Examples with PolicyEnforcer org.keycloak.adapters.authorization.PolicyEnforcer used on opensource projects

Example 16 with PolicyEnforcer

use of org.keycloak.adapters.authorization.PolicyEnforcer in project keycloak by keycloak.

the class PolicyEnforcerTest method testSetMethodConfigs.

@Test
public void testSetMethodConfigs() {
    ClientResource clientResource = getClientResource(RESOURCE_SERVER_CLIENT_ID);
    ResourceRepresentation representation = new ResourceRepresentation();
    representation.setName(KeycloakModelUtils.generateId());
    representation.setUris(Collections.singleton("/api-method/*"));
    ResourcesResource resources = clientResource.authorization().resources();
    javax.ws.rs.core.Response response = resources.create(representation);
    representation.setId(response.readEntity(ResourceRepresentation.class).getId());
    response.close();
    try {
        KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(getAdapterConfiguration("enforcer-paths-use-method-config.json"));
        PolicyEnforcer policyEnforcer = deployment.getPolicyEnforcer();
        oauth.realm(REALM_NAME);
        oauth.clientId("public-client-test");
        oauth.doLogin("marta", "password");
        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
        OAuthClient.AccessTokenResponse tokeResponse = oauth.doAccessTokenRequest(code, null);
        String token = tokeResponse.getAccessToken();
        AuthorizationContext context = policyEnforcer.enforce(createHttpFacade("/api-method/foo", token));
        // GET is disabled in the config
        assertTrue(context.isGranted());
        PolicyEnforcerConfig.PathConfig pathConfig = policyEnforcer.getPaths().get("/api-method/*");
        assertNotNull(pathConfig);
        List<PolicyEnforcerConfig.MethodConfig> methods = pathConfig.getMethods();
        assertEquals(1, methods.size());
        assertTrue(PolicyEnforcerConfig.ScopeEnforcementMode.DISABLED.equals(methods.get(0).getScopesEnforcementMode()));
        // other verbs should be protected
        context = policyEnforcer.enforce(createHttpFacade("/api-method/foo", token, "POST"));
        assertFalse(context.isGranted());
    } finally {
        resources.resource(representation.getId()).remove();
    }
}

Example 17 with PolicyEnforcer

use of org.keycloak.adapters.authorization.PolicyEnforcer in project keycloak by keycloak.

the class PolicyEnforcerTest method testLazyLoadPaths.

@Test
public void testLazyLoadPaths() {
    ClientResource clientResource = getClientResource(RESOURCE_SERVER_CLIENT_ID);
    for (int i = 0; i < 200; i++) {
        ResourceRepresentation representation = new ResourceRepresentation();
        representation.setType("test");
        representation.setName("Resource " + i);
        representation.setUri("/api/" + i);
        javax.ws.rs.core.Response response = clientResource.authorization().resources().create(representation);
        representation.setId(response.readEntity(ResourceRepresentation.class).getId());
        response.close();
    }
    ResourcePermissionRepresentation permission = new ResourcePermissionRepresentation();
    permission.setName("Test Permission");
    permission.setResourceType("test");
    permission.addPolicy("Only User Policy");
    PermissionsResource permissions = clientResource.authorization().permissions();
    permissions.resource().create(permission).close();
    KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(getAdapterConfiguration("enforcer-no-lazyload.json"));
    PolicyEnforcer policyEnforcer = deployment.getPolicyEnforcer();
    assertEquals(205, policyEnforcer.getPaths().size());
    deployment = KeycloakDeploymentBuilder.build(getAdapterConfiguration("enforcer-lazyload.json"));
    policyEnforcer = deployment.getPolicyEnforcer();
    assertEquals(0, policyEnforcer.getPathMatcher().getPathCache().size());
    assertEquals(0, policyEnforcer.getPaths().size());
    oauth.realm(REALM_NAME);
    oauth.clientId("public-client-test");
    oauth.doLogin("marta", "password");
    String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
    OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, null);
    String token = response.getAccessToken();
    for (int i = 0; i < 101; i++) {
        policyEnforcer.enforce(createHttpFacade("/api/" + i, token));
    }
    assertEquals(101, policyEnforcer.getPathMatcher().getPathCache().size());
    for (int i = 101; i < 200; i++) {
        policyEnforcer.enforce(createHttpFacade("/api/" + i, token));
    }
    assertEquals(200, policyEnforcer.getPathMatcher().getPathCache().size());
    assertEquals(0, policyEnforcer.getPaths().size());
    ResourceRepresentation resource = clientResource.authorization().resources().findByName("Root").get(0);
    clientResource.authorization().resources().resource(resource.getId()).remove();
    deployment = KeycloakDeploymentBuilder.build(getAdapterConfiguration("enforcer-lazyload-with-paths.json"));
    policyEnforcer = deployment.getPolicyEnforcer();
    AuthorizationContext context = policyEnforcer.enforce(createHttpFacade("/api/0", token));
    assertTrue(context.isGranted());
}

Example 18 with PolicyEnforcer

use of org.keycloak.adapters.authorization.PolicyEnforcer in project keycloak by keycloak.

the class PolicyEnforcerTest method testCustomClaimProvider.

@Test
public void testCustomClaimProvider() {
    KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(getAdapterConfiguration("enforcer-bearer-only-with-cip.json"));
    PolicyEnforcer policyEnforcer = deployment.getPolicyEnforcer();
    oauth.realm(REALM_NAME);
    oauth.clientId("public-client-test");
    oauth.doLogin("marta", "password");
    String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
    OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, null);
    String token = response.getAccessToken();
    OIDCHttpFacade httpFacade = createHttpFacade("/api/resourcea", token);
    AuthorizationContext context = policyEnforcer.enforce(httpFacade);
    Permission permission = context.getPermissions().get(0);
    Map<String, Set<String>> claims = permission.getClaims();
    assertTrue(context.isGranted());
    assertEquals("test", claims.get("resolved-claim").iterator().next());
}

Example 19 with PolicyEnforcer

use of org.keycloak.adapters.authorization.PolicyEnforcer in project keycloak by keycloak.

the class PolicyEnforcerTest method testPathConfigurationPrecendenceWhenLazyLoadingPaths.

@Test
public void testPathConfigurationPrecendenceWhenLazyLoadingPaths() {
    KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(getAdapterConfiguration("enforcer-paths.json"));
    PolicyEnforcer policyEnforcer = deployment.getPolicyEnforcer();
    OIDCHttpFacade httpFacade = createHttpFacade("/api/resourcea");
    AuthorizationContext context = policyEnforcer.enforce(httpFacade);
    assertFalse(context.isGranted());
    assertEquals(403, TestResponse.class.cast(httpFacade.getResponse()).getStatus());
    oauth.realm(REALM_NAME);
    oauth.clientId("public-client-test");
    oauth.doLogin("marta", "password");
    String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
    OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, null);
    String token = response.getAccessToken();
    httpFacade = createHttpFacade("/api/resourcea", token);
    context = policyEnforcer.enforce(httpFacade);
    assertTrue(context.isGranted());
    httpFacade = createHttpFacade("/");
    context = policyEnforcer.enforce(httpFacade);
    assertTrue(context.isGranted());
}

Example 20 with PolicyEnforcer

use of org.keycloak.adapters.authorization.PolicyEnforcer in project keycloak by keycloak.

the class PolicyEnforcerTest method testUsingInvalidToken.

@Test
public void testUsingInvalidToken() {
    ClientResource clientResource = getClientResource(RESOURCE_SERVER_CLIENT_ID);
    ResourceRepresentation resource = createResource(clientResource, "Resource Subject Invalid Token", "/api/check-subject-token");
    ResourcePermissionRepresentation permission = new ResourcePermissionRepresentation();
    permission.setName(resource.getName() + " Permission");
    permission.addResource(resource.getName());
    permission.addPolicy("Only User Policy");
    PermissionsResource permissions = clientResource.authorization().permissions();
    permissions.resource().create(permission).close();
    KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(getAdapterConfiguration("enforcer-bearer-only.json"));
    PolicyEnforcer policyEnforcer = deployment.getPolicyEnforcer();
    OIDCHttpFacade httpFacade = createHttpFacade("/api/check-subject-token");
    oauth.realm(REALM_NAME);
    oauth.clientId("public-client-test");
    oauth.doLogin("marta", "password");
    String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
    OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, null);
    String token = response.getAccessToken();
    httpFacade = createHttpFacade("/api/check-subject-token", token);
    AuthorizationContext context = policyEnforcer.enforce(httpFacade);
    assertTrue(context.isGranted());
    oauth.doLogout(response.getRefreshToken(), null);
    context = policyEnforcer.enforce(httpFacade);
    assertFalse(context.isGranted());
}