|
|
|
@@ -12,18 +12,15 @@ import org.keycloak.adapters.authorization.spi.ConfigurationResolver
|
|
|
|
|
import org.keycloak.adapters.authorization.spi.HttpRequest
|
|
|
|
|
import org.keycloak.representations.adapters.config.PolicyEnforcerConfig
|
|
|
|
|
import java.io.IOException
|
|
|
|
|
import java.util.concurrent.ConcurrentHashMap
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class SpringPolicyEnforcerFilter(private val configResolver: ConfigurationResolver) : Filter {
|
|
|
|
|
private val policyEnforcer: MutableMap<PolicyEnforcerConfig, SpringPolicyEnforcer> = ConcurrentHashMap()
|
|
|
|
|
|
|
|
|
|
@Throws(IOException::class, ServletException::class)
|
|
|
|
|
override fun doFilter(servletRequest: ServletRequest, servletResponse: ServletResponse?, filterChain: FilterChain) {
|
|
|
|
|
val request = servletRequest as HttpServletRequest
|
|
|
|
|
val response = servletResponse as HttpServletResponse?
|
|
|
|
|
val httpRequest = ServletHttpRequest(request) { extractBearerToken(request) }
|
|
|
|
|
val policyEnforcer = getOrCreatePolicyEnforcer(httpRequest)
|
|
|
|
|
val policyEnforcer = createPolicyEnforcer(httpRequest)
|
|
|
|
|
val authzContext = policyEnforcer.enforce(httpRequest, ServletHttpResponse(response))
|
|
|
|
|
request.setAttribute(AuthorizationContext::class.java.name, authzContext)
|
|
|
|
|
if (authzContext.isGranted) {
|
|
|
|
@@ -53,8 +50,8 @@ class SpringPolicyEnforcerFilter(private val configResolver: ConfigurationResolv
|
|
|
|
|
return null
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private fun getOrCreatePolicyEnforcer(request: HttpRequest): SpringPolicyEnforcer {
|
|
|
|
|
return policyEnforcer.computeIfAbsent(configResolver.resolve(request)) { createPolicyEnforcer(it) }
|
|
|
|
|
private fun createPolicyEnforcer(request: HttpRequest): SpringPolicyEnforcer {
|
|
|
|
|
return createPolicyEnforcer(configResolver.resolve(request))
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private fun createPolicyEnforcer(enforcerConfig: PolicyEnforcerConfig): SpringPolicyEnforcer {
|
|
|
|
|