Examples with PoliciesResource org.keycloak.admin.client.resource.PoliciesResource used on opensource projects

Example 1 with PoliciesResource

use of org.keycloak.admin.client.resource.PoliciesResource in project keycloak by keycloak.

the class AbstractPhotozExampleAdapterTest method testAdminWithoutPermissionsToDeleteAlbum.

@Test
public void testAdminWithoutPermissionsToDeleteAlbum() throws Exception {
    loginToClientPage(aliceUser);
    clientPage.createAlbum(ALICE_ALBUM_NAME);
    loginToClientPage(adminUser);
    clientPage.navigateToAdminAlbum(this::assertWasNotDenied);
    clientPage.viewAlbum(ALICE_ALBUM_NAME, this::assertWasNotDenied);
    clientPage.deleteAlbum(ALICE_ALBUM_NAME, this::assertWasNotDenied);
    assertThat(getResourcesOfUser("alice"), is(empty()));
    PoliciesResource policiesResource = getAuthorizationResource().policies();
    List<PolicyRepresentation> policies = policiesResource.policies();
    for (PolicyRepresentation policy : policies) {
        if ("Delete Album Permission".equals(policy.getName())) {
            policy.getConfig().put("applyPolicies", "[\"Only Owner Policy\"]");
            policiesResource.policy(policy.getId()).update(policy);
        }
    }
    printUpdatedPolicies();
    loginToClientPage(aliceUser);
    clientPage.createAlbum(ALICE_ALBUM_NAME);
    loginToClientPage(adminUser);
    clientPage.viewAlbum(ALICE_ALBUM_NAME, this::assertWasNotDenied);
    assertThat(getResourcesOfUser("alice"), is(not(empty())));
    clientPage.deleteAlbum(ALICE_ALBUM_NAME, this::assertWasDenied);
    for (PolicyRepresentation policy : policies) {
        if ("Delete Album Permission".equals(policy.getName())) {
            policy.getConfig().put("applyPolicies", "[\"Only Owner and Administrators Policy\"]");
            policiesResource.policy(policy.getId()).update(policy);
        }
    }
    printUpdatedPolicies();
    // Clear cache
    loginToClientPage(adminUser);
    clientPage.deleteAlbum(ALICE_ALBUM_NAME, this::assertWasNotDenied);
    assertThat(getResourcesOfUser("alice"), is(empty()));
}

Example 2 with PoliciesResource

use of org.keycloak.admin.client.resource.PoliciesResource in project keycloak by keycloak.

the class GenericPolicyManagementTest method assertAssociatedPolicy.

private void assertAssociatedPolicy(String associatedPolicyName, PolicyRepresentation dependentPolicy) {
    PolicyRepresentation associatedPolicy = findPolicyByName(associatedPolicyName);
    PoliciesResource policies = getClientResource().authorization().policies();
    associatedPolicy = policies.policy(associatedPolicy.getId()).toRepresentation();
    assertNotNull(associatedPolicy);
    PolicyRepresentation finalAssociatedPolicy = associatedPolicy;
    PolicyResource policyResource = policies.policy(dependentPolicy.getId());
    List<PolicyRepresentation> associatedPolicies = policyResource.associatedPolicies();
    assertTrue(associatedPolicies.stream().filter(associated -> associated.getId().equals(finalAssociatedPolicy.getId())).findFirst().isPresent());
    List<PolicyRepresentation> dependentPolicies = policies.policy(associatedPolicy.getId()).dependentPolicies();
    assertEquals(1, dependentPolicies.size());
    assertEquals(dependentPolicy.getId(), dependentPolicies.get(0).getId());
}

Example 3 with PoliciesResource

use of org.keycloak.admin.client.resource.PoliciesResource in project keycloak by keycloak.

the class GenericPolicyManagementTest method createPolicy.

private PolicyResource createPolicy(String name, Map<String, String> config) {
    PolicyRepresentation newPolicy = new PolicyRepresentation();
    newPolicy.setName(name);
    newPolicy.setType("scope");
    newPolicy.setConfig(config);
    PoliciesResource policies = getClientResource().authorization().policies();
    try (Response response = policies.create(newPolicy)) {
        assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus());
        PolicyRepresentation stored = response.readEntity(PolicyRepresentation.class);
        return policies.policy(stored.getId());
    }
}

Example 4 with PoliciesResource

use of org.keycloak.admin.client.resource.PoliciesResource in project keycloak by keycloak.

the class ScopePermissionManagementTest method configureTest.

@Before
public void configureTest() {
    super.configureTest();
    RolesResource realmRoles = testRealmResource().roles();
    realmRoles.create(new RoleRepresentation("Role A", "", false));
    realmRoles.create(new RoleRepresentation("Role B", "", false));
    RolePolicyRepresentation policyA = new RolePolicyRepresentation();
    policyA.setName("Policy A");
    policyA.addRole("Role A");
    AuthorizationResource authorization = testRealmResource().clients().get(newClient.getId()).authorization();
    PoliciesResource policies = authorization.policies();
    RolePoliciesResource roles = policies.role();
    roles.create(policyA);
    RolePolicyRepresentation policyB = new RolePolicyRepresentation();
    policyB.setName("Policy B");
    policyB.addRole("Role B");
    roles.create(policyB);
    UserPolicyRepresentation policyC = new UserPolicyRepresentation();
    policyC.setName("Policy C");
    policyC.addUser("test");
    policies.user().create(policyC).close();
    authorization.scopes().create(new ScopeRepresentation("Scope A"));
    authorization.scopes().create(new ScopeRepresentation("Scope B"));
    authorization.scopes().create(new ScopeRepresentation("Scope C"));
    ResourcesResource resources = authorization.resources();
    resources.create(new ResourceRepresentation("Resource A", "Scope A"));
    resources.create(new ResourceRepresentation("Resource B", "Scope B", "Scope C"));
}

Example 5 with PoliciesResource

use of org.keycloak.admin.client.resource.PoliciesResource in project keycloak by keycloak.

the class AbstractPhotozExampleAdapterTest method testAdminWithoutPermissionsToTypedResource.

@Test
public void testAdminWithoutPermissionsToTypedResource() throws Exception {
    loginToClientPage(aliceUser);
    clientPage.createAlbum(ALICE_ALBUM_NAME);
    loginToClientPage(adminUser);
    clientPage.navigateToAdminAlbum(this::assertWasNotDenied);
    clientPage.viewAlbum(ALICE_ALBUM_NAME, this::assertWasNotDenied);
    PoliciesResource policiesResource = getAuthorizationResource().policies();
    List<PolicyRepresentation> policies = policiesResource.policies();
    for (PolicyRepresentation policy : policies) {
        if ("Album Resource Permission".equals(policy.getName())) {
            policy.getConfig().put("applyPolicies", "[\"Any User Policy\"]");
            policiesResource.policy(policy.getId()).update(policy);
        }
        if ("Any User Policy".equals(policy.getName())) {
            ClientResource resourceServerClient = getClientResource(RESOURCE_SERVER_ID);
            RoleResource manageAlbumRole = resourceServerClient.roles().get("manage-albums");
            RoleRepresentation roleRepresentation = manageAlbumRole.toRepresentation();
            List<Map<String, Object>> roles = JsonSerialization.readValue(policy.getConfig().get("roles"), List.class);
            roles = roles.stream().filter((Map map) -> !map.get("id").equals(roleRepresentation.getId())).collect(Collectors.toList());
            policy.getConfig().put("roles", JsonSerialization.writeValueAsString(roles));
            policiesResource.policy(policy.getId()).update(policy);
        }
    }
    printUpdatedPolicies();
    // Clear cache
    loginToClientPage(adminUser);
    clientPage.navigateToAdminAlbum(this::assertWasNotDenied);
    clientPage.viewAlbum(ALICE_ALBUM_NAME, this::assertWasDenied);
    clientPage.deleteAlbum(ALICE_ALBUM_NAME, this::assertWasDenied);
    for (PolicyRepresentation policy : policies) {
        if ("Album Resource Permission".equals(policy.getName())) {
            policy.getConfig().put("applyPolicies", "[\"Any User Policy\", \"Administration Policy\"]");
            policiesResource.policy(policy.getId()).update(policy);
        }
    }
    printUpdatedPolicies();
    // Clear cache
    loginToClientPage(adminUser);
    clientPage.viewAlbum(ALICE_ALBUM_NAME, this::assertWasNotDenied);
    clientPage.deleteAlbum(ALICE_ALBUM_NAME, this::assertWasNotDenied);
    assertThat(getResourcesOfUser("alice"), is(empty()));
}