Class PoliciesBuilderExtensions

Namespace

Keycloak.AuthServices.Authorization

Assembly

Keycloak.AuthServices.Authorization.dll

Extension methods for AuthorizationPolicyBuilder to add Keycloak-specific authorization requirements such as realm roles, resource roles, protected resources, and organization membership checks.

public static class PoliciesBuilderExtensions

Inheritance

object

PoliciesBuilderExtensions

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Methods

RequireOrganizationMembership(AuthorizationPolicyBuilder)

Adds organization membership requirement to builder. Requires the user to be a member of any Keycloak organization.

public static AuthorizationPolicyBuilder RequireOrganizationMembership(this AuthorizationPolicyBuilder builder)

Parameters

builder AuthorizationPolicyBuilder

The authorization policy builder.

Returns

AuthorizationPolicyBuilder

The modified authorization policy builder.

RequireOrganizationMembership(AuthorizationPolicyBuilder, string)

Adds organization membership requirement to builder. Requires the user to be a member of the specified organization.

public static AuthorizationPolicyBuilder RequireOrganizationMembership(this AuthorizationPolicyBuilder builder, string organization)

Parameters

builder AuthorizationPolicyBuilder

The authorization policy builder.

organization string

The organization alias or identifier.

Returns

AuthorizationPolicyBuilder

The modified authorization policy builder.

RequireProtectedResource(AuthorizationPolicyBuilder, string, string)

Adds protected resource requirement to builder. Makes outgoing HTTP requests to Authorization Server.

public static AuthorizationPolicyBuilder RequireProtectedResource(this AuthorizationPolicyBuilder builder, string resource, string scope)

Parameters

builder AuthorizationPolicyBuilder

The authorization policy builder.

resource string

The protected resource name.

scope string

The required scope for the resource.

Returns

AuthorizationPolicyBuilder

The authorization policy builder.

RequireProtectedResource(AuthorizationPolicyBuilder, string, string[], ScopesValidationMode?)

Adds protected resource requirement to builder. Makes outgoing HTTP requests to Authorization Server.

public static AuthorizationPolicyBuilder RequireProtectedResource(this AuthorizationPolicyBuilder builder, string resource, string[] scopes, ScopesValidationMode? scopesValidationMode = null)

Parameters

builder AuthorizationPolicyBuilder

The authorization policy builder.

resource string

The protected resource name.

scopes string[]

The required scopes for the resource.

scopesValidationMode ScopesValidationMode?

Controls whether all scopes (AllOf) or at least one scope (AnyOf) must be granted. Defaults to the server-level setting.

Returns

AuthorizationPolicyBuilder

The authorization policy builder.

RequireRealmRoles(AuthorizationPolicyBuilder, params string[])

Adds realm role requirement to builder. Ensures that at least one realm role is present in realm claims.

public static AuthorizationPolicyBuilder RequireRealmRoles(this AuthorizationPolicyBuilder builder, params string[] roles)

Parameters

builder AuthorizationPolicyBuilder

The authorization policy builder.

roles string[]

The realm roles to require. At least one must match.

Returns

AuthorizationPolicyBuilder

The authorization policy builder.

RequireResourceRoles(AuthorizationPolicyBuilder, params string[])

Adds resource role requirement to builder. Ensures that at least one resource role is present in resource claims. Note, make sure role source is configure. See documentation for more details.

public static AuthorizationPolicyBuilder RequireResourceRoles(this AuthorizationPolicyBuilder builder, params string[] roles)

Parameters

builder AuthorizationPolicyBuilder

The authorization policy builder.

roles string[]

The resource roles to require. At least one must match.

Returns

AuthorizationPolicyBuilder

The authorization policy builder.

RequireResourceRolesForClient(AuthorizationPolicyBuilder, string, string[])

Adds resource role requirement to builder. Ensures that at least one resource role is present in resource claims.

public static AuthorizationPolicyBuilder RequireResourceRolesForClient(this AuthorizationPolicyBuilder builder, string client, string[] roles)

Parameters

builder AuthorizationPolicyBuilder

The authorization policy builder.

client string

The Keycloak client (resource) name to check roles against.

roles string[]

The resource roles to require. At least one must match.

Returns

AuthorizationPolicyBuilder

The authorization policy builder.