Examples with ScopePermissionsResource org.keycloak.admin.client.resource.ScopePermissionsResource used on opensource projects

Example 1 with ScopePermissionsResource

use of org.keycloak.admin.client.resource.ScopePermissionsResource in project keycloak by keycloak.

the class ScopePermissionManagementTest method testDelete.

@Test
public void testDelete() {
    AuthorizationResource authorization = getClient().authorization();
    ScopePermissionRepresentation representation = new ScopePermissionRepresentation();
    representation.setName("Test Delete Permission");
    representation.addScope("execute");
    representation.addPolicy("Only Marta Policy");
    assertCreated(authorization, representation);
    ScopePermissionsResource permissions = authorization.permissions().scope();
    permissions.findById(representation.getId()).remove();
    ScopePermissionResource removed = permissions.findById(representation.getId());
    try {
        removed.toRepresentation();
        fail("Permission not removed");
    } catch (NotFoundException ignore) {
    }
}

Example 2 with ScopePermissionsResource

use of org.keycloak.admin.client.resource.ScopePermissionsResource in project keycloak by keycloak.

the class ScopePermissionManagementTest method assertCreated.

private void assertCreated(AuthorizationResource authorization, ScopePermissionRepresentation representation) {
    ScopePermissionsResource permissions = authorization.permissions().scope();
    try (Response response = permissions.create(representation)) {
        ScopePermissionRepresentation created = response.readEntity(ScopePermissionRepresentation.class);
        ScopePermissionResource permission = permissions.findById(created.getId());
        assertRepresentation(representation, permission);
    }
}

Example 3 with ScopePermissionsResource

use of org.keycloak.admin.client.resource.ScopePermissionsResource in project keycloak by keycloak.

the class ScopePermissionManagementTest method failCreateWithSameName.

@Test
public void failCreateWithSameName() {
    AuthorizationResource authorization = getClient().authorization();
    ScopePermissionRepresentation permission1 = new ScopePermissionRepresentation();
    permission1.setName("Conflicting Name Permission");
    permission1.addScope("read");
    permission1.addPolicy("Only Marta Policy");
    ScopePermissionsResource permissions = authorization.permissions().scope();
    permissions.create(permission1).close();
    ScopePermissionRepresentation permission2 = new ScopePermissionRepresentation();
    permission2.setName(permission1.getName());
    try (Response response = permissions.create(permission2)) {
        assertEquals(Response.Status.CONFLICT.getStatusCode(), response.getStatus());
    }
}

Example 4 with ScopePermissionsResource

use of org.keycloak.admin.client.resource.ScopePermissionsResource in project keycloak by keycloak.

the class EntitlementAPITest method testServerDecisionStrategy.

@Test
public void testServerDecisionStrategy() throws Exception {
    ClientResource client = getClient(getRealm(), RESOURCE_SERVER_TEST);
    AuthorizationResource authorization = client.authorization();
    ResourceRepresentation resource = new ResourceRepresentation();
    resource.setName(KeycloakModelUtils.generateId());
    resource.addScope("read", "write", "delete");
    try (Response response = authorization.resources().create(resource)) {
        resource = response.readEntity(ResourceRepresentation.class);
    }
    JSPolicyRepresentation grantPolicy = new JSPolicyRepresentation();
    grantPolicy.setName(KeycloakModelUtils.generateId());
    grantPolicy.setCode("$evaluation.grant();");
    authorization.policies().js().create(grantPolicy).close();
    JSPolicyRepresentation denyPolicy = new JSPolicyRepresentation();
    denyPolicy.setName(KeycloakModelUtils.generateId());
    denyPolicy.setCode("$evaluation.deny();");
    authorization.policies().js().create(denyPolicy).close();
    ResourcePermissionRepresentation resourcePermission = new ResourcePermissionRepresentation();
    resourcePermission.setName(KeycloakModelUtils.generateId());
    resourcePermission.addResource(resource.getId());
    resourcePermission.addPolicy(denyPolicy.getName());
    authorization.permissions().resource().create(resourcePermission).close();
    ScopePermissionRepresentation scopePermission1 = new ScopePermissionRepresentation();
    scopePermission1.setName(KeycloakModelUtils.generateId());
    scopePermission1.addScope("read");
    scopePermission1.addPolicy(grantPolicy.getName());
    ScopePermissionsResource scopePermissions = authorization.permissions().scope();
    scopePermissions.create(scopePermission1).close();
    String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken();
    AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
    AuthorizationRequest request = new AuthorizationRequest();
    request.addPermission(resource.getName());
    try {
        authzClient.authorization(accessToken).authorize(request);
        fail("kolo can not access the resource");
    } catch (RuntimeException expected) {
        assertEquals(403, HttpResponseException.class.cast(expected.getCause()).getStatusCode());
        assertTrue(HttpResponseException.class.cast(expected.getCause()).toString().contains("access_denied"));
    }
    ResourceServerRepresentation settings = authorization.getSettings();
    settings.setDecisionStrategy(DecisionStrategy.AFFIRMATIVE);
    authorization.update(settings);
    assertPermissions(authzClient, accessToken, request, resource, "read");
    scopePermission1 = scopePermissions.findByName(scopePermission1.getName());
    scopePermission1.addScope("read", "delete");
    scopePermissions.findById(scopePermission1.getId()).update(scopePermission1);
    assertPermissions(authzClient, accessToken, request, resource, "read", "delete");
    ScopePermissionRepresentation scopePermission2 = new ScopePermissionRepresentation();
    scopePermission2.setName(KeycloakModelUtils.generateId());
    scopePermission2.addScope("write");
    scopePermission2.addPolicy(grantPolicy.getName());
    scopePermissions.create(scopePermission2).close();
    assertPermissions(authzClient, accessToken, request, resource, "read", "delete", "write");
    ScopePermissionRepresentation scopePermission3 = new ScopePermissionRepresentation();
    scopePermission3.setName(KeycloakModelUtils.generateId());
    scopePermission3.addResource(resource.getId());
    scopePermission3.addScope("write", "read", "delete");
    scopePermission3.addPolicy(grantPolicy.getName());
    scopePermissions.create(scopePermission3).close();
    assertPermissions(authzClient, accessToken, request, resource, "read", "delete", "write");
    scopePermission2 = scopePermissions.findByName(scopePermission2.getName());
    scopePermissions.findById(scopePermission2.getId()).remove();
    assertPermissions(authzClient, accessToken, request, resource, "read", "delete", "write");
    scopePermission1 = scopePermissions.findByName(scopePermission1.getName());
    scopePermissions.findById(scopePermission1.getId()).remove();
    assertPermissions(authzClient, accessToken, request, resource, "read", "delete", "write");
    scopePermission3 = scopePermissions.findByName(scopePermission3.getName());
    scopePermission3.addScope("write", "delete");
    scopePermissions.findById(scopePermission3.getId()).update(scopePermission3);
    assertPermissions(authzClient, accessToken, request, resource, "delete", "write");
    scopePermissions.findById(scopePermission3.getId()).remove();
    try {
        authzClient.authorization(accessToken).authorize(request);
        fail("kolo can not access the resource");
    } catch (RuntimeException expected) {
        assertEquals(403, HttpResponseException.class.cast(expected.getCause()).getStatusCode());
        assertTrue(HttpResponseException.class.cast(expected.getCause()).toString().contains("access_denied"));
    }
    ResourcePermissionRepresentation grantResourcePermission = new ResourcePermissionRepresentation();
    grantResourcePermission.setName(KeycloakModelUtils.generateId());
    grantResourcePermission.addResource(resource.getId());
    grantResourcePermission.addPolicy(grantPolicy.getName());
    authorization.permissions().resource().create(grantResourcePermission).close();
    assertPermissions(authzClient, accessToken, request, resource, "read", "delete", "write");
    settings.setDecisionStrategy(DecisionStrategy.UNANIMOUS);
    authorization.update(settings);
    try {
        authzClient.authorization(accessToken).authorize(request);
        fail("kolo can not access the resource");
    } catch (RuntimeException expected) {
        assertEquals(403, HttpResponseException.class.cast(expected.getCause()).getStatusCode());
        assertTrue(HttpResponseException.class.cast(expected.getCause()).toString().contains("access_denied"));
    }
}

Example 5 with ScopePermissionsResource

use of org.keycloak.admin.client.resource.ScopePermissionsResource in project keycloak by keycloak.

the class ScopePermissionManagementTest method testUpdate.

@Test
public void testUpdate() {
    AuthorizationResource authorization = getClient().authorization();
    ScopePermissionRepresentation representation = new ScopePermissionRepresentation();
    representation.setName("Update Test Scope Permission");
    representation.setDescription("description");
    representation.setDecisionStrategy(DecisionStrategy.CONSENSUS);
    representation.setLogic(Logic.NEGATIVE);
    representation.addResource("Resource A");
    representation.addScope("read", "execute");
    representation.addPolicy("Only Marta Policy", "Only Kolo Policy");
    assertCreated(authorization, representation);
    representation.setName("changed");
    representation.setDescription("changed");
    representation.setDecisionStrategy(DecisionStrategy.AFFIRMATIVE);
    representation.setLogic(Logic.POSITIVE);
    representation.getResources().remove("Resource A");
    representation.addResource("Resource B");
    representation.getScopes().remove("execute");
    representation.getPolicies().remove("Only Marta Policy");
    ScopePermissionsResource permissions = authorization.permissions().scope();
    ScopePermissionResource permission = permissions.findById(representation.getId());
    permission.update(representation);
    assertRepresentation(representation, permission);
}