Examples with AuthzClient org.keycloak.authorization.client.AuthzClient used on opensource projects

Example 16 with AuthzClient

use of org.keycloak.authorization.client.AuthzClient in project keycloak by keycloak.

the class PermissionClaimTest method testClaimsFromDifferentResourcePermissions.

@Test
public void testClaimsFromDifferentResourcePermissions() throws Exception {
    ClientResource client = getClient(getRealm());
    AuthorizationResource authorization = client.authorization();
    ResourceRepresentation resourceA = new ResourceRepresentation(KeycloakModelUtils.generateId());
    resourceA.setType("typed-resource");
    authorization.resources().create(resourceA).close();
    ResourcePermissionRepresentation allScopesPermission = new ResourcePermissionRepresentation();
    allScopesPermission.setName(KeycloakModelUtils.generateId());
    allScopesPermission.addResource(resourceA.getName());
    allScopesPermission.addPolicy(claimAPolicy.getName(), claimBPolicy.getName());
    authorization.permissions().resource().create(allScopesPermission).close();
    ResourcePermissionRepresentation updatePermission = new ResourcePermissionRepresentation();
    updatePermission.setName(KeycloakModelUtils.generateId());
    updatePermission.addResource(resourceA.getName());
    updatePermission.addPolicy(claimCPolicy.getName());
    try (Response response = authorization.permissions().resource().create(updatePermission)) {
        updatePermission = response.readEntity(ResourcePermissionRepresentation.class);
    }
    AuthzClient authzClient = getAuthzClient();
    AuthorizationResponse response = authzClient.authorization("marta", "password").authorize();
    assertNotNull(response.getToken());
    AccessToken rpt = toAccessToken(response.getToken());
    Authorization authorizationClaim = rpt.getAuthorization();
    List<Permission> permissions = new ArrayList<>(authorizationClaim.getPermissions());
    assertEquals(1, permissions.size());
    for (Permission permission : permissions) {
        Map<String, Set<String>> claims = permission.getClaims();
        assertNotNull(claims);
        assertThat(claims.get("claim-a"), Matchers.containsInAnyOrder("claim-a", "claim-a1"));
        assertThat(claims.get("claim-b"), Matchers.containsInAnyOrder("claim-b"));
        assertThat(claims.get("claim-c"), Matchers.containsInAnyOrder("claim-c"));
    }
    updatePermission.addPolicy(denyPolicy.getName());
    authorization.permissions().resource().findById(updatePermission.getId()).update(updatePermission);
    try {
        authzClient.authorization("marta", "password").authorize();
        fail("can not access resource");
    } catch (RuntimeException expected) {
        assertEquals(403, HttpResponseException.class.cast(expected.getCause()).getStatusCode());
        assertTrue(HttpResponseException.class.cast(expected.getCause()).toString().contains("access_denied"));
    }
    ResourceRepresentation resourceInstance = new ResourceRepresentation(KeycloakModelUtils.generateId(), "create", "update");
    resourceInstance.setType(resourceA.getType());
    resourceInstance.setOwner("marta");
    try (Response response1 = authorization.resources().create(resourceInstance)) {
        resourceInstance = response1.readEntity(ResourceRepresentation.class);
    }
    AuthorizationRequest request = new AuthorizationRequest();
    request.addPermission(null, "create", "update");
    try {
        authzClient.authorization("marta", "password").authorize(request);
        fail("can not access resource");
    } catch (RuntimeException expected) {
        assertEquals(403, HttpResponseException.class.cast(expected.getCause()).getStatusCode());
        assertTrue(HttpResponseException.class.cast(expected.getCause()).toString().contains("access_denied"));
    }
    ResourcePermissionRepresentation resourceInstancePermission = new ResourcePermissionRepresentation();
    resourceInstancePermission.setName(KeycloakModelUtils.generateId());
    resourceInstancePermission.addResource(resourceInstance.getId());
    resourceInstancePermission.addPolicy(claimCPolicy.getName());
    try (Response response1 = authorization.permissions().resource().create(resourceInstancePermission)) {
        resourceInstancePermission = response1.readEntity(ResourcePermissionRepresentation.class);
    }
    response = authzClient.authorization("marta", "password").authorize(request);
    assertNotNull(response.getToken());
    rpt = toAccessToken(response.getToken());
    authorizationClaim = rpt.getAuthorization();
    permissions = new ArrayList<>(authorizationClaim.getPermissions());
    assertEquals(1, permissions.size());
    for (Permission permission : permissions) {
        Map<String, Set<String>> claims = permission.getClaims();
        assertNotNull(claims);
        assertThat(claims.get("claim-a"), Matchers.containsInAnyOrder("claim-a", "claim-a1"));
        assertThat(claims.get("claim-b"), Matchers.containsInAnyOrder("claim-b"));
        assertThat(claims.get("claim-c"), Matchers.containsInAnyOrder("claim-c"));
        assertThat(claims.get("deny-policy"), Matchers.containsInAnyOrder("deny-policy"));
    }
    response = authzClient.authorization("marta", "password").authorize();
    assertNotNull(response.getToken());
    rpt = toAccessToken(response.getToken());
    authorizationClaim = rpt.getAuthorization();
    permissions = new ArrayList<>(authorizationClaim.getPermissions());
    assertEquals(1, permissions.size());
    for (Permission permission : permissions) {
        Map<String, Set<String>> claims = permission.getClaims();
        assertNotNull(claims);
        assertThat(claims.get("claim-a"), Matchers.containsInAnyOrder("claim-a", "claim-a1"));
        assertThat(claims.get("claim-b"), Matchers.containsInAnyOrder("claim-b"));
        assertThat(claims.get("claim-c"), Matchers.containsInAnyOrder("claim-c"));
        assertThat(claims.get("deny-policy"), Matchers.containsInAnyOrder("deny-policy"));
        assertThat(permission.getScopes(), Matchers.containsInAnyOrder("create", "update"));
    }
    updatePermission.setPolicies(new HashSet<>());
    updatePermission.addPolicy(claimCPolicy.getName());
    authorization.permissions().resource().findById(updatePermission.getId()).update(updatePermission);
    response = authzClient.authorization("marta", "password").authorize();
    assertNotNull(response.getToken());
    rpt = toAccessToken(response.getToken());
    authorizationClaim = rpt.getAuthorization();
    permissions = new ArrayList<>(authorizationClaim.getPermissions());
    assertEquals(2, permissions.size());
    for (Permission permission : permissions) {
        Map<String, Set<String>> claims = permission.getClaims();
        assertNotNull(claims);
        assertThat(claims.get("claim-a"), Matchers.containsInAnyOrder("claim-a", "claim-a1"));
        assertThat(claims.get("claim-b"), Matchers.containsInAnyOrder("claim-b"));
        assertThat(claims.get("claim-c"), Matchers.containsInAnyOrder("claim-c"));
    }
}

Example 17 with AuthzClient

use of org.keycloak.authorization.client.AuthzClient in project keycloak by keycloak.

the class PermissionManagementTest method testCreatePermissionTicketWithResourceId.

@Test
public void testCreatePermissionTicketWithResourceId() throws Exception {
    ResourceRepresentation resource = addResource("Resource A", "kolo", true);
    AuthzClient authzClient = getAuthzClient();
    PermissionResponse response = authzClient.protection("marta", "password").permission().create(new PermissionRequest(resource.getId()));
    AuthorizationRequest request = new AuthorizationRequest();
    request.setTicket(response.getTicket());
    request.setClaimToken(authzClient.obtainAccessToken("marta", "password").getToken());
    try {
        authzClient.authorization().authorize(request);
    } catch (Exception e) {
    }
    assertNotNull(response.getTicket());
    assertFalse(authzClient.protection().permission().findByResource(resource.getId()).isEmpty());
}

Example 18 with AuthzClient

use of org.keycloak.authorization.client.AuthzClient in project keycloak by keycloak.

the class PermissionManagementTest method testGetPermissionTicketWithPagination.

@Test
public void testGetPermissionTicketWithPagination() throws Exception {
    String[] scopes = { "ScopeA", "ScopeB", "ScopeC", "ScopeD" };
    ResourceRepresentation resource = addResource("Resource A", "kolo", true, scopes);
    AuthzClient authzClient = getAuthzClient();
    PermissionResponse response = authzClient.protection("marta", "password").permission().create(new PermissionRequest(resource.getId(), scopes));
    AuthorizationRequest request = new AuthorizationRequest();
    request.setTicket(response.getTicket());
    request.setClaimToken(authzClient.obtainAccessToken("marta", "password").getToken());
    try {
        authzClient.authorization().authorize(request);
    } catch (Exception e) {
    }
    // start with fetching the second half of all permission tickets
    Collection<String> expectedScopes = new ArrayList(Arrays.asList(scopes));
    List<PermissionTicketRepresentation> tickets = getAuthzClient().protection().permission().find(resource.getId(), null, null, null, null, true, 2, 2);
    assertEquals("Returned number of permissions tickets must match the specified page size (i.e., 'maxResult').", 2, tickets.size());
    boolean foundScope = expectedScopes.remove(tickets.get(0).getScopeName());
    assertTrue("Returned set of permission tickets must be only a sub-set as per pagination offset and specified page size.", foundScope);
    foundScope = expectedScopes.remove(tickets.get(1).getScopeName());
    assertTrue("Returned set of permission tickets must be only a sub-set as per pagination offset and specified page size.", foundScope);
    // fetch the first half of all permission tickets
    tickets = getAuthzClient().protection().permission().find(resource.getId(), null, null, null, null, true, 0, 2);
    assertEquals("Returned number of permissions tickets must match the specified page size (i.e., 'maxResult').", 2, tickets.size());
    foundScope = expectedScopes.remove(tickets.get(0).getScopeName());
    assertTrue("Returned set of permission tickets must be only a sub-set as per pagination offset and specified page size.", foundScope);
    foundScope = expectedScopes.remove(tickets.get(1).getScopeName());
    assertTrue("Returned set of permission tickets must be only a sub-set as per pagination offset and specified page size.", foundScope);
}

Example 19 with AuthzClient

use of org.keycloak.authorization.client.AuthzClient in project keycloak by keycloak.

the class PermissionManagementTest method testCreatePermissionTicketWithScopes.

@Test
public void testCreatePermissionTicketWithScopes() throws Exception {
    ResourceRepresentation resource = addResource("Resource A", "kolo", true, "ScopeA", "ScopeB", "ScopeC");
    AuthzClient authzClient = getAuthzClient();
    PermissionResponse response = authzClient.protection("marta", "password").permission().create(new PermissionRequest(resource.getId(), "ScopeA", "ScopeB", "ScopeC"));
    AuthorizationRequest request = new AuthorizationRequest();
    request.setTicket(response.getTicket());
    request.setClaimToken(authzClient.obtainAccessToken("marta", "password").getToken());
    try {
        authzClient.authorization().authorize(request);
    } catch (Exception e) {
    }
    assertPersistence(response, resource, "ScopeA", "ScopeB", "ScopeC");
}

Example 20 with AuthzClient

use of org.keycloak.authorization.client.AuthzClient in project keycloak by keycloak.

the class PermissionManagementTest method testRemoveScopeFromResource.

@Test
public void testRemoveScopeFromResource() throws Exception {
    ResourceRepresentation resource = addResource("Resource A", "kolo", true, "ScopeA", "ScopeB");
    PermissionRequest permissionRequest = new PermissionRequest(resource.getId(), "ScopeA", "ScopeB");
    AuthzClient authzClient = getAuthzClient();
    PermissionResponse response = authzClient.protection("marta", "password").permission().create(permissionRequest);
    assertNotNull(response.getTicket());
    AuthorizationRequest request = new AuthorizationRequest();
    request.setTicket(response.getTicket());
    request.setClaimToken(authzClient.obtainAccessToken("marta", "password").getToken());
    try {
        authzClient.authorization().authorize(request);
    } catch (Exception e) {
    }
    AuthorizationResource authorization = getClient(getRealm()).authorization();
    ResourceScopesResource scopes = authorization.scopes();
    ScopeRepresentation removedScope = scopes.findByName("ScopeA");
    List permissions = authzClient.protection().permission().findByScope(removedScope.getId());
    assertFalse(permissions.isEmpty());
    resource.setScopes(new HashSet<>());
    resource.addScope("ScopeB");
    authorization.resources().resource(resource.getId()).update(resource);
    permissions = authzClient.protection().permission().findByScope(removedScope.getId());
    assertTrue(permissions.isEmpty());
    ScopeRepresentation scopeB = scopes.findByName("ScopeB");
    permissions = authzClient.protection().permission().findByScope(scopeB.getId());
    assertFalse(permissions.isEmpty());
}