[KEYCLOAK-7849] - Improvements to RPT upgrade

authz/client/src/main/java/org/keycloak/authorization/client/util/HttpMethodAuthenticator.java

@@ -25,8 +25,8 @@
 import org.keycloak.authorization.client.ClientAuthenticator;
 import org.keycloak.representations.idm.authorization.AuthorizationRequest;
 import org.keycloak.representations.idm.authorization.AuthorizationRequest.Metadata;
+import org.keycloak.representations.idm.authorization.Permission;
 import org.keycloak.representations.idm.authorization.PermissionTicketToken;
-import org.keycloak.representations.idm.authorization.PermissionTicketToken.ResourcePermission;
 
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
@@ -80,13 +80,13 @@ public HttpMethod<R> uma(AuthorizationRequest request) {
         method.param("claim_token", request.getClaimToken());
         method.param("claim_token_format", request.getClaimTokenFormat());
         method.param("pct", request.getPct());
-        method.param("rpt", request.getRpt());
+        method.param("rpt", request.getRptToken());
         method.param("scope", request.getScope());
         method.param("audience", request.getAudience());
         method.param("subject_token", request.getSubjectToken());
 
         if (permissions != null) {
-            for (ResourcePermission permission : permissions.getResources()) {
+            for (Permission permission : permissions.getPermissions()) {
                 String resourceId = permission.getResourceId();
                 Set<String> scopes = permission.getScopes();
                 StringBuilder value = new StringBuilder();

core/src/main/java/org/keycloak/representations/idm/authorization/AuthorizationRequest.java

@@ -23,15 +23,14 @@
 import java.util.List;
 import java.util.Map;
 
-import org.keycloak.representations.idm.authorization.PermissionTicketToken.ResourcePermission;
+import org.keycloak.representations.AccessToken;
 
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
  */
 public class AuthorizationRequest {
 
     private String ticket;
-    private String rpt;
     private String claimToken;
     private String claimTokenFormat;
     private String pct;
@@ -42,6 +41,8 @@ public class AuthorizationRequest {
     private String subjectToken;
     private boolean submitRequest;
     private Map<String, List<String>> claims;
+    private AccessToken rpt;
+    private String rptToken;
 
     public AuthorizationRequest(String ticket) {
         this.ticket = ticket;
@@ -59,14 +60,22 @@ public void setTicket(String ticket) {
         this.ticket = ticket;
     }
 
-    public String getRpt() {
+    public AccessToken getRpt() {
         return this.rpt;
     }
 
-    public void setRpt(String rpt) {
+    public void setRpt(AccessToken rpt) {
         this.rpt = rpt;
     }
 
+    public void setRpt(String rpt) {
+        this.rptToken = rpt;
+    }
+
+    public String getRptToken() {
+        return rptToken;
+    }
+
     public void setClaimToken(String claimToken) {
         this.claimToken = claimToken;
     }
@@ -145,21 +154,21 @@ public void addPermission(String resourceId, List<String> scopes) {
 
     public void addPermission(String resourceId, String... scopes) {
         if (permissions == null) {
-            permissions = new PermissionTicketToken(new ArrayList<ResourcePermission>());
+            permissions = new PermissionTicketToken(new ArrayList<Permission>());
         }
 
-        ResourcePermission permission = null;
+        Permission permission = null;
 
-        for (ResourcePermission resourcePermission : permissions.getResources()) {
+        for (Permission resourcePermission : permissions.getPermissions()) {
             if (resourcePermission.getResourceId() != null && resourcePermission.getResourceId().equals(resourceId)) {
                 permission = resourcePermission;
                 break;
             }
         }
 
         if (permission == null) {
-            permission = new ResourcePermission(resourceId, new HashSet<String>());
-            permissions.getResources().add(permission);
+            permission = new Permission(resourceId, new HashSet<String>());
+            permissions.getPermissions().add(permission);
         }
 
         permission.getScopes().addAll(Arrays.asList(scopes));

core/src/main/java/org/keycloak/representations/idm/authorization/Permission.java

@@ -33,7 +33,7 @@ public class Permission {
     private String resourceId;
 
     @JsonProperty("rsname")
-    private final String resourceName;
+    private String resourceName;
 
     @JsonInclude(JsonInclude.Include.NON_EMPTY)
     private Set<String> scopes;
@@ -45,17 +45,29 @@ public Permission() {
         this(null, null, null, null);
     }
 
+    public Permission(final String resourceId, final Set<String> scopes) {
+        this(resourceId, null, scopes, null);
+    }
+
     public Permission(final String resourceId, String resourceName, final Set<String> scopes, Map<String, Set<String>> claims) {
         this.resourceId = resourceId;
         this.resourceName = resourceName;
         this.scopes = scopes;
         this.claims = claims;
     }
 
+    public void setResourceId(String resourceId) {
+        this.resourceId = resourceId;
+    }
+
     public String getResourceId() {
         return this.resourceId;
     }
 
+    public void setResourceName(String resourceName) {
+        this.resourceName = resourceName;
+    }
+
     public String getResourceName() {
         return this.resourceName;
     }
@@ -75,11 +87,29 @@ public Map<String, Set<String>> getClaims() {
     @Override
     public boolean equals(Object o) {
         if (this == o) return true;
-        if (o == null || getClass() != o.getClass()) return false;
+        if (o == null || !getClass().isAssignableFrom(o.getClass())) return false;
 
         Permission that = (Permission) o;
 
-        return getResourceId().equals(that.resourceId);
+        if (getResourceId() != null || getResourceName() != null) {
+            if (!getResourceId().equals(that.resourceId)) {
+                return false;
+            }
+
+            if (getScopes().isEmpty() && that.getScopes().isEmpty()) {
+                return true;
+            }
+        } else if (that.resourceId != null) {
+            return false;
+        }
+
+        for (String scope : that.getScopes()) {
+            if (getScopes().contains(scope)) {
+                return true;
+            }
+        }
+
+        return false;
     }
 
     @Override

core/src/main/java/org/keycloak/representations/idm/authorization/PermissionTicketToken.java

@@ -33,16 +33,16 @@
  */
 public class PermissionTicketToken extends JsonWebToken {
 
-    private final List<ResourcePermission> resources;
+    private final List<Permission> permissions;
 
     @JsonDeserialize(using = StringListMapDeserializer.class)
     private Map<String, List<String>> claims;
 
     public PermissionTicketToken() {
-        this(new ArrayList<ResourcePermission>());
+        this(new ArrayList<Permission>());
     }
 
-    public PermissionTicketToken(List<ResourcePermission> resources, String audience, AccessToken accessToken) {
+    public PermissionTicketToken(List<Permission> permissions, String audience, AccessToken accessToken) {
         if (accessToken != null) {
             id(TokenIdGenerator.generateId());
             subject(accessToken.getSubject());
@@ -54,15 +54,15 @@ public PermissionTicketToken(List<ResourcePermission> resources, String audience
         if (audience != null) {
             audience(audience);
         }
-        this.resources = resources;
+        this.permissions = permissions;
     }
 
-    public PermissionTicketToken(List<ResourcePermission> resources) {
+    public PermissionTicketToken(List<Permission> resources) {
         this(resources, null, null);
     }
 
-    public List<ResourcePermission> getResources() {
-        return this.resources;
+    public List<Permission> getPermissions() {
+        return this.permissions;
     }
 
     public Map<String, List<String>> getClaims() {
@@ -72,29 +72,4 @@ public Map<String, List<String>> getClaims() {
     public void setClaims(Map<String, List<String>> claims) {
         this.claims = claims;
     }
-
-    public static class ResourcePermission {
-
-        @JsonProperty("id")
-        private String resourceId;
-
-        @JsonProperty("scopes")
-        private Set<String> scopes;
-
-        public ResourcePermission() {
-        }
-
-        public ResourcePermission(String resourceId, Set<String> scopes) {
-            this.resourceId = resourceId;
-            this.scopes = scopes;
-        }
-
-        public String getResourceId() {
-            return resourceId;
-        }
-
-        public Set<String> getScopes() {
-            return scopes;
-        }
-    }
 }

server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/PermissionTicketAwareDecisionResultCollector.java

@@ -31,11 +31,11 @@
 import org.keycloak.authorization.model.ResourceServer;
 import org.keycloak.authorization.model.Scope;
 import org.keycloak.authorization.permission.ResourcePermission;
-import org.keycloak.authorization.policy.evaluation.Result.PolicyResult;
 import org.keycloak.authorization.store.ResourceStore;
 import org.keycloak.authorization.store.ScopeStore;
 import org.keycloak.authorization.store.StoreFactory;
 import org.keycloak.representations.idm.authorization.AuthorizationRequest;
+import org.keycloak.representations.idm.authorization.Permission;
 import org.keycloak.representations.idm.authorization.PermissionTicketToken;
 
 /**
@@ -75,12 +75,12 @@ private void removePermissionsIfGranted(DefaultEvaluation evaluation) {
 
             if ("uma".equals(policy.getType())) {
                 ResourcePermission grantedPermission = evaluation.getPermission();
-                List<PermissionTicketToken.ResourcePermission> permissions = ticket.getResources();
+                List<Permission> permissions = ticket.getPermissions();
 
-                Iterator<PermissionTicketToken.ResourcePermission> itPermissions = permissions.iterator();
+                Iterator<Permission> itPermissions = permissions.iterator();
 
                 while (itPermissions.hasNext()) {
-                    PermissionTicketToken.ResourcePermission permission = itPermissions.next();
+                    Permission permission = itPermissions.next();
 
                     if (permission.getResourceId().equals(grantedPermission.getResource().getId())) {
                         Set<String> scopes = permission.getScopes();
@@ -109,10 +109,10 @@ public void onComplete() {
         if (request.isSubmitRequest()) {
             StoreFactory storeFactory = authorization.getStoreFactory();
             ResourceStore resourceStore = storeFactory.getResourceStore();
-            List<PermissionTicketToken.ResourcePermission> permissions = ticket.getResources();
+            List<Permission> permissions = ticket.getPermissions();
 
             if (permissions != null) {
-                for (PermissionTicketToken.ResourcePermission permission : permissions) {
+                for (Permission permission : permissions) {
                     Resource resource = resourceStore.findById(permission.getResourceId(), resourceServer.getId());
 
                     if (resource == null) {