Examples with OIDCAdvancedConfigWrapper org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper used on opensource projects

Example 26 with OIDCAdvancedConfigWrapper

use of org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper in project keycloak by keycloak.

the class OIDCClientRegistrationTest method testRequestUris.

@Test
public void testRequestUris() throws Exception {
    OIDCClientRepresentation clientRep = null;
    OIDCClientRepresentation response = null;
    clientRep = createRep();
    clientRep.setRequestUris(Arrays.asList("http://host/foo", "https://host2/bar"));
    response = reg.oidc().create(clientRep);
    Assert.assertNames(response.getRequestUris(), "http://host/foo", "https://host2/bar");
    // Test Keycloak representation
    ClientRepresentation kcClient = getClient(response.getClientId());
    OIDCAdvancedConfigWrapper config = OIDCAdvancedConfigWrapper.fromClientRepresentation(kcClient);
    Assert.assertNames(config.getRequestUris(), "http://host/foo", "https://host2/bar");
}

Example 27 with OIDCAdvancedConfigWrapper

use of org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper in project keycloak by keycloak.

the class OIDCClientRegistrationTest method testClientWithRefreshToken.

@Test
public void testClientWithRefreshToken() throws Exception {
    OIDCClientRepresentation clientRep = null;
    OIDCClientRepresentation response = null;
    clientRep = createRep();
    clientRep.setGrantTypes(Arrays.asList(OAuth2Constants.AUTHORIZATION_CODE, OAuth2Constants.REFRESH_TOKEN));
    response = reg.oidc().create(clientRep);
    // Test Keycloak representation
    ClientRepresentation kcClient = getClient(response.getClientId());
    OIDCAdvancedConfigWrapper config = OIDCAdvancedConfigWrapper.fromClientRepresentation(kcClient);
    Assert.assertTrue(config.isUseRefreshToken());
}

Example 28 with OIDCAdvancedConfigWrapper

use of org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper in project keycloak by keycloak.

the class OIDCClientRegistrationTest method testAuthorizationEncryptedResponse.

@Test
public void testAuthorizationEncryptedResponse() throws Exception {
    OIDCClientRepresentation response = null;
    OIDCClientRepresentation updated = null;
    try {
        OIDCClientRepresentation clientRep = createRep();
        clientRep.setAuthorizationEncryptedResponseAlg(JWEConstants.RSA1_5);
        clientRep.setAuthorizationEncryptedResponseEnc(JWEConstants.A128CBC_HS256);
        // create
        response = reg.oidc().create(clientRep);
        Assert.assertEquals(JWEConstants.RSA1_5, response.getAuthorizationEncryptedResponseAlg());
        Assert.assertEquals(JWEConstants.A128CBC_HS256, response.getAuthorizationEncryptedResponseEnc());
        // Test Keycloak representation
        ClientRepresentation kcClient = getClient(response.getClientId());
        OIDCAdvancedConfigWrapper config = OIDCAdvancedConfigWrapper.fromClientRepresentation(kcClient);
        Assert.assertEquals(JWEConstants.RSA1_5, config.getAuthorizationEncryptedResponseAlg());
        Assert.assertEquals(JWEConstants.A128CBC_HS256, config.getAuthorizationEncryptedResponseEnc());
        // update
        reg.auth(Auth.token(response));
        response.setAuthorizationEncryptedResponseAlg(null);
        response.setAuthorizationEncryptedResponseEnc(null);
        updated = reg.oidc().update(response);
        Assert.assertNull(updated.getAuthorizationEncryptedResponseAlg());
        Assert.assertNull(updated.getAuthorizationEncryptedResponseEnc());
        // Test Keycloak representation
        kcClient = getClient(updated.getClientId());
        config = OIDCAdvancedConfigWrapper.fromClientRepresentation(kcClient);
        Assert.assertNull(config.getAuthorizationEncryptedResponseAlg());
        Assert.assertNull(config.getAuthorizationEncryptedResponseEnc());
    } finally {
        // revert
        reg.auth(Auth.token(updated));
        updated.setAuthorizationEncryptedResponseAlg(null);
        updated.setAuthorizationEncryptedResponseEnc(null);
        reg.oidc().update(updated);
    }
}

Example 29 with OIDCAdvancedConfigWrapper

use of org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper in project keycloak by keycloak.

the class FAPICIBATest method testFAPICIBAWithoutSignedAuthenticationRequest.

@Test
public void testFAPICIBAWithoutSignedAuthenticationRequest() throws Exception {
    setupPolicyFAPICIBAForAllClient();
    // Register client with X509
    String clientUUID = createClientByAdmin("foo", (ClientRepresentation clientRep) -> {
        clientRep.setClientAuthenticatorType(X509ClientAuthenticator.PROVIDER_ID);
        OIDCAdvancedConfigWrapper clientConfig = OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep);
        clientConfig.setRequestUris(Collections.singletonList(TestApplicationResourceUrls.clientRequestUri()));
        clientConfig.setTlsClientAuthSubjectDn("EMAILADDRESS=contact@keycloak.org, CN=Keycloak Intermediate CA, OU=Keycloak, O=Red Hat, ST=MA, C=US");
        setClientAuthMethodNeutralSettings(clientRep);
    });
    ClientResource clientResource = adminClient.realm(REALM_NAME).clients().get(clientUUID);
    ClientRepresentation client = clientResource.toRepresentation();
    assertEquals(X509ClientAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
    AuthenticationRequestAcknowledgement response = doInvalidBackchannelAuthenticationRequestWithMTLS(clientId, username, bindingMessage, () -> MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore());
    assertThat(response.getStatusCode(), is(equalTo(400)));
    assertThat(response.getError(), is(equalTo(OAuthErrorException.INVALID_REQUEST)));
    assertThat(response.getErrorDescription(), is(equalTo("Missing parameter: 'request' or 'request_uri'")));
}

Example 30 with OIDCAdvancedConfigWrapper

use of org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper in project keycloak by keycloak.

the class FAPICIBATest method testFAPIAdvancedClientRegistration.

@Test
public void testFAPIAdvancedClientRegistration() throws Exception {
    setupPolicyFAPICIBAForAllClient();
    // Register client with clientIdAndSecret - should fail
    try {
        createClientByAdmin("invalid", (ClientRepresentation clientRep) -> {
            clientRep.setClientAuthenticatorType(ClientIdAndSecretAuthenticator.PROVIDER_ID);
        });
        fail();
    } catch (ClientPolicyException e) {
        assertEquals(OAuthErrorException.INVALID_CLIENT_METADATA, e.getMessage());
    }
    // Register client with signedJWT - should fail
    try {
        createClientByAdmin("invalid", (ClientRepresentation clientRep) -> {
            clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID);
        });
        fail();
    } catch (ClientPolicyException e) {
        assertEquals(OAuthErrorException.INVALID_CLIENT_METADATA, e.getMessage());
    }
    // Register client with privateKeyJWT, but unsecured requestUri - should fail
    try {
        createClientByAdmin("invalid", (ClientRepresentation clientRep) -> {
            clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID);
            OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setRequestUris(Collections.singletonList("http://foo"));
        });
        fail();
    } catch (ClientPolicyException e) {
        assertEquals(OAuthErrorException.INVALID_CLIENT_METADATA, e.getMessage());
    }
    // Try to register client with "client-jwt" - should pass
    String clientUUID = createClientByAdmin("client-jwt", (ClientRepresentation clientRep) -> {
        clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID);
    });
    ClientRepresentation client = getClientByAdmin(clientUUID);
    Assert.assertEquals(JWTClientAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
    // Try to register client with "client-x509" - should pass
    clientUUID = createClientByAdmin("client-x509", (ClientRepresentation clientRep) -> {
        clientRep.setClientAuthenticatorType(X509ClientAuthenticator.PROVIDER_ID);
    });
    client = getClientByAdmin(clientUUID);
    Assert.assertEquals(X509ClientAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
    // Try to register client with default authenticator - should pass. Client authenticator should be "client-jwt"
    clientUUID = createClientByAdmin("client-jwt-2", (ClientRepresentation clientRep) -> {
    });
    client = getClientByAdmin(clientUUID);
    Assert.assertEquals(JWTClientAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
    // Check the Consent is enabled, Holder-of-key is enabled, fullScopeAllowed disabled and default signature algorithm.
    Assert.assertTrue(client.isConsentRequired());
    OIDCAdvancedConfigWrapper clientConfig = OIDCAdvancedConfigWrapper.fromClientRepresentation(client);
    Assert.assertTrue(clientConfig.isUseMtlsHokToken());
    Assert.assertEquals(Algorithm.PS256, clientConfig.getIdTokenSignedResponseAlg());
    Assert.assertEquals(Algorithm.PS256, clientConfig.getRequestObjectSignatureAlg().toString());
    Assert.assertFalse(client.isFullScopeAllowed());
}