<div dir="ltr"><div>Thanks Pedro!</div><div>You are been so clear!!!</div><div>So, excuse for my pedantry, the old stuff that I had used with picketlink and deltaspike I must forget:</div><div><br></div><div>es: @LoggedIn, CDI that call picketlink lib etc etc.</div><div><br></div><div>In clear I must use only the code that you suggest me... what I read in our site, in particular in <a href="http://picketlink.org/keycloak-merge-faq/">http://picketlink.org/keycloak-merge-faq/</a> </div><div><br></div><div>"Q) What happens with PicketLink Java EE related capabilities</div><div>A) Based on experience gained with PicketLink project we’ll be introducing Keycloak SDK component including libraries for easier integration with Java EE applications"</div><div><br></div><div>It must interpret as the code you suggest me? </div><div><br></div><div>Thanks very much!</div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">2016-02-17 2:37 GMT+01:00 Pedro Igor Silva <span dir="ltr"><<a href="mailto:psilva@redhat.com" target="_blank">psilva@redhat.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Stefano,<br>
<br>
In KC you can use standard JEE security mechanisms to perform RBAC.<br>
<br>
Another thing you can do is obtain a KeycloakSecurityContext and get roles or any other claim from there. Something like:<br>
<br>
KeycloakSecurityContext securityContext = (KeycloakSecurityContext) request.getAttribute(KeycloakSecurityContext.class.getName());<br>
AccessToken token = securityContext.getToken();<br>
AccessToken.Access realmAccess = token.getRealmAccess();<br>
<br>
if (realmAccess.isUserInRole("admin")) {<br>
// do admin stuff<br>
}<br>
<br>
You can use a lot of information from the AccessToken to perform local authorization checks. Above is RBAC, but you can also use claims to perform ABAC, for instance.<br>
<br>
Regards.<br>
Pedro Igor<br>
<div><div class="h5"><br>
----- Original Message -----<br>
From: "Stefano Zaccaria" <<a href="mailto:zaquas@gmail.com">zaquas@gmail.com</a>><br>
To: <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
Sent: Tuesday, February 16, 2016 9:59:13 PM<br>
Subject: [keycloak-user] Use keycloak as I used picketlink<br>
<br>
<br>
<br>
<br>
Hello to all,<br>
I want to change from picketlink to keycloak<br>
In my ee app I use keycloack CDI to check the user roles and grant with BasicModel.hasRole(relationshipManager, identity.getAccount(), BasicModel.getRole(identityManager, "admin"))<br>
or<br>
Authorization Util.hasRole(identity, partitionManager, "admin");<br>
in my bean methods<br>
How can I made the same thing with Keycloak?<br>
Thanks in advantage<br>
<br>
Stefano<br>
<br>
</div></div>_______________________________________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><i>Stefano</i><div><i><span></span><span></span><br></i></div></div>
</div>