-
Notifications
You must be signed in to change notification settings - Fork 13
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #46 from mgdgl/master
Ignoring role name case on service account role synchronization
- Loading branch information
Showing
8 changed files
with
820 additions
and
53 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
101 changes: 101 additions & 0 deletions
101
src/main/java/com/kiwigrid/keycloak/controller/client/ServiceAccountRoleAssignment.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,101 @@ | ||
| package com.kiwigrid.keycloak.controller.client; | ||
|
|
||
| import java.util.List; | ||
| import java.util.stream.Collectors; | ||
|
|
||
| import javax.inject.Singleton; | ||
| import org.keycloak.admin.client.resource.RealmResource; | ||
| import org.keycloak.admin.client.resource.RoleMappingResource; | ||
| import org.keycloak.representations.idm.RoleRepresentation; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
|
|
||
| @Singleton | ||
| public class ServiceAccountRoleAssignment { | ||
| private final Logger LOG = LoggerFactory.getLogger(getClass()); | ||
|
|
||
| public List<RoleRepresentation> findAssignedRolesToRemoveWith(RealmResource realmResource, | ||
| ClientResource clientResource, String clientUuid) | ||
| { | ||
| List<RoleRepresentation> assignedServiceAccountRoles = getAssignedServiceAccountRoles( | ||
| realmResource, | ||
| clientUuid); | ||
| List<String> requestedServiceAccountRoleNames = getRequestedServiceAccountRoleNamesFrom( | ||
| clientResource); | ||
|
|
||
| return assignedServiceAccountRoles | ||
| .stream() | ||
| .filter(roleRepresentation -> !requestedServiceAccountRoleNames | ||
| .stream() | ||
| .anyMatch(roleName -> roleName.equalsIgnoreCase(roleRepresentation.getName()))) | ||
| .collect(Collectors.toList()); | ||
| } | ||
|
|
||
| private List<String> getRequestedServiceAccountRoleNamesFrom(ClientResource clientResourceDefinition) { | ||
| return clientResourceDefinition | ||
| .getSpec() | ||
| .getServiceAccountRealmRoles(); | ||
| } | ||
|
|
||
| private List<RoleRepresentation> getAssignedServiceAccountRoles(RealmResource realmResource, String clientUuid) { | ||
| org.keycloak.admin.client.resource.ClientResource keycloakClientResource = realmResource.clients() | ||
| .get(clientUuid); | ||
| return realmResource.users() | ||
| .get(keycloakClientResource.getServiceAccountUser().getId()) | ||
| .roles().getAll().getRealmMappings(); | ||
| } | ||
|
|
||
| public List<RoleRepresentation> findRolesToAssignWith(RealmResource realmResource, | ||
| ClientResource clientResourceDefinition, String clientUuid) | ||
| { | ||
| List<RoleRepresentation> assignedServiceAccountRoles = getAssignedServiceAccountRoles( | ||
| realmResource, | ||
| clientUuid); | ||
| List<String> requestedServiceAccountRoleNames = getRequestedServiceAccountRoleNamesFrom( | ||
| clientResourceDefinition); | ||
| List<RoleRepresentation> serviceAccountRealmRoles = realmResource.roles().list(); | ||
|
|
||
| var unassignedRequestedRoleNames = requestedServiceAccountRoleNames.stream() | ||
| .filter(roleName -> !assignedServiceAccountRoles.stream() | ||
| .anyMatch(roleRepresentation -> roleName.equalsIgnoreCase(roleRepresentation.getName()))) | ||
| .collect(Collectors.toList()); | ||
|
|
||
| return serviceAccountRealmRoles.stream() | ||
| .filter(roleRepresentation -> unassignedRequestedRoleNames.stream() | ||
| .anyMatch(roleName -> roleRepresentation.getName().equalsIgnoreCase(roleName))) | ||
| .collect(Collectors.toList()); | ||
| } | ||
|
|
||
| public List<RoleRepresentation> findRequestedRolesToCreateWith(RealmResource realmResource, | ||
| ClientResource clientResourceDefinition) | ||
| { | ||
| List<RoleRepresentation> serviceAccountRealmRoleMappings = realmResource.roles().list(); | ||
|
|
||
| return getRequestedServiceAccountRoleNamesFrom(clientResourceDefinition) | ||
| .stream() | ||
| .filter(roleName -> !serviceAccountRealmRoleMappings | ||
| .stream() | ||
| .anyMatch(roleRepresentation -> roleRepresentation | ||
| .getName() | ||
| .equalsIgnoreCase(roleName))) | ||
| .map(this::createRoleRepresentation) | ||
| .collect(Collectors.toList()); | ||
| } | ||
|
|
||
| RoleRepresentation createRoleRepresentation(String roleName) { | ||
| var roleRepresentation = new RoleRepresentation(); | ||
| roleRepresentation.setName(roleName); | ||
| roleRepresentation.setClientRole(false); | ||
| roleRepresentation.setComposite(false); | ||
| return roleRepresentation; | ||
| } | ||
|
|
||
| public RoleMappingResource getServiceAccountRoleMappingsFor(RealmResource realmResource, String clientUuid) { | ||
| return realmResource.users() | ||
| .get(realmResource | ||
| .clients() | ||
| .get(clientUuid) | ||
| .getServiceAccountUser() | ||
| .getId()).roles(); | ||
| } | ||
| } |
100 changes: 100 additions & 0 deletions
100
...ava/com/kiwigrid/keycloak/controller/client/ServiceAccountRoleAssignmentSynchronizer.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| package com.kiwigrid.keycloak.controller.client; | ||
|
|
||
| import java.util.List; | ||
| import java.util.stream.Collectors; | ||
|
|
||
| import javax.inject.Singleton; | ||
| import org.keycloak.admin.client.resource.RealmResource; | ||
| import org.keycloak.admin.client.resource.RoleMappingResource; | ||
| import org.keycloak.representations.idm.RoleRepresentation; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
|
|
||
| @Singleton | ||
| public class ServiceAccountRoleAssignmentSynchronizer { | ||
| private final Logger LOG = LoggerFactory.getLogger(getClass()); | ||
| private final ServiceAccountRoleAssignment serviceAccountRoleAssignment; | ||
|
|
||
| public ServiceAccountRoleAssignmentSynchronizer(ServiceAccountRoleAssignment serviceAccountRoleAssignment) { | ||
| this.serviceAccountRoleAssignment = serviceAccountRoleAssignment; | ||
| } | ||
|
|
||
| public void synchronizeServiceAccountRealmRoles(RealmResource realmResource, ClientResource clientResourceDefinition, String clientUuid) { | ||
| var keycloak = clientResourceDefinition.getSpec().getKeycloak(); | ||
| var realm = clientResourceDefinition.getSpec().getRealm(); | ||
| var clientId = clientResourceDefinition.getSpec().getClientId(); | ||
|
|
||
| RoleMappingResource serviceAccountRoleMappings = serviceAccountRoleAssignment.getServiceAccountRoleMappingsFor( | ||
| realmResource, | ||
| clientUuid); | ||
|
|
||
| List<RoleRepresentation> assignedServiceAccountRolesToRemove = serviceAccountRoleAssignment | ||
| .findAssignedRolesToRemoveWith( | ||
| realmResource, | ||
| clientResourceDefinition, | ||
| clientUuid); | ||
|
|
||
| if (!assignedServiceAccountRolesToRemove.isEmpty()) { | ||
| removeAssignedRolesFromServiceAccount(keycloak, | ||
| realm, | ||
| clientId, | ||
| serviceAccountRoleMappings, | ||
| assignedServiceAccountRolesToRemove); | ||
| } | ||
|
|
||
| List<RoleRepresentation> serviceAccountRealmRolesToCreate = serviceAccountRoleAssignment | ||
| .findRequestedRolesToCreateWith( | ||
| realmResource, | ||
| clientResourceDefinition); | ||
|
|
||
| if (!serviceAccountRealmRolesToCreate.isEmpty()) { | ||
| createNewRealmRoles(realmResource, keycloak, realm, clientId, serviceAccountRealmRolesToCreate); | ||
| } | ||
|
|
||
| List<RoleRepresentation> serviceAccountRolesToAssign = serviceAccountRoleAssignment | ||
| .findRolesToAssignWith( | ||
| realmResource, | ||
| clientResourceDefinition, | ||
| clientUuid); | ||
|
|
||
| if (!serviceAccountRolesToAssign.isEmpty()) { | ||
| assignRequestedRolesToServiceAccount(keycloak, | ||
| realm, | ||
| clientId, | ||
| serviceAccountRoleMappings, | ||
| serviceAccountRolesToAssign); | ||
| } | ||
| } | ||
|
|
||
| private void removeAssignedRolesFromServiceAccount(String keycloak, String realm, String clientId, RoleMappingResource serviceAccountRoleMappings, List<RoleRepresentation> assignedServiceAccountRolesToRemove) { | ||
| serviceAccountRoleMappings.realmLevel().remove(assignedServiceAccountRolesToRemove); | ||
| LOG.info("{}/{}/{}: deleted roles not requested anymore {}", | ||
| keycloak, | ||
| realm, | ||
| clientId, | ||
| assignedServiceAccountRolesToRemove.stream() | ||
| .map(RoleRepresentation::getName) | ||
| .collect(Collectors.toList())); | ||
| } | ||
|
|
||
| private void createNewRealmRoles(RealmResource realmResource, String keycloak, String realm, String clientId, List<RoleRepresentation> serviceAccountRealmRolesToCreate) { | ||
| serviceAccountRealmRolesToCreate.stream() | ||
| .forEach(roleRepresentation -> realmResource.roles().create(roleRepresentation)); | ||
| LOG.info("{}/{}/{}: created realm roles {}", | ||
| keycloak, | ||
| realm, | ||
| clientId, | ||
| serviceAccountRealmRolesToCreate.stream() | ||
| .map(RoleRepresentation::getName) | ||
| .collect(Collectors.toList())); | ||
| } | ||
|
|
||
| private void assignRequestedRolesToServiceAccount(String keycloak, String realm, String clientId, RoleMappingResource serviceAccountRoleMappings, List<RoleRepresentation> serviceAccountRolesToAssign) { | ||
| serviceAccountRoleMappings.realmLevel().add(serviceAccountRolesToAssign); | ||
| LOG.info("{}/{}/{}: assigned realm roles {}", | ||
| keycloak, | ||
| realm, | ||
| clientId, | ||
| serviceAccountRolesToAssign.stream().map(RoleRepresentation::getName).collect(Collectors.toList())); | ||
| } | ||
| } |
Oops, something went wrong.