Hi again, I use a small javascript policy: var context = $evaluation.getContext(); var permission = $evaluation.getPermission(); var identity = context.getIdentity(); if (identity.id == permission.getResource().getOwner()) { $evaluation.grant(); } But this gets me an error: Unexpected error while evaluating permissions: java.lang.RuntimeException: Failed to evaluate permissions at org.keycloak.authorization.permission.evaluator. IterablePermissionEvaluator$1.onError(IterablePermissionEvaluator.java:66) at org.keycloak.authorization.permission.evaluator. IterablePermissionEvaluator.evaluate(IterablePermissionEvaluator.java:54) at org.keycloak.authorization.permission.evaluator. IterablePermissionEvaluator.evaluate(IterablePermissionEvaluator.java:63) at org.keycloak.authorization.authorization.AuthorizationTokenService. evaluatePermissions(AuthorizationTokenService.java:208) ... Caused by: org.keycloak.scripting.ScriptExecutionException: Could not execute script 'Resource owner' problem was: TypeError: null has no such function "getOwner" in <eval> at line number 4 at org.keycloak.scripting.AbstractEvaluatableScriptAdapter.evalUnchecked( AbstractEvaluatableScriptAdapter.java:64) at org.keycloak.scripting.AbstractEvaluatableScriptAdapter.eval( AbstractEvaluatableScriptAdapter.java:30) I noticed this happens only with scope-based policies, so maybe it's the same problem than before? _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

So how to retrieve the resource associated with this request? For instance I want to delete a sensor named MySensorsXXX: curl -X POST http://localhost:8080/auth/realms/waziup/protocol/openid- connect/token -H "Authorization: Bearer $USERTOKEN" -d "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket& audience=api-server&permission=MySensorsXXX#sensors:delete" I have a scope-based policy, where I check if you are owner. On Wed, Jul 4, 2018 at 3:07 PM, Pedro Igor Silva <psilva(a)redhat.com&gt; wrote: > This is because the permission is not for the resource (it does not > exist) but for scopes. So resource is null. > > On Wed, Jul 4, 2018 at 9:38 AM, Corentin Dupont < > corentin.dupont(a)gmail.com&gt; wrote: > >> Hi again, >> I use a small javascript policy: >> >> var context = $evaluation.getContext(); >> var permission = $evaluation.getPermission(); >> var identity = context.getIdentity(); >> if (identity.id == permission.getResource().getOwner()) { >> $evaluation.grant(); >> } >> >> >> But this gets me an error: >> >> Unexpected error while evaluating permissions: >> java.lang.RuntimeException: >> Failed to evaluate permissions >> at >> org.keycloak.authorization.permission.evaluator.IterablePerm >> issionEvaluator$1.onError(IterablePermissionEvaluator.java:66) >> at >> org.keycloak.authorization.permission.evaluator.IterablePerm >> issionEvaluator.evaluate(IterablePermissionEvaluator.java:54) >> at >> org.keycloak.authorization.permission.evaluator.IterablePerm >> issionEvaluator.evaluate(IterablePermissionEvaluator.java:63) >> at >> org.keycloak.authorization.authorization.AuthorizationTokenS >> ervice.evaluatePermissions(AuthorizationTokenService.java:208) >> ... >> Caused by: org.keycloak.scripting.ScriptExecutionException: Could not >> execute script 'Resource owner' problem was: TypeError: null has no such >> function "getOwner" in <eval> at line number 4 >> at >> org.keycloak.scripting.AbstractEvaluatableScriptAdapter.eval >> Unchecked(AbstractEvaluatableScriptAdapter.java:64) >> at >> org.keycloak.scripting.AbstractEvaluatableScriptAdapter.eval >> (AbstractEvaluatableScriptAdapter.java:30) >> >> >> I noticed this happens only with scope-based policies, so maybe it's the >> same problem than before? >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-user >> > >

Yes I want to have permissions for each resource associated with that scope. Basically, I have: Resource: ------------- name: MySensorsXXX scope: [sensors:update, sensors:delete] Policy: --------- name: Resource owner type: javascript Permission: -------------- name: Delete Sensor type: scope-based Scopes: [sensors:delete] Apply Policy: Resource owner Based on this setting, I want to ask Keycloak if I can delete a particular sensor, named MySensorsXXX. Keycloak should approve only if I'm owner. Is it the correct way to do it? On Wed, Jul 4, 2018 at 3:28 PM, Pedro Igor Silva <psilva(a)redhat.com&gt; wrote: > Could you deny if requested permission is not for a resource ? Or do you > want to have permissions for each resource associated with that scope ? > > On Wed, Jul 4, 2018 at 10:16 AM, Corentin Dupont < > corentin.dupont(a)gmail.com&gt; wrote: > >> So how to retrieve the resource associated with this request? >> >> For instance I want to delete a sensor named MySensorsXXX: >> >> curl -X POST http://localhost:8080/auth/rea >> lms/waziup/protocol/openid-connect/token -H "Authorization: Bearer >> $USERTOKEN" -d "grant_type=urn:ietf:params:oa >> uth:grant-type:uma-ticket&audience=api-server&permission=MyS >> ensorsXXX#sensors:delete" >> >> I have a scope-based policy, where I check if you are owner. >> >> >> >> On Wed, Jul 4, 2018 at 3:07 PM, Pedro Igor Silva <psilva(a)redhat.com&gt; >> wrote: >> >>> This is because the permission is not for the resource (it does not >>> exist) but for scopes. So resource is null. >>> >>> On Wed, Jul 4, 2018 at 9:38 AM, Corentin Dupont < >>> corentin.dupont(a)gmail.com&gt; wrote: >>> >>>> Hi again, >>>> I use a small javascript policy: >>>> >>>> var context = $evaluation.getContext(); >>>> var permission = $evaluation.getPermission(); >>>> var identity = context.getIdentity(); >>>> if (identity.id == permission.getResource().getOwner()) { >>>> $evaluation.grant(); >>>> } >>>> >>>> >>>> But this gets me an error: >>>> >>>> Unexpected error while evaluating permissions: >>>> java.lang.RuntimeException: >>>> Failed to evaluate permissions >>>> at >>>> org.keycloak.authorization.permission.evaluator.IterablePerm >>>> issionEvaluator$1.onError(IterablePermissionEvaluator.java:66) >>>> at >>>> org.keycloak.authorization.permission.evaluator.IterablePerm >>>> issionEvaluator.evaluate(IterablePermissionEvaluator.java:54) >>>> at >>>> org.keycloak.authorization.permission.evaluator.IterablePerm >>>> issionEvaluator.evaluate(IterablePermissionEvaluator.java:63) >>>> at >>>> org.keycloak.authorization.authorization.AuthorizationTokenS >>>> ervice.evaluatePermissions(AuthorizationTokenService.java:208) >>>> ... >>>> Caused by: org.keycloak.scripting.ScriptExecutionException: Could not >>>> execute script 'Resource owner' problem was: TypeError: null has no >>>> such >>>> function "getOwner" in <eval> at line number 4 >>>> at >>>> org.keycloak.scripting.AbstractEvaluatableScriptAdapter.eval >>>> Unchecked(AbstractEvaluatableScriptAdapter.java:64) >>>> at >>>> org.keycloak.scripting.AbstractEvaluatableScriptAdapter.eval >>>> (AbstractEvaluatableScriptAdapter.java:30) >>>> >>>> >>>> I noticed this happens only with scope-based policies, so maybe it's >>>> the >>>> same problem than before? >>>> _______________________________________________ >>>> keycloak-user mailing list >>>> keycloak-user(a)lists.jboss.org >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>>> >>> >>> >> >

Sorry, should *not* get a null reference ... On Wed, Jul 4, 2018 at 11:12 AM, Pedro Igor Silva <psilva(a)redhat.com&gt; wrote: > Yeah it is fine, and if you ask permissions for MySensorsXXX (considering > resource exists) you should get a null reference in your JS policy. > > On Wed, Jul 4, 2018 at 11:07 AM, Corentin Dupont < > corentin.dupont(a)gmail.com&gt; wrote: > >> Yes I want to have permissions for each resource associated with that >> scope. >> Basically, I have: >> >> Resource: >> ------------- >> name: MySensorsXXX >> scope: [sensors:update, sensors:delete] >> >> Policy: >> --------- >> name: Resource owner >> type: javascript >> >> Permission: >> -------------- >> name: Delete Sensor >> type: scope-based >> Scopes: [sensors:delete] >> Apply Policy: Resource owner >> >> Based on this setting, I want to ask Keycloak if I can delete a >> particular sensor, named MySensorsXXX. >> Keycloak should approve only if I'm owner. >> Is it the correct way to do it? >> >> >> >> >> >> >> >> >> On Wed, Jul 4, 2018 at 3:28 PM, Pedro Igor Silva <psilva(a)redhat.com&gt; >> wrote: >> >>> Could you deny if requested permission is not for a resource ? Or do >>> you want to have permissions for each resource associated with that scope ? >>> >>> On Wed, Jul 4, 2018 at 10:16 AM, Corentin Dupont < >>> corentin.dupont(a)gmail.com&gt; wrote: >>> >>>> So how to retrieve the resource associated with this request? >>>> >>>> For instance I want to delete a sensor named MySensorsXXX: >>>> >>>> curl -X POST http://localhost:8080/auth/rea >>>> lms/waziup/protocol/openid-connect/token -H "Authorization: Bearer >>>> $USERTOKEN" -d "grant_type=urn:ietf:params:oa >>>> uth:grant-type:uma-ticket&audience=api-server&permission=MyS >>>> ensorsXXX#sensors:delete" >>>> >>>> I have a scope-based policy, where I check if you are owner. >>>> >>>> >>>> >>>> On Wed, Jul 4, 2018 at 3:07 PM, Pedro Igor Silva <psilva(a)redhat.com&gt; >>>> wrote: >>>> >>>>> This is because the permission is not for the resource (it does not >>>>> exist) but for scopes. So resource is null. >>>>> >>>>> On Wed, Jul 4, 2018 at 9:38 AM, Corentin Dupont < >>>>> corentin.dupont(a)gmail.com&gt; wrote: >>>>> >>>>>> Hi again, >>>>>> I use a small javascript policy: >>>>>> >>>>>> var context = $evaluation.getContext(); >>>>>> var permission = $evaluation.getPermission(); >>>>>> var identity = context.getIdentity(); >>>>>> if (identity.id == permission.getResource().getOwner()) { >>>>>> $evaluation.grant(); >>>>>> } >>>>>> >>>>>> >>>>>> But this gets me an error: >>>>>> >>>>>> Unexpected error while evaluating permissions: >>>>>> java.lang.RuntimeException: >>>>>> Failed to evaluate permissions >>>>>> at >>>>>> org.keycloak.authorization.permission.evaluator.IterablePerm >>>>>> issionEvaluator$1.onError(IterablePermissionEvaluator.java:66) >>>>>> at >>>>>> org.keycloak.authorization.permission.evaluator.IterablePerm >>>>>> issionEvaluator.evaluate(IterablePermissionEvaluator.java:54) >>>>>> at >>>>>> org.keycloak.authorization.permission.evaluator.IterablePerm >>>>>> issionEvaluator.evaluate(IterablePermissionEvaluator.java:63) >>>>>> at >>>>>> org.keycloak.authorization.authorization.AuthorizationTokenS >>>>>> ervice.evaluatePermissions(AuthorizationTokenService.java:208) >>>>>> ... >>>>>> Caused by: org.keycloak.scripting.ScriptExecutionException: Could >>>>>> not >>>>>> execute script 'Resource owner' problem was: TypeError: null has no >>>>>> such >>>>>> function "getOwner" in <eval> at line number 4 >>>>>> at >>>>>> org.keycloak.scripting.AbstractEvaluatableScriptAdapter.eval >>>>>> Unchecked(AbstractEvaluatableScriptAdapter.java:64) >>>>>> at >>>>>> org.keycloak.scripting.AbstractEvaluatableScriptAdapter.eval >>>>>> (AbstractEvaluatableScriptAdapter.java:30) >>>>>> >>>>>> >>>>>> I noticed this happens only with scope-based policies, so maybe it's >>>>>> the >>>>>> same problem than before? >>>>>> _______________________________________________ >>>>>> keycloak-user mailing list >>>>>> keycloak-user(a)lists.jboss.org >>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>>>>> >>>>> >>>>> >>>> >>> >> >