Search in sources :

Example 16 with AuthorizationContext

use of org.keycloak.AuthorizationContext in project keycloak by keycloak.

the class PolicyEnforcerTest method testUsingInvalidToken.

@Test
public void testUsingInvalidToken() {
    ClientResource clientResource = getClientResource(RESOURCE_SERVER_CLIENT_ID);
    ResourceRepresentation resource = createResource(clientResource, "Resource Subject Invalid Token", "/api/check-subject-token");
    ResourcePermissionRepresentation permission = new ResourcePermissionRepresentation();
    permission.setName(resource.getName() + " Permission");
    permission.addResource(resource.getName());
    permission.addPolicy("Only User Policy");
    PermissionsResource permissions = clientResource.authorization().permissions();
    permissions.resource().create(permission).close();
    KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(getAdapterConfiguration("enforcer-bearer-only.json"));
    PolicyEnforcer policyEnforcer = deployment.getPolicyEnforcer();
    OIDCHttpFacade httpFacade = createHttpFacade("/api/check-subject-token");
    oauth.realm(REALM_NAME);
    oauth.clientId("public-client-test");
    oauth.doLogin("marta", "password");
    String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
    OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, null);
    String token = response.getAccessToken();
    httpFacade = createHttpFacade("/api/check-subject-token", token);
    AuthorizationContext context = policyEnforcer.enforce(httpFacade);
    assertTrue(context.isGranted());
    oauth.doLogout(response.getRefreshToken(), null);
    context = policyEnforcer.enforce(httpFacade);
    assertFalse(context.isGranted());
}
Also used : PermissionsResource(org.keycloak.admin.client.resource.PermissionsResource) OAuthClient(org.keycloak.testsuite.util.OAuthClient) OIDCHttpFacade(org.keycloak.adapters.OIDCHttpFacade) KeycloakDeployment(org.keycloak.adapters.KeycloakDeployment) ClientResource(org.keycloak.admin.client.resource.ClientResource) PolicyEnforcer(org.keycloak.adapters.authorization.PolicyEnforcer) AuthorizationContext(org.keycloak.AuthorizationContext) ResourceRepresentation(org.keycloak.representations.idm.authorization.ResourceRepresentation) ResourcePermissionRepresentation(org.keycloak.representations.idm.authorization.ResourcePermissionRepresentation) AbstractKeycloakTest(org.keycloak.testsuite.AbstractKeycloakTest) Test(org.junit.Test)

Example 17 with AuthorizationContext

use of org.keycloak.AuthorizationContext in project keycloak by keycloak.

the class PolicyEnforcerTest method testMatchHttpVerbsToScopes.

@Test
public void testMatchHttpVerbsToScopes() {
    ClientResource clientResource = getClientResource(RESOURCE_SERVER_CLIENT_ID);
    ResourceRepresentation resource = createResource(clientResource, "Resource With HTTP Scopes", "/api/resource-with-scope");
    ResourcePermissionRepresentation permission = new ResourcePermissionRepresentation();
    permission.setName(resource.getName() + " Permission");
    permission.addResource(resource.getName());
    permission.addPolicy("Always Grant Policy");
    PermissionsResource permissions = clientResource.authorization().permissions();
    permissions.resource().create(permission).close();
    KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(getAdapterConfiguration("enforcer-match-http-verbs-scopes.json"));
    PolicyEnforcer policyEnforcer = deployment.getPolicyEnforcer();
    oauth.realm(REALM_NAME);
    oauth.clientId("public-client-test");
    oauth.doLogin("marta", "password");
    String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
    OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, null);
    String token = response.getAccessToken();
    OIDCHttpFacade httpFacade = createHttpFacade("/api/resource-with-scope", token);
    AuthorizationContext context = policyEnforcer.enforce(httpFacade);
    assertFalse("Should fail because resource does not have any scope named GET", context.isGranted());
    assertEquals(403, TestResponse.class.cast(httpFacade.getResponse()).getStatus());
    resource.addScope("GET", "POST");
    clientResource.authorization().resources().resource(resource.getId()).update(resource);
    deployment = KeycloakDeploymentBuilder.build(getAdapterConfiguration("enforcer-match-http-verbs-scopes.json"));
    policyEnforcer = deployment.getPolicyEnforcer();
    context = policyEnforcer.enforce(httpFacade);
    assertTrue(context.isGranted());
    httpFacade = createHttpFacade("/api/resource-with-scope", token, "POST");
    context = policyEnforcer.enforce(httpFacade);
    assertTrue(context.isGranted());
    // create a PATCH scope without associated it with the resource so that a PATCH request is denied accordingly even though
    // the scope exists on the server
    clientResource.authorization().scopes().create(new ScopeRepresentation("PATCH"));
    httpFacade = createHttpFacade("/api/resource-with-scope", token, "PATCH");
    context = policyEnforcer.enforce(httpFacade);
    assertFalse(context.isGranted());
    ScopePermissionRepresentation postPermission = new ScopePermissionRepresentation();
    postPermission.setName("GET permission");
    postPermission.addScope("GET");
    postPermission.addPolicy("Always Deny Policy");
    permissions.scope().create(postPermission).close();
    httpFacade = createHttpFacade("/api/resource-with-scope", token);
    context = policyEnforcer.enforce(httpFacade);
    assertFalse(context.isGranted());
    postPermission = permissions.scope().findByName(postPermission.getName());
    postPermission.addScope("GET");
    postPermission.addPolicy("Always Grant Policy");
    permissions.scope().findById(postPermission.getId()).update(postPermission);
    AuthzClient authzClient = getAuthzClient("default-keycloak.json");
    AuthorizationResponse authorize = authzClient.authorization(token).authorize();
    token = authorize.getToken();
    httpFacade = createHttpFacade("/api/resource-with-scope", token);
    context = policyEnforcer.enforce(httpFacade);
    assertTrue(context.isGranted());
    httpFacade = createHttpFacade("/api/resource-with-scope", token, "POST");
    context = policyEnforcer.enforce(httpFacade);
    assertTrue(context.isGranted());
    postPermission = permissions.scope().findByName(postPermission.getName());
    postPermission.addScope("GET");
    postPermission.addPolicy("Always Deny Policy");
    permissions.scope().findById(postPermission.getId()).update(postPermission);
    authorize = authzClient.authorization(token).authorize();
    token = authorize.getToken();
    httpFacade = createHttpFacade("/api/resource-with-scope", token);
    context = policyEnforcer.enforce(httpFacade);
    assertFalse(context.isGranted());
    httpFacade = createHttpFacade("/api/resource-with-scope", token, "POST");
    context = policyEnforcer.enforce(httpFacade);
    assertTrue(context.isGranted());
    postPermission = permissions.scope().findByName(postPermission.getName());
    postPermission.addScope("GET");
    postPermission.addPolicy("Always Grant Policy");
    permissions.scope().findById(postPermission.getId()).update(postPermission);
    authorize = authzClient.authorization(token).authorize();
    token = authorize.getToken();
    httpFacade = createHttpFacade("/api/resource-with-scope", token);
    context = policyEnforcer.enforce(httpFacade);
    assertTrue(context.isGranted());
    httpFacade = createHttpFacade("/api/resource-with-scope", token, "POST");
    context = policyEnforcer.enforce(httpFacade);
    assertTrue(context.isGranted());
    postPermission = permissions.scope().findByName(postPermission.getName());
    postPermission.addScope("POST");
    postPermission.addPolicy("Always Deny Policy");
    permissions.scope().findById(postPermission.getId()).update(postPermission);
    AuthorizationRequest request = new AuthorizationRequest();
    request.addPermission(null, "GET");
    authorize = authzClient.authorization(token).authorize(request);
    token = authorize.getToken();
    httpFacade = createHttpFacade("/api/resource-with-scope", token);
    context = policyEnforcer.enforce(httpFacade);
    assertTrue(context.isGranted());
    httpFacade = createHttpFacade("/api/resource-with-scope", token, "POST");
    context = policyEnforcer.enforce(httpFacade);
    assertFalse(context.isGranted());
}
Also used : AuthorizationRequest(org.keycloak.representations.idm.authorization.AuthorizationRequest) OAuthClient(org.keycloak.testsuite.util.OAuthClient) OIDCHttpFacade(org.keycloak.adapters.OIDCHttpFacade) AuthorizationContext(org.keycloak.AuthorizationContext) ResourceRepresentation(org.keycloak.representations.idm.authorization.ResourceRepresentation) ResourcePermissionRepresentation(org.keycloak.representations.idm.authorization.ResourcePermissionRepresentation) AuthorizationResponse(org.keycloak.representations.idm.authorization.AuthorizationResponse) PermissionsResource(org.keycloak.admin.client.resource.PermissionsResource) AuthzClient(org.keycloak.authorization.client.AuthzClient) KeycloakDeployment(org.keycloak.adapters.KeycloakDeployment) ClientResource(org.keycloak.admin.client.resource.ClientResource) PolicyEnforcer(org.keycloak.adapters.authorization.PolicyEnforcer) ScopeRepresentation(org.keycloak.representations.idm.authorization.ScopeRepresentation) ScopePermissionRepresentation(org.keycloak.representations.idm.authorization.ScopePermissionRepresentation) AbstractKeycloakTest(org.keycloak.testsuite.AbstractKeycloakTest) Test(org.junit.Test)

Example 18 with AuthorizationContext

use of org.keycloak.AuthorizationContext in project keycloak by keycloak.

the class PolicyEnforcerTest method testBearerOnlyClientResponse.

@Test
public void testBearerOnlyClientResponse() {
    KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(getAdapterConfiguration("enforcer-bearer-only.json"));
    PolicyEnforcer policyEnforcer = deployment.getPolicyEnforcer();
    OIDCHttpFacade httpFacade = createHttpFacade("/api/resourcea");
    AuthorizationContext context = policyEnforcer.enforce(httpFacade);
    assertFalse(context.isGranted());
    assertEquals(403, TestResponse.class.cast(httpFacade.getResponse()).getStatus());
    oauth.realm(REALM_NAME);
    oauth.clientId("public-client-test");
    oauth.doLogin("marta", "password");
    String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
    OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, null);
    String token = response.getAccessToken();
    httpFacade = createHttpFacade("/api/resourcea", token);
    context = policyEnforcer.enforce(httpFacade);
    assertTrue(context.isGranted());
    httpFacade = createHttpFacade("/api/resourceb");
    context = policyEnforcer.enforce(httpFacade);
    assertFalse(context.isGranted());
    assertEquals(403, TestResponse.class.cast(httpFacade.getResponse()).getStatus());
}
Also used : OAuthClient(org.keycloak.testsuite.util.OAuthClient) OIDCHttpFacade(org.keycloak.adapters.OIDCHttpFacade) KeycloakDeployment(org.keycloak.adapters.KeycloakDeployment) PolicyEnforcer(org.keycloak.adapters.authorization.PolicyEnforcer) AuthorizationContext(org.keycloak.AuthorizationContext) AbstractKeycloakTest(org.keycloak.testsuite.AbstractKeycloakTest) Test(org.junit.Test)

Aggregations

AuthorizationContext (org.keycloak.AuthorizationContext)18 PolicyEnforcer (org.keycloak.adapters.authorization.PolicyEnforcer)17 Test (org.junit.Test)16 KeycloakDeployment (org.keycloak.adapters.KeycloakDeployment)16 AbstractKeycloakTest (org.keycloak.testsuite.AbstractKeycloakTest)16 OIDCHttpFacade (org.keycloak.adapters.OIDCHttpFacade)10 OAuthClient (org.keycloak.testsuite.util.OAuthClient)10 ClientResource (org.keycloak.admin.client.resource.ClientResource)5 Permission (org.keycloak.representations.idm.authorization.Permission)5 ResourceRepresentation (org.keycloak.representations.idm.authorization.ResourceRepresentation)5 HashMap (java.util.HashMap)4 List (java.util.List)4 PermissionsResource (org.keycloak.admin.client.resource.PermissionsResource)4 AuthzClient (org.keycloak.authorization.client.AuthzClient)4 ResourcePermissionRepresentation (org.keycloak.representations.idm.authorization.ResourcePermissionRepresentation)4 Set (java.util.Set)2 AuthorizationRequest (org.keycloak.representations.idm.authorization.AuthorizationRequest)2 AuthorizationResponse (org.keycloak.representations.idm.authorization.AuthorizationResponse)2 IOException (java.io.IOException)1 AtomicBoolean (java.util.concurrent.atomic.AtomicBoolean)1