Examples with UserConsentModel org.keycloak.models.UserConsentModel used on opensource projects

Example 26 with UserConsentModel

use of org.keycloak.models.UserConsentModel in project keycloak by keycloak.

the class AuthenticationManager method actionRequired.

public static Response actionRequired(final KeycloakSession session, final AuthenticationSessionModel authSession, final HttpRequest request, final EventBuilder event) {
    final RealmModel realm = authSession.getRealm();
    final UserModel user = authSession.getAuthenticatedUser();
    final ClientModel client = authSession.getClient();
    evaluateRequiredActionTriggers(session, authSession, request, event, realm, user);
    logger.debugv("processAccessCode: go to oauth page?: {0}", client.isConsentRequired());
    event.detail(Details.CODE_ID, authSession.getParentSession().getId());
    Stream<String> requiredActions = user.getRequiredActionsStream();
    Response action = executionActions(session, authSession, request, event, realm, user, requiredActions);
    if (action != null)
        return action;
    // executionActions() method should remove any duplicate actions that might be in the clientSession
    action = executionActions(session, authSession, request, event, realm, user, authSession.getRequiredActions().stream());
    if (action != null)
        return action;
    // so the consent is required when running a verification flow of OAuth 2.0 Device Authorization Grant.
    if (client.isConsentRequired() || isOAuth2DeviceVerificationFlow(authSession)) {
        UserConsentModel grantedConsent = getEffectiveGrantedConsent(session, authSession);
        List<AuthorizationDetails> clientScopesToApprove = getClientScopesToApproveOnConsentScreen(grantedConsent, session);
        // Skip grant screen if everything was already approved by this user
        if (clientScopesToApprove.size() > 0) {
            String execution = AuthenticatedClientSessionModel.Action.OAUTH_GRANT.name();
            ClientSessionCode<AuthenticationSessionModel> accessCode = new ClientSessionCode<>(session, realm, authSession);
            accessCode.setAction(AuthenticatedClientSessionModel.Action.REQUIRED_ACTIONS.name());
            authSession.setAuthNote(AuthenticationProcessor.CURRENT_AUTHENTICATION_EXECUTION, execution);
            return session.getProvider(LoginFormsProvider.class).setAuthenticationSession(authSession).setExecution(execution).setClientSessionCode(accessCode.getOrGenerateCode()).setAccessRequest(clientScopesToApprove).createOAuthGrant();
        } else {
            String consentDetail = (grantedConsent != null) ? Details.CONSENT_VALUE_PERSISTED_CONSENT : Details.CONSENT_VALUE_NO_CONSENT_REQUIRED;
            event.detail(Details.CONSENT, consentDetail);
        }
    } else {
        event.detail(Details.CONSENT, Details.CONSENT_VALUE_NO_CONSENT_REQUIRED);
    }
    return null;
}

Example 27 with UserConsentModel

use of org.keycloak.models.UserConsentModel in project keycloak by keycloak.

the class AuthenticationManager method nextRequiredAction.

// Return null if action is not required. Or the name of the requiredAction in case it is required.
public static String nextRequiredAction(final KeycloakSession session, final AuthenticationSessionModel authSession, final HttpRequest request, final EventBuilder event) {
    final RealmModel realm = authSession.getRealm();
    final UserModel user = authSession.getAuthenticatedUser();
    final ClientModel client = authSession.getClient();
    evaluateRequiredActionTriggers(session, authSession, request, event, realm, user);
    Optional<String> reqAction = user.getRequiredActionsStream().findFirst();
    if (reqAction.isPresent()) {
        return reqAction.get();
    }
    if (!authSession.getRequiredActions().isEmpty()) {
        return authSession.getRequiredActions().iterator().next();
    }
    String kcAction = authSession.getClientNote(Constants.KC_ACTION);
    if (kcAction != null) {
        return kcAction;
    }
    if (client.isConsentRequired() || isOAuth2DeviceVerificationFlow(authSession)) {
        UserConsentModel grantedConsent = getEffectiveGrantedConsent(session, authSession);
        // See if any clientScopes need to be approved on consent screen
        List<AuthorizationDetails> clientScopesToApprove = getClientScopesToApproveOnConsentScreen(grantedConsent, session);
        if (!clientScopesToApprove.isEmpty()) {
            return CommonClientSessionModel.Action.OAUTH_GRANT.name();
        }
        String consentDetail = (grantedConsent != null) ? Details.CONSENT_VALUE_PERSISTED_CONSENT : Details.CONSENT_VALUE_NO_CONSENT_REQUIRED;
        event.detail(Details.CONSENT, consentDetail);
    } else {
        event.detail(Details.CONSENT, Details.CONSENT_VALUE_NO_CONSENT_REQUIRED);
    }
    return null;
}

Example 28 with UserConsentModel

use of org.keycloak.models.UserConsentModel in project keycloak by keycloak.

the class UserResource method getConsents.

/**
 * Get consents granted by the user
 *
 * @return
 */
@Path("consents")
@GET
@NoCache
@Produces(MediaType.APPLICATION_JSON)
public Stream<Map<String, Object>> getConsents() {
    auth.users().requireView(user);
    Set<ClientModel> offlineClients = new UserSessionManager(session).findClientsWithOfflineToken(realm, user);
    Set<ClientModel> clientsWithUserConsents = new HashSet<>();
    List<UserConsentModel> userConsents = session.users().getConsentsStream(realm, user.getId()).peek(ucm -> clientsWithUserConsents.add(ucm.getClient())).collect(Collectors.toList());
    return Stream.concat(userConsents.stream().map(consent -> toConsent(consent, offlineClients)), offlineClients.stream().filter(c -> !clientsWithUserConsents.contains(c)).map(this::toConsent));
}

Example 29 with UserConsentModel

use of org.keycloak.models.UserConsentModel in project keycloak by keycloak.

the class UserConsentWithUserStorageModelTest method updateWithClientScopeRemovalTest.

@Test
@ModelTest
public void updateWithClientScopeRemovalTest(KeycloakSession session) {
    KeycloakModelUtils.runJobInTransaction(session.getKeycloakSessionFactory(), (KeycloakSession sessionScopeRemoval1) -> {
        KeycloakSession currentSession = sessionScopeRemoval1;
        RealmModel realm = currentSession.realms().getRealmByName("original");
        ClientModel fooClient = realm.getClientByClientId("foo-client");
        UserModel john = currentSession.users().getUserByUsername(realm, "john");
        UserConsentModel johnConsent = currentSession.users().getConsentByClient(realm, john.getId(), fooClient.getId());
        Assert.assertEquals(1, johnConsent.getGrantedClientScopes().size());
        // Remove foo protocol mapper from johnConsent
        ClientScopeModel fooScope = KeycloakModelUtils.getClientScopeByName(realm, "foo");
        johnConsent.getGrantedClientScopes().remove(fooScope);
        currentSession.users().updateConsent(realm, john.getId(), johnConsent);
    });
    KeycloakModelUtils.runJobInTransaction(session.getKeycloakSessionFactory(), (KeycloakSession sessionScopeRemoval2) -> {
        KeycloakSession currentSession = sessionScopeRemoval2;
        RealmModel realm = currentSession.realms().getRealmByName("original");
        ClientModel fooClient = realm.getClientByClientId("foo-client");
        UserModel john = currentSession.users().getUserByUsername(realm, "john");
        UserConsentModel johnConsent = currentSession.users().getConsentByClient(realm, john.getId(), fooClient.getId());
        Assert.assertEquals(johnConsent.getGrantedClientScopes().size(), 0);
        Assert.assertTrue("Created date should be less than last updated date", johnConsent.getCreatedDate() < johnConsent.getLastUpdatedDate());
    });
}

Example 30 with UserConsentModel

use of org.keycloak.models.UserConsentModel in project keycloak by keycloak.

the class UserConsentWithUserStorageModelTest method getAllConsentTest.

@Test
@ModelTest
public void getAllConsentTest(KeycloakSession session) {
    KeycloakModelUtils.runJobInTransaction(session.getKeycloakSessionFactory(), (KeycloakSession currentSessionACT) -> {
        KeycloakSession currentSession = currentSessionACT;
        RealmModel realm = currentSession.realms().getRealmByName("original");
        ClientModel fooClient = realm.getClientByClientId("foo-client");
        UserModel john = currentSessionACT.users().getUserByUsername(realm, "john");
        UserModel mary = currentSessionACT.users().getUserByUsername(realm, "mary");
        Assert.assertEquals(2, currentSession.users().getConsentsStream(realm, john.getId()).count());
        ClientModel hardcodedClient = currentSessionACT.clients().getClientByClientId(realm, "hardcoded-client");
        List<UserConsentModel> maryConsents = currentSession.users().getConsentsStream(realm, mary.getId()).collect(Collectors.toList());
        Assert.assertEquals(2, maryConsents.size());
        UserConsentModel maryConsent = maryConsents.get(0);
        UserConsentModel maryHardcodedConsent = maryConsents.get(1);
        if (maryConsents.get(0).getClient().getId().equals(hardcodedClient.getId())) {
            maryConsent = maryConsents.get(1);
            maryHardcodedConsent = maryConsents.get(0);
        }
        Assert.assertEquals(maryConsent.getClient().getId(), fooClient.getId());
        Assert.assertEquals(maryConsent.getGrantedClientScopes().size(), 1);
        Assert.assertTrue(isClientScopeGranted(realm, "foo", maryConsent));
        Assert.assertEquals(maryHardcodedConsent.getClient().getId(), hardcodedClient.getId());
        Assert.assertEquals(maryHardcodedConsent.getGrantedClientScopes().size(), 0);
    });
}