Examples with ClientScopeResource org.keycloak.admin.client.resource.ClientScopeResource used on opensource projects

Example 6 with ClientScopeResource

use of org.keycloak.admin.client.resource.ClientScopeResource in project keycloak by keycloak.

the class OIDCScopeTest method testOptionalScopesWithConsentRequired.

@Test
public void testOptionalScopesWithConsentRequired() throws Exception {
    // Remove "displayOnConsentScreen" from address
    ClientScopeResource addressScope = ApiUtil.findClientScopeByName(testRealm(), "address");
    ClientScopeRepresentation addressScopeRep = addressScope.toRepresentation();
    addressScopeRep.getAttributes().put(ClientScopeModel.DISPLAY_ON_CONSENT_SCREEN, "false");
    addressScope.update(addressScopeRep);
    oauth.clientId("third-party");
    oauth.doLoginGrant("john", "password");
    grantPage.assertCurrent();
    grantPage.assertGrants(OAuthGrantPage.PROFILE_CONSENT_TEXT, OAuthGrantPage.EMAIL_CONSENT_TEXT, OAuthGrantPage.ROLES_CONSENT_TEXT);
    grantPage.accept();
    EventRepresentation loginEvent = events.expectLogin().user(userId).client("third-party").detail(Details.CONSENT, Details.CONSENT_VALUE_CONSENT_GRANTED).assertEvent();
    Tokens tokens = sendTokenRequest(loginEvent, userId, "openid email profile", "third-party");
    IDToken idToken = tokens.idToken;
    assertProfile(idToken, true);
    assertEmail(idToken, true);
    assertAddress(idToken, false);
    assertPhone(idToken, false);
    // Logout
    oauth.doLogout(tokens.refreshToken, "password");
    events.expectLogout(idToken.getSessionState()).client("third-party").user(userId).removeDetail(Details.REDIRECT_URI).assertEvent();
    // Login with optional scopes. Grant screen should have just "phone"
    oauth.scope("openid address phone");
    oauth.doLoginGrant("john", "password");
    grantPage.assertCurrent();
    grantPage.assertGrants(OAuthGrantPage.PHONE_CONSENT_TEXT);
    grantPage.accept();
    loginEvent = events.expectLogin().client("third-party").detail(Details.CONSENT, Details.CONSENT_VALUE_CONSENT_GRANTED).user(userId).assertEvent();
    tokens = sendTokenRequest(loginEvent, userId, "openid email profile address phone", "third-party");
    idToken = tokens.idToken;
    assertProfile(idToken, true);
    assertEmail(idToken, true);
    assertAddress(idToken, true);
    assertPhone(idToken, true);
    // Revert
    addressScopeRep.getAttributes().put(ClientScopeModel.DISPLAY_ON_CONSENT_SCREEN, "true");
    addressScope.update(addressScopeRep);
}

Example 7 with ClientScopeResource

use of org.keycloak.admin.client.resource.ClientScopeResource in project keycloak by keycloak.

the class AudienceTest method testAudienceProtocolMapperWithClientAudience.

@Test
public void testAudienceProtocolMapperWithClientAudience() throws Exception {
    // Add audience protocol mapper to the clientScope "audience-scope"
    ProtocolMapperRepresentation audienceMapper = ProtocolMapperUtil.createAudienceMapper("audience mapper", "service-client", null, true, false);
    ClientScopeResource clientScope = ApiUtil.findClientScopeByName(testRealm(), "audience-scope");
    Response resp = clientScope.getProtocolMappers().createMapper(audienceMapper);
    String mapperId = ApiUtil.getCreatedId(resp);
    resp.close();
    // Login and check audiences in the token (just accessToken contains it)
    oauth.scope("openid audience-scope");
    oauth.doLogin("john", "password");
    EventRepresentation loginEvent = events.expectLogin().user(userId).assertEvent();
    Tokens tokens = sendTokenRequest(loginEvent, userId, "openid profile email audience-scope", "test-app");
    assertAudiences(tokens.accessToken, "service-client");
    assertAudiences(tokens.idToken, "test-app");
    // Revert
    clientScope.getProtocolMappers().delete(mapperId);
}

Example 8 with ClientScopeResource

use of org.keycloak.admin.client.resource.ClientScopeResource in project keycloak by keycloak.

the class AudienceTest method beforeTest.

@Before
public void beforeTest() {
    // Check if already exists
    ClientScopeResource clientScopeRes = ApiUtil.findClientScopeByName(testRealm(), "audience-scope");
    if (clientScopeRes != null) {
        return;
    }
    // Create client scope 'audience-scope' and add as optional scope to the 'test-app' client
    ClientScopeRepresentation clientScope = new ClientScopeRepresentation();
    clientScope.setName("audience-scope");
    clientScope.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
    Response resp = testRealm().clientScopes().create(clientScope);
    String clientScopeId = ApiUtil.getCreatedId(resp);
    resp.close();
    ClientResource client = ApiUtil.findClientByClientId(testRealm(), "test-app");
    client.addOptionalClientScope(clientScopeId);
}