Examples with IDToken org.keycloak.representations.IDToken used on opensource projects

Example 56 with IDToken

use of org.keycloak.representations.IDToken in project keycloak by keycloak.

the class OIDCScopeTest method testOptionalScopesWithConsentRequired.

@Test
public void testOptionalScopesWithConsentRequired() throws Exception {
    // Remove "displayOnConsentScreen" from address
    ClientScopeResource addressScope = ApiUtil.findClientScopeByName(testRealm(), "address");
    ClientScopeRepresentation addressScopeRep = addressScope.toRepresentation();
    addressScopeRep.getAttributes().put(ClientScopeModel.DISPLAY_ON_CONSENT_SCREEN, "false");
    addressScope.update(addressScopeRep);
    oauth.clientId("third-party");
    oauth.doLoginGrant("john", "password");
    grantPage.assertCurrent();
    grantPage.assertGrants(OAuthGrantPage.PROFILE_CONSENT_TEXT, OAuthGrantPage.EMAIL_CONSENT_TEXT, OAuthGrantPage.ROLES_CONSENT_TEXT);
    grantPage.accept();
    EventRepresentation loginEvent = events.expectLogin().user(userId).client("third-party").detail(Details.CONSENT, Details.CONSENT_VALUE_CONSENT_GRANTED).assertEvent();
    Tokens tokens = sendTokenRequest(loginEvent, userId, "openid email profile", "third-party");
    IDToken idToken = tokens.idToken;
    assertProfile(idToken, true);
    assertEmail(idToken, true);
    assertAddress(idToken, false);
    assertPhone(idToken, false);
    // Logout
    oauth.doLogout(tokens.refreshToken, "password");
    events.expectLogout(idToken.getSessionState()).client("third-party").user(userId).removeDetail(Details.REDIRECT_URI).assertEvent();
    // Login with optional scopes. Grant screen should have just "phone"
    oauth.scope("openid address phone");
    oauth.doLoginGrant("john", "password");
    grantPage.assertCurrent();
    grantPage.assertGrants(OAuthGrantPage.PHONE_CONSENT_TEXT);
    grantPage.accept();
    loginEvent = events.expectLogin().client("third-party").detail(Details.CONSENT, Details.CONSENT_VALUE_CONSENT_GRANTED).user(userId).assertEvent();
    tokens = sendTokenRequest(loginEvent, userId, "openid email profile address phone", "third-party");
    idToken = tokens.idToken;
    assertProfile(idToken, true);
    assertEmail(idToken, true);
    assertAddress(idToken, true);
    assertPhone(idToken, true);
    // Revert
    addressScopeRep.getAttributes().put(ClientScopeModel.DISPLAY_ON_CONSENT_SCREEN, "true");
    addressScope.update(addressScopeRep);
}

Example 57 with IDToken

use of org.keycloak.representations.IDToken in project keycloak by keycloak.

the class OIDCScopeTest method testRemoveScopes.

@Test
public void testRemoveScopes() throws Exception {
    // Add 'profile' as optional scope. Remove 'email' scope entirely
    String profileScopeId = ApiUtil.findClientScopeByName(testRealm(), "profile").toRepresentation().getId();
    String emailScopeId = ApiUtil.findClientScopeByName(testRealm(), "email").toRepresentation().getId();
    ClientResource testApp = ApiUtil.findClientByClientId(testRealm(), "test-app");
    testApp.removeDefaultClientScope(profileScopeId);
    testApp.removeDefaultClientScope(emailScopeId);
    testApp.addOptionalClientScope(profileScopeId);
    // Login without scope parameter. Assert 'profile' and 'email' info not there
    oauth.doLogin("john", "password");
    EventRepresentation loginEvent = events.expectLogin().user(userId).assertEvent();
    Tokens tokens = sendTokenRequest(loginEvent, userId, "openid", "test-app");
    IDToken idToken = tokens.idToken;
    assertProfile(idToken, false);
    assertEmail(idToken, false);
    assertAddress(idToken, false);
    assertPhone(idToken, false);
    // Logout
    oauth.doLogout(tokens.refreshToken, "password");
    events.expectLogout(idToken.getSessionState()).client("test-app").user(userId).removeDetail(Details.REDIRECT_URI).assertEvent();
    // Login with scope parameter. Just 'profile' is there
    oauth.scope("openid profile");
    oauth.doLogin("john", "password");
    loginEvent = events.expectLogin().user(userId).assertEvent();
    tokens = sendTokenRequest(loginEvent, userId, "openid profile", "test-app");
    idToken = tokens.idToken;
    assertProfile(idToken, true);
    assertEmail(idToken, false);
    assertAddress(idToken, false);
    assertPhone(idToken, false);
    // Revert
    testApp.removeOptionalClientScope(profileScopeId);
    testApp.addDefaultClientScope(profileScopeId);
    testApp.addDefaultClientScope(emailScopeId);
}

Example 58 with IDToken

use of org.keycloak.representations.IDToken in project keycloak by keycloak.

the class OIDCScopeTest method testBuiltinOptionalScopes.

@Test
public void testBuiltinOptionalScopes() throws Exception {
    // Login. Assert that just 'profile' and 'email' data are there. 'Address' and 'phone' not
    oauth.doLogin("john", "password");
    EventRepresentation loginEvent = events.expectLogin().user(userId).assertEvent();
    Tokens tokens = sendTokenRequest(loginEvent, userId, "openid email profile", "test-app");
    IDToken idToken = tokens.idToken;
    assertProfile(idToken, true);
    assertEmail(idToken, true);
    assertAddress(idToken, false);
    assertPhone(idToken, false);
    // check both idtoken and access token for microprofile claims.
    assertMicroprofile(idToken, false);
    assertMicroprofile(tokens.accessToken, false);
    // Logout
    oauth.doLogout(tokens.refreshToken, "password");
    events.expectLogout(idToken.getSessionState()).client("test-app").user(userId).removeDetail(Details.REDIRECT_URI).assertEvent();
    // Login with optional scopes. Assert that everything is there
    oauth.scope("openid address phone microprofile-jwt");
    oauth.doLogin("john", "password");
    loginEvent = events.expectLogin().user(userId).assertEvent();
    tokens = sendTokenRequest(loginEvent, userId, "openid email profile address phone microprofile-jwt", "test-app");
    idToken = tokens.idToken;
    assertProfile(idToken, true);
    assertEmail(idToken, true);
    assertAddress(idToken, true);
    assertPhone(idToken, true);
    assertMicroprofile(idToken, true);
    assertMicroprofile(tokens.accessToken, true);
}

Example 59 with IDToken

use of org.keycloak.representations.IDToken in project keycloak by keycloak.

the class OIDCScopeTest method testRefreshTokenWithConsentRequired.

@Test
// TODO remove this (KEYCLOAK-16228)
@DisableFeature(value = Profile.Feature.ACCOUNT2, skipRestart = true)
public void testRefreshTokenWithConsentRequired() {
    // Login with consentRequired
    oauth.clientId("third-party");
    oauth.doLoginGrant("john", "password");
    grantPage.assertCurrent();
    grantPage.assertGrants(OAuthGrantPage.PROFILE_CONSENT_TEXT, OAuthGrantPage.EMAIL_CONSENT_TEXT, OAuthGrantPage.ROLES_CONSENT_TEXT);
    grantPage.accept();
    EventRepresentation loginEvent = events.expectLogin().user(userId).client("third-party").detail(Details.CONSENT, Details.CONSENT_VALUE_CONSENT_GRANTED).assertEvent();
    Tokens tokens = sendTokenRequest(loginEvent, userId, "openid email profile", "third-party");
    IDToken idToken = tokens.idToken;
    RefreshToken refreshToken1 = oauth.parseRefreshToken(tokens.refreshToken);
    assertProfile(idToken, true);
    assertEmail(idToken, true);
    assertAddress(idToken, false);
    assertPhone(idToken, false);
    // Ensure that I can refresh token
    OAuthClient.AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(tokens.refreshToken, "password");
    Assert.assertEquals(200, refreshResponse.getStatusCode());
    idToken = oauth.verifyIDToken(refreshResponse.getIdToken());
    assertProfile(idToken, true);
    assertEmail(idToken, true);
    assertAddress(idToken, false);
    assertPhone(idToken, false);
    events.expectRefresh(refreshToken1.getId(), idToken.getSessionState()).user(userId).client("third-party").assertEvent();
    // Go to applications in account mgmt and revoke consent
    accountAppsPage.open();
    events.clear();
    accountAppsPage.revokeGrant("third-party");
    events.expect(EventType.REVOKE_GRANT).client("account").user(userId).detail(Details.REVOKED_CLIENT, "third-party").assertEvent();
    // Ensure I can't refresh anymore
    refreshResponse = oauth.doRefreshTokenRequest(refreshResponse.getRefreshToken(), "password");
    assertEquals(400, refreshResponse.getStatusCode());
    events.expectRefresh(refreshToken1.getId(), idToken.getSessionState()).client("third-party").user(userId).removeDetail(Details.TOKEN_ID).removeDetail(Details.REFRESH_TOKEN_ID).removeDetail(Details.UPDATED_REFRESH_TOKEN_ID).error("invalid_token").assertEvent();
}

Example 60 with IDToken

use of org.keycloak.representations.IDToken in project keycloak by keycloak.

the class AbstractOIDCResponseTypeTest method nonceAndSessionStateMatches.

@Test
public void nonceAndSessionStateMatches() {
    EventRepresentation loginEvent = loginUser("abcdef123456");
    OAuthClient.AuthorizationEndpointResponse authzResponse = new OAuthClient.AuthorizationEndpointResponse(oauth, isFragment());
    Assert.assertNotNull(authzResponse.getSessionState());
    List<IDToken> idTokens = testAuthzResponseAndRetrieveIDTokens(authzResponse, loginEvent);
    for (IDToken idToken : idTokens) {
        Assert.assertEquals("abcdef123456", idToken.getNonce());
        Assert.assertEquals(authzResponse.getSessionState(), idToken.getSessionState());
    }
}