org.keycloak.authorization.policy.evaluation

Interface Realm

public interface Realm

This interface provides methods to query information from a realm.

Author:

Pedro Igor

Method Summary

Modifier and Type	Method and Description
Map<String,List<String>>	getUserAttributes(String id) Returns all attributes associated with the a user with the given id.
List<String>	getUserClientRoles(String id, String clientId) Returns all client roles granted for a user with the given id.
List<String>	getUserGroups(String id) Returns all groups which the user with the given id is a member.
List<String>	getUserRealmRoles(String id) Returns all realm roles granted for a user with the given id.
boolean	isGroupInRole(String group, String role) Checks whether or not a group is granted with the given realm role.
boolean	isUserInClientRole(String id, String clientId, String role) Checks whether or not a user with the given id is granted with the given client role.
default boolean	isUserInGroup(String id, String group) Checks whether or not a user with the given id is a member of the given group.
boolean	isUserInGroup(String id, String group, boolean checkParent) Checks whether or not a user with the given id is a member of the given group.
boolean	isUserInRealmRole(String id, String role) Checks whether or not a user with the given id is granted with the given realm role.

Method Detail

isUserInGroup

default boolean isUserInGroup(String id,
                              String group)

Checks whether or not a user with the given id is a member of the given group.

This method will also consider memberships where the user is a member of any child group of the given group. For instance, if user is member of /Group A/Group B and this method is checking if user is a member of /Group A the result will be true given that the user is a member of a child group of /Group A.

Parameters:

id - the user id. It can be the id, username or email

group - the group path. For instance, /Group A/Group B.

Returns:

true if user is a member of the given group. Otherwise returns false.

isUserInGroup

boolean isUserInGroup(String id,
                      String group,
                      boolean checkParent)

Checks whether or not a user with the given id is a member of the given group.

Parameters:

id - the user id. It can be the id, username or email

group - the group path. For instance, /Group A/Group B.

checkParent - if true, this method returns true even though the user is not directly associated with the given group but a member of any child of the group.

Returns:

true if user is a member of the given group. Otherwise returns false.

isUserInRealmRole

boolean isUserInRealmRole(String id,
                          String role)

Checks whether or not a user with the given id is granted with the given realm role.

Parameters:

id - the user id. It can be the id, username or email

role - the role name

Returns:

true if the user is granted with the role. Otherwise, false.

isUserInClientRole

boolean isUserInClientRole(String id,
                           String clientId,
                           String role)

Checks whether or not a user with the given id is granted with the given client role.

Parameters:

id - the user id. It can be the id, username or email

clientId - the client id

role - the role name

Returns:

true if the user is granted with the role. Otherwise, false.

isGroupInRole

boolean isGroupInRole(String group,
                      String role)

Checks whether or not a group is granted with the given realm role.

Parameters:

group - the group path. For instance, /Group A/Group B.

role - the role name

Returns:

true if the group is granted with the role. Otherwise, false.

getUserRealmRoles

List<String> getUserRealmRoles(String id)

Returns all realm roles granted for a user with the given id.

Parameters:

id - the user id. It can be the id, username or email

Returns:

the roles granted to the user

getUserClientRoles

List<String> getUserClientRoles(String id,
                                String clientId)

Returns all client roles granted for a user with the given id.

Parameters:

id - the user id. It can be the id, username or email

clientId - the client id

Returns:

the roles granted to the user

getUserGroups

List<String> getUserGroups(String id)

Returns all groups which the user with the given id is a member.

Parameters:

id - the user id. It can be the id, username or email

Returns:

the groups which the user is a member

getUserAttributes

Map<String,List<String>> getUserAttributes(String id)

Returns all attributes associated with the a user with the given id.

Parameters:

id - the user id. It can be the id, username or email

Returns:

a map with the attributes associated with the user