Keycloak.Authorizations

This module helps you manage resources authorization with Keycloak.

In Keycloak, in the client, activate "Authorization Enabled" and set "Valid Redirect URIs" as "*". You then need to create your scopes, policies and permissions in the authorization tab. If you are unsure, set the "Policy Enforcement Mode" as permissive, so that a positive permission will be given with resources without policy.

The example below shows how to retrieve a token from Keycloak, and then retrieve the permissions of a user on a specific resource.

-- Let's get a token for a specific user login/password
userToken <- getJWT "demo" "demo"

-- Can I access this resource?
isAuth <- isAuthorized resId (ScopeName "view") userToken

liftIO $ putStrLn $ "User demo can access resource demo: " ++ (show isAuth)

-- We can also retrieve all the permissions for our user.
perms <- getPermissions [PermReq Nothing [ScopeName "view"]] userToken

liftIO $ putStrLn $ "All permissions: " ++ (show perms)

Permissions

isAuthorized :: ResourceId -> ScopeName -> JWT -> Keycloak Bool

Returns true if the resource is authorized under the given scope.

getPermissions :: [PermReq] -> JWT -> Keycloak [Permission]

Return the permissions for the permission requests.

checkPermission :: ResourceId -> ScopeName -> JWT -> Keycloak ()

Checks if a scope is permitted on a resource. An HTTP Exception 403 will be thrown if not.

Resource

createResource :: Resource -> JWT -> Keycloak ResourceId

Create an authorization resource in Keycloak, under the configured client.

deleteResource :: ResourceId -> JWT -> Keycloak ()

Delete the resource

deleteAllResources :: JWT -> Keycloak ()

Delete all resources in Keycloak

getResource :: ResourceId -> JWT -> Keycloak Resource

get a single resource

getAllResourceIds :: Keycloak [ResourceId]

get all resources IDs

updateResource :: Resource -> JWT -> Keycloak ResourceId

Update a resource