Examples with ProtectionResource org.keycloak.authorization.client.resource.ProtectionResource used on opensource projects

Example 16 with ProtectionResource

use of org.keycloak.authorization.client.resource.ProtectionResource in project keycloak by keycloak.

the class UserManagedPermissionServiceTest method testGrantRequestedScopesOnly.

@Test
public void testGrantRequestedScopesOnly() {
    ResourceRepresentation resource = new ResourceRepresentation();
    resource.setName(UUID.randomUUID().toString());
    resource.setOwnerManagedAccess(true);
    resource.setOwner("marta");
    resource.addScope("view", "delete");
    ProtectionResource protection = getAuthzClient().protection("marta", "password");
    resource = protection.resource().create(resource);
    UmaPermissionRepresentation permission = new UmaPermissionRepresentation();
    permission.setName("Custom User-Managed Permission");
    permission.addScope("view");
    permission.addUser("kolo");
    permission = protection.policy(resource.getId()).create(permission);
    AuthorizationRequest request = new AuthorizationRequest();
    request.addPermission(resource.getId(), "view");
    AuthorizationResponse response = getAuthzClient().authorization("kolo", "password").authorize(request);
    AccessToken rpt = toAccessToken(response.getToken());
    Collection<Permission> permissions = rpt.getAuthorization().getPermissions();
    assertPermissions(permissions, resource.getId(), "view");
    assertTrue(permissions.isEmpty());
    request = new AuthorizationRequest();
    request.addPermission(resource.getId(), "delete");
    try {
        getAuthzClient().authorization("kolo", "password").authorize(request);
        fail("User should not have permission");
    } catch (Exception e) {
        assertTrue(AuthorizationDeniedException.class.isInstance(e));
    }
    request = new AuthorizationRequest();
    request.addPermission(resource.getId(), "delete");
    try {
        getAuthzClient().authorization("kolo", "password").authorize(request);
        fail("User should not have permission");
    } catch (Exception e) {
        assertTrue(AuthorizationDeniedException.class.isInstance(e));
    }
    request = new AuthorizationRequest();
    request.addPermission(resource.getId());
    response = getAuthzClient().authorization("kolo", "password").authorize(request);
    rpt = toAccessToken(response.getToken());
    permissions = rpt.getAuthorization().getPermissions();
    assertPermissions(permissions, resource.getId(), "view");
    assertTrue(permissions.isEmpty());
}

Example 17 with ProtectionResource

use of org.keycloak.authorization.client.resource.ProtectionResource in project keycloak by keycloak.

the class UserManagedPermissionServiceTest method testPermissionInAdditionToUserGrantedPermission.

@Test
public void testPermissionInAdditionToUserGrantedPermission() {
    ResourceRepresentation resource = new ResourceRepresentation();
    resource.setName("Resource A");
    resource.setOwnerManagedAccess(true);
    resource.setOwner("marta");
    resource.addScope("Scope A", "Scope B", "Scope C");
    resource = getAuthzClient().protection().resource().create(resource);
    PermissionResponse ticketResponse = getAuthzClient().protection().permission().create(new PermissionRequest(resource.getId(), "Scope A"));
    AuthorizationRequest request = new AuthorizationRequest();
    request.setTicket(ticketResponse.getTicket());
    try {
        getAuthzClient().authorization("kolo", "password").authorize(request);
        fail("User should not have permission");
    } catch (Exception e) {
        assertTrue(AuthorizationDeniedException.class.isInstance(e));
        assertTrue(e.getMessage().contains("request_submitted"));
    }
    List<PermissionTicketRepresentation> tickets = getAuthzClient().protection().permission().findByResource(resource.getId());
    assertEquals(1, tickets.size());
    PermissionTicketRepresentation ticket = tickets.get(0);
    ticket.setGranted(true);
    getAuthzClient().protection().permission().update(ticket);
    AuthorizationResponse authzResponse = getAuthzClient().authorization("kolo", "password").authorize(request);
    assertNotNull(authzResponse);
    UmaPermissionRepresentation permission = new UmaPermissionRepresentation();
    permission.setName("Custom User-Managed Permission");
    permission.addScope("Scope A");
    permission.addRole("role_a");
    ProtectionResource protection = getAuthzClient().protection("marta", "password");
    permission = protection.policy(resource.getId()).create(permission);
    getAuthzClient().authorization("kolo", "password").authorize(request);
    ticket.setGranted(false);
    getAuthzClient().protection().permission().update(ticket);
    getAuthzClient().authorization("kolo", "password").authorize(request);
    permission = getAuthzClient().protection("marta", "password").policy(resource.getId()).findById(permission.getId());
    assertNotNull(permission);
    permission.removeRole("role_a");
    permission.addRole("role_b");
    getAuthzClient().protection("marta", "password").policy(resource.getId()).update(permission);
    try {
        getAuthzClient().authorization("kolo", "password").authorize(request);
        fail("User should not have permission");
    } catch (Exception e) {
        assertTrue(AuthorizationDeniedException.class.isInstance(e));
    }
    request = new AuthorizationRequest();
    request.addPermission(resource.getId());
    try {
        getAuthzClient().authorization("kolo", "password").authorize(request);
        fail("User should not have permission");
    } catch (Exception e) {
        assertTrue(AuthorizationDeniedException.class.isInstance(e));
    }
    getAuthzClient().protection("marta", "password").policy(resource.getId()).delete(permission.getId());
    try {
        getAuthzClient().authorization("kolo", "password").authorize(request);
        fail("User should not have permission");
    } catch (Exception e) {
        assertTrue(AuthorizationDeniedException.class.isInstance(e));
    }
}

Example 18 with ProtectionResource

use of org.keycloak.authorization.client.resource.ProtectionResource in project keycloak by keycloak.

the class UserManagedPermissionServiceTest method testUploadScriptDisabled.

@Test
@DisableFeature(value = Profile.Feature.UPLOAD_SCRIPTS, skipRestart = true)
public void testUploadScriptDisabled() {
    ResourceRepresentation resource = new ResourceRepresentation();
    resource.setName("Resource A");
    resource.setOwnerManagedAccess(true);
    resource.setOwner("marta");
    resource.addScope("Scope A", "Scope B", "Scope C");
    resource = getAuthzClient().protection().resource().create(resource);
    UmaPermissionRepresentation newPermission = new UmaPermissionRepresentation();
    newPermission.setName("Custom User-Managed Permission");
    newPermission.setDescription("Users from specific roles are allowed to access");
    newPermission.setCondition("$evaluation.grant()");
    ProtectionResource protection = getAuthzClient().protection("marta", "password");
    try {
        protection.policy(resource.getId()).create(newPermission);
        fail("Should fail because upload scripts is disabled");
    } catch (Exception ignore) {
    }
    newPermission.setCondition(null);
    UmaPermissionRepresentation representation = protection.policy(resource.getId()).create(newPermission);
    representation.setCondition("$evaluation.grant();");
    try {
        protection.policy(resource.getId()).update(newPermission);
        fail("Should fail because upload scripts is disabled");
    } catch (Exception ignore) {
    }
}

Example 19 with ProtectionResource

use of org.keycloak.authorization.client.resource.ProtectionResource in project keycloak by keycloak.

the class UserManagedPermissionServiceTest method testOwnerAccess.

@Test
public void testOwnerAccess() {
    ResourceRepresentation resource = new ResourceRepresentation();
    resource.setName(UUID.randomUUID().toString());
    resource.setOwner("marta");
    resource.addScope("Scope A", "Scope B", "Scope C");
    resource.setOwnerManagedAccess(true);
    ProtectionResource protection = getAuthzClient().protection();
    resource = protection.resource().create(resource);
    UmaPermissionRepresentation rep = null;
    try {
        rep = new UmaPermissionRepresentation();
        rep.setName("test");
        rep.addRole("role_b");
        rep = getAuthzClient().protection("marta", "password").policy(resource.getId()).create(rep);
    } catch (Exception e) {
        assertTrue(HttpResponseException.class.cast(e.getCause()).toString().contains("Only resources with owner managed accessed can have policies"));
    }
    AuthorizationResource authorization = getAuthzClient().authorization("marta", "password");
    AuthorizationRequest request = new AuthorizationRequest();
    request.addPermission(resource.getId(), "Scope A");
    AuthorizationResponse authorize = authorization.authorize(request);
    assertNotNull(authorize);
    try {
        getAuthzClient().authorization("kolo", "password").authorize(request);
        fail("User should not have permission");
    } catch (Exception e) {
        assertTrue(AuthorizationDeniedException.class.isInstance(e));
    }
    rep.addRole("role_a");
    getAuthzClient().protection("marta", "password").policy(resource.getId()).update(rep);
    authorization = getAuthzClient().authorization("kolo", "password");
    assertNotNull(authorization.authorize(request));
}

Example 20 with ProtectionResource

use of org.keycloak.authorization.client.resource.ProtectionResource in project keycloak by keycloak.

the class AbstractResourceServerTest method authorize.

protected AuthorizationResponse authorize(String userName, String password, String[] additionalScopes, String rpt, String accessToken, String claimToken, String tokenFormat, PermissionRequest... permissions) {
    ProtectionResource protection;
    if (userName != null) {
        protection = getAuthzClient().protection(userName, password);
    } else {
        protection = getAuthzClient().protection();
    }
    String ticket = protection.permission().create(Arrays.asList(permissions)).getTicket();
    AuthorizationRequest authorizationRequest = new AuthorizationRequest(ticket);
    if (additionalScopes != null) {
        StringBuilder builder = new StringBuilder();
        for (String scope : additionalScopes) {
            if (builder.length() > 0) {
                builder.append(" ");
            }
            builder.append(scope);
        }
        authorizationRequest.setScope(builder.toString());
    }
    authorizationRequest.setRpt(rpt);
    authorizationRequest.setClaimTokenFormat(tokenFormat);
    authorizationRequest.setClaimToken(claimToken);
    org.keycloak.authorization.client.resource.AuthorizationResource authorization;
    if (userName != null) {
        authorization = getAuthzClient().authorization(userName, password);
    } else if (accessToken != null) {
        authorization = getAuthzClient().authorization(accessToken);
    } else {
        authorization = getAuthzClient().authorization();
    }
    return authorization.authorize(authorizationRequest);
}