Manage composite realm roles of the realm role

Signed-off-by: Tamara Nocentini <tamara.nocentini@2ndquadrant.com>
Signed-off-by: Paolo Romolini <paolo.romolini@2ndquadrant.com>

keycloak/keycloak_admin.py

@@ -29,7 +29,10 @@ from builtins import isinstance
 from typing import List, Iterable
 
 from keycloak.urls_patterns import URL_ADMIN_GROUPS_REALM_ROLES, \
-    URL_ADMIN_GET_GROUPS_REALM_ROLES, URL_ADMIN_REALM_ROLES_ROLE_BY_NAME, URL_ADMIN_GROUPS_CLIENT_ROLES
+    URL_ADMIN_GET_GROUPS_REALM_ROLES, URL_ADMIN_REALM_ROLES_ROLE_BY_NAME, URL_ADMIN_GROUPS_CLIENT_ROLES, \
+    URL_ADMIN_GET_GROUPS_REALM_ROLES, URL_ADMIN_REALM_ROLES_ROLE_BY_NAME, \
+    URL_ADMIN_REALM_ROLES_COMPOSITE_REALM_ROLE
+
 from .connection import ConnectionManager
 from .exceptions import raise_error_from_response, KeycloakGetError
 from .keycloak_openid import KeycloakOpenID
@@ -999,6 +1002,53 @@ class KeycloakAdmin:
             URL_ADMIN_REALM_ROLES_ROLE_BY_NAME.format(**params_path))
         return raise_error_from_response(data_raw, KeycloakGetError, expected_codes=[204])
 
+    def add_composite_realm_roles_to_role(self, role_name, roles):
+        """
+        Add composite roles to the role
+
+        :param role_name: The name of the role
+        :param roles: roles list or role (use RoleRepresentation) to be updated
+        :return Keycloak server response
+        """
+
+        payload = roles if isinstance(roles, list) else [roles]
+        params_path = {"realm-name": self.realm_name, "role-name": role_name}
+        data_raw = self.raw_post(
+            URL_ADMIN_REALM_ROLES_COMPOSITE_REALM_ROLE.format(**params_path),
+            data=json.dumps(payload))
+        return raise_error_from_response(data_raw, KeycloakGetError,
+                                         expected_codes=[204])
+
+    def remove_composite_realm_roles_to_role(self, role_name, roles):
+        """
+        Remove composite roles from the role
+
+        :param role_name: The name of the role
+        :param roles: roles list or role (use RoleRepresentation) to be removed
+        :return Keycloak server response
+        """
+
+        payload = roles if isinstance(roles, list) else [roles]
+        params_path = {"realm-name": self.realm_name, "role-name": role_name}
+        data_raw = self.raw_delete(
+            URL_ADMIN_REALM_ROLES_COMPOSITE_REALM_ROLE.format(**params_path),
+            data=json.dumps(payload))
+        return raise_error_from_response(data_raw, KeycloakGetError,
+                                         expected_codes=[204])
+
+    def get_composite_realm_roles_of_role(self, role_name):
+        """
+        Get composite roles of the role
+
+        :param role_name: The name of the role
+        :return Keycloak server response (array RoleRepresentation)
+        """
+
+        params_path = {"realm-name": self.realm_name, "role-name": role_name}
+        data_raw = self.raw_get(
+            URL_ADMIN_REALM_ROLES_COMPOSITE_REALM_ROLE.format(**params_path))
+        return raise_error_from_response(data_raw, KeycloakGetError)
+
     def assign_realm_roles(self, user_id, client_id, roles):
         """
         Assign realm roles to a user

keycloak/urls_patterns.py

@@ -79,6 +79,7 @@ URL_ADMIN_REALMS = "admin/realms"
 URL_ADMIN_REALM = "admin/realms/{realm-name}"
 URL_ADMIN_IDPS = "admin/realms/{realm-name}/identity-provider/instances"
 URL_ADMIN_REALM_ROLES_ROLE_BY_NAME = "admin/realms/{realm-name}/roles/{role-name}"
+URL_ADMIN_REALM_ROLES_COMPOSITE_REALM_ROLE = "admin/realms/{realm-name}/roles/{role-name}/composites"
 
 
 URL_ADMIN_FLOWS = "admin/realms/{realm-name}/authentication/flows"