mirror of
https://github.com/keycloak/keycloak.git
synced 2026-01-08 14:32:05 -03:30
44 lines
2.2 KiB
Plaintext
44 lines
2.2 KiB
Plaintext
[id="defining-workflow-conditions_{context}"]
|
|
|
|
[[_workflow_conditions_]]
|
|
= Defining conditions
|
|
|
|
The optional `if` setting allows you to define the conditions, as expressions, that the target resource must meet in
|
|
order for the workflow to be triggered. See <<_workflow_expression_language_>> for more details.
|
|
|
|
Conditions provide fine-grained control over whether a workflow execution should be created.
|
|
They allow you to inspect the context of the event and the state of the resource.
|
|
For example, you can create conditions to check:
|
|
* If a user has a specific attribute.
|
|
* If a specific role is granted to a user or if the user is joining a specific group.
|
|
|
|
If the condition evaluates to `true`, the workflow execution is created. If it evaluates to `false`, no workflow execution is created, even though
|
|
the expression from the `on` setting evaluates to `true`.
|
|
|
|
Just like the `on` setting, the condition is written using an expression that supports a variety of checks on the realm resource associated with the event.
|
|
For instance, considering a `user_created` event, you can define a condition to trigger the workflow only if the user has a specific attribute:
|
|
|
|
```yaml
|
|
on: user_created
|
|
if: has-user-attribute('plan', 'gold')
|
|
```
|
|
|
|
In this example, the workflow will only be triggered when a new user is created and that user has an attribute `plan` with the value `gold`.
|
|
|
|
{project_name} provides a set of built-in conditions that you can use in your workflows.
|
|
The conditions are also based on the realm resource associated with the event.
|
|
|
|
[[_workflow_user_functions_]]
|
|
== User functions
|
|
|
|
[cols="3*", options="header"]
|
|
|===
|
|
|Condition
|
|
|Description
|
|
|Parameters
|
|
| `has-user-attribute` | If the user has an attribute set. | The attribute name and optionally the attribute value using a properties format. If multiple values, they should be separated by comma. If the value is omitted, only the presence of the attribute is checked.
|
|
| `has-role` | If the user is granted with a specific role | The name of the role.
|
|
| `has-identity-provider-link` | If the user is linked to an identity provider. | The alias of the identity provider.
|
|
| `is-member-of` | If the user is member of a specific group. | The name or path of the group.
|
|
|===
|