Examples with AuthorizationResource org.keycloak.admin.client.resource.AuthorizationResource used on opensource projects

Example 96 with AuthorizationResource

use of org.keycloak.admin.client.resource.AuthorizationResource in project keycloak by keycloak.

the class EntitlementAPITest method testOfflineRequestingPartyToken.

@Test
public void testOfflineRequestingPartyToken() throws Exception {
    ClientResource client = getClient(getRealm(), RESOURCE_SERVER_TEST);
    AuthorizationResource authorization = client.authorization();
    JSPolicyRepresentation policy = new JSPolicyRepresentation();
    policy.setName(KeycloakModelUtils.generateId());
    policy.setCode("$evaluation.grant();");
    authorization.policies().js().create(policy).close();
    ResourceRepresentation resource = new ResourceRepresentation();
    resource.setName("Sensors");
    resource.addScope("sensors:view", "sensors:update", "sensors:delete");
    try (Response response = authorization.resources().create(resource)) {
        resource = response.readEntity(ResourceRepresentation.class);
    }
    ScopePermissionRepresentation permission = new ScopePermissionRepresentation();
    permission.setName("View Sensor");
    permission.addScope("sensors:view");
    permission.addPolicy(policy.getName());
    authorization.permissions().scope().create(permission).close();
    String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).scope("offline_access").doGrantAccessTokenRequest("secret", "offlineuser", "password").getAccessToken();
    AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
    AccessTokenResponse response = authzClient.authorization(accessToken).authorize();
    assertNotNull(response.getToken());
    controller.stop(suiteContext.getAuthServerInfo().getQualifier());
    controller.start(suiteContext.getAuthServerInfo().getQualifier());
    reconnectAdminClient();
    configureSectorIdentifierRedirectUris();
    TokenIntrospectionResponse introspectionResponse = authzClient.protection().introspectRequestingPartyToken(response.getToken());
    assertTrue(introspectionResponse.getActive());
    assertFalse(introspectionResponse.getPermissions().isEmpty());
    response = authzClient.authorization(accessToken).authorize();
    assertNotNull(response.getToken());
}

Example 97 with AuthorizationResource

use of org.keycloak.admin.client.resource.AuthorizationResource in project keycloak by keycloak.

the class PermissionClaimTest method testClaimsFromDifferentScopePermissions.

@Test
public void testClaimsFromDifferentScopePermissions() throws Exception {
    ClientResource client = getClient(getRealm());
    AuthorizationResource authorization = client.authorization();
    ResourceRepresentation resourceA = new ResourceRepresentation(KeycloakModelUtils.generateId(), "create", "update");
    authorization.resources().create(resourceA).close();
    ResourceRepresentation resourceB = new ResourceRepresentation(KeycloakModelUtils.generateId(), "create", "update");
    authorization.resources().create(resourceB).close();
    ScopePermissionRepresentation allScopesPermission = new ScopePermissionRepresentation();
    allScopesPermission.setName(KeycloakModelUtils.generateId());
    allScopesPermission.addScope("create", "update");
    allScopesPermission.addPolicy(claimAPolicy.getName(), claimBPolicy.getName());
    authorization.permissions().scope().create(allScopesPermission).close();
    ScopePermissionRepresentation updatePermission = new ScopePermissionRepresentation();
    updatePermission.setName(KeycloakModelUtils.generateId());
    updatePermission.addScope("update");
    updatePermission.addPolicy(claimCPolicy.getName());
    try (Response response = authorization.permissions().scope().create(updatePermission)) {
        updatePermission = response.readEntity(ScopePermissionRepresentation.class);
    }
    AuthzClient authzClient = getAuthzClient();
    AuthorizationRequest request = new AuthorizationRequest();
    request.addPermission(null, "create", "update");
    AuthorizationResponse response = authzClient.authorization("marta", "password").authorize(request);
    assertNotNull(response.getToken());
    AccessToken rpt = toAccessToken(response.getToken());
    Authorization authorizationClaim = rpt.getAuthorization();
    List<Permission> permissions = new ArrayList<>(authorizationClaim.getPermissions());
    assertEquals(2, permissions.size());
    for (Permission permission : permissions) {
        Map<String, Set<String>> claims = permission.getClaims();
        assertNotNull(claims);
        assertThat(claims.get("claim-a"), Matchers.containsInAnyOrder("claim-a", "claim-a1"));
        assertThat(claims.get("claim-b"), Matchers.containsInAnyOrder("claim-b"));
        assertThat(claims.get("claim-c"), Matchers.containsInAnyOrder("claim-c"));
    }
    updatePermission.addPolicy(denyPolicy.getName());
    authorization.permissions().scope().findById(updatePermission.getId()).update(updatePermission);
    response = authzClient.authorization("marta", "password").authorize(request);
    assertNotNull(response.getToken());
    rpt = toAccessToken(response.getToken());
    authorizationClaim = rpt.getAuthorization();
    permissions = new ArrayList<>(authorizationClaim.getPermissions());
    assertEquals(2, permissions.size());
    for (Permission permission : permissions) {
        Map<String, Set<String>> claims = permission.getClaims();
        assertNotNull(claims);
        assertThat(claims.get("claim-a"), Matchers.containsInAnyOrder("claim-a", "claim-a1"));
        assertThat(claims.get("claim-b"), Matchers.containsInAnyOrder("claim-b"));
        assertThat(claims.get("claim-c"), Matchers.containsInAnyOrder("claim-c"));
        assertThat(claims.get("deny-policy"), Matchers.containsInAnyOrder("deny-policy"));
    }
}

Example 98 with AuthorizationResource

use of org.keycloak.admin.client.resource.AuthorizationResource in project keycloak by keycloak.

the class PermissionClaimTest method testPermissionWithClaimsDifferentPolicies.

@Test
public void testPermissionWithClaimsDifferentPolicies() throws Exception {
    ClientResource client = getClient(getRealm());
    AuthorizationResource authorization = client.authorization();
    ResourceRepresentation resource = new ResourceRepresentation("Resource B");
    authorization.resources().create(resource).close();
    ResourcePermissionRepresentation permission = new ResourcePermissionRepresentation();
    permission.setName(resource.getName() + " Permission");
    permission.addResource(resource.getName());
    permission.addPolicy(claimAPolicy.getName(), claimBPolicy.getName());
    authorization.permissions().resource().create(permission).close();
    PermissionRequest request = new PermissionRequest();
    request.setResourceId(resource.getName());
    String accessToken = new OAuthClient().realm("authz-test").clientId("test-client").doGrantAccessTokenRequest("secret", "marta", "password").getAccessToken();
    AuthzClient authzClient = getAuthzClient();
    String ticket = authzClient.protection().permission().forResource(request).getTicket();
    AuthorizationResponse response = authzClient.authorization(accessToken).authorize(new AuthorizationRequest(ticket));
    assertNotNull(response.getToken());
    AccessToken rpt = toAccessToken(response.getToken());
    Authorization authorizationClaim = rpt.getAuthorization();
    List<Permission> permissions = new ArrayList<>(authorizationClaim.getPermissions());
    assertEquals(1, permissions.size());
    Map<String, Set<String>> claims = permissions.get(0).getClaims();
    assertTrue(claims.containsKey("claim-a"));
    assertTrue(claims.containsKey("claim-b"));
}

Example 99 with AuthorizationResource

use of org.keycloak.admin.client.resource.AuthorizationResource in project keycloak by keycloak.

the class PermissionClaimTest method testPermissionWithClaims.

@Test
public void testPermissionWithClaims() throws Exception {
    ClientResource client = getClient(getRealm());
    AuthorizationResource authorization = client.authorization();
    ResourceRepresentation resource = new ResourceRepresentation("Resource A");
    authorization.resources().create(resource).close();
    ResourcePermissionRepresentation permission = new ResourcePermissionRepresentation();
    permission.setName(resource.getName() + " Permission");
    permission.addResource(resource.getName());
    permission.addPolicy(claimAPolicy.getName());
    authorization.permissions().resource().create(permission).close();
    PermissionRequest request = new PermissionRequest();
    request.setResourceId(resource.getName());
    String accessToken = new OAuthClient().realm("authz-test").clientId("test-client").doGrantAccessTokenRequest("secret", "marta", "password").getAccessToken();
    AuthzClient authzClient = getAuthzClient();
    String ticket = authzClient.protection().permission().create(request).getTicket();
    AuthorizationResponse response = authzClient.authorization(accessToken).authorize(new AuthorizationRequest(ticket));
    assertNotNull(response.getToken());
    AccessToken rpt = toAccessToken(response.getToken());
    Authorization authorizationClaim = rpt.getAuthorization();
    List<Permission> permissions = new ArrayList<>(authorizationClaim.getPermissions());
    assertEquals(1, permissions.size());
    assertTrue(permissions.get(0).getClaims().get("claim-a").containsAll(Arrays.asList("claim-a", "claim-a1")));
}

Example 100 with AuthorizationResource

use of org.keycloak.admin.client.resource.AuthorizationResource in project keycloak by keycloak.

the class TimePolicyManagementTest method testDelete.

@Test
public void testDelete() {
    AuthorizationResource authorization = getClient().authorization();
    TimePolicyRepresentation representation = createRepresentation("Test Delete Policy");
    TimePoliciesResource policies = authorization.policies().time();
    try (Response response = policies.create(representation)) {
        TimePolicyRepresentation created = response.readEntity(TimePolicyRepresentation.class);
        policies.findById(created.getId()).remove();
        TimePolicyResource removed = policies.findById(created.getId());
        try {
            removed.toRepresentation();
            fail("Permission not removed");
        } catch (NotFoundException ignore) {
        }
    }
}