Examples with IDToken org.keycloak.representations.IDToken used on opensource projects

Example 81 with IDToken

use of org.keycloak.representations.IDToken in project keycloak by keycloak.

the class HoKTest method testAuthzResponseAndRetrieveIDTokens.

protected List<IDToken> testAuthzResponseAndRetrieveIDTokens(OAuthClient.AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent) {
    Assert.assertEquals(OIDCResponseType.CODE + " " + OIDCResponseType.ID_TOKEN, loginEvent.getDetails().get(Details.RESPONSE_TYPE));
    // IDToken from the authorization response
    Assert.assertNull(authzResponse.getAccessToken());
    String idTokenStr = authzResponse.getIdToken();
    IDToken idToken = oauth.verifyIDToken(idTokenStr);
    // Validate "c_hash"
    Assert.assertNull(idToken.getAccessTokenHash());
    Assert.assertNotNull(idToken.getCodeHash());
    Assert.assertEquals(idToken.getCodeHash(), HashUtils.oidcHash(Algorithm.RS256, authzResponse.getCode()));
    // IDToken exchanged for the code
    IDToken idToken2 = sendTokenRequestAndGetIDToken(loginEvent);
    return Arrays.asList(idToken, idToken2);
}

Example 82 with IDToken

use of org.keycloak.representations.IDToken in project keycloak by keycloak.

the class LogoutTest method testFrontChannelLogout.

@Test
public void testFrontChannelLogout() throws Exception {
    ClientsResource clients = adminClient.realm(oauth.getRealm()).clients();
    ClientRepresentation rep = clients.findByClientId(oauth.getClientId()).get(0);
    rep.setName("My Testing App");
    rep.setFrontchannelLogout(true);
    rep.getAttributes().put(OIDCConfigAttributes.FRONT_CHANNEL_LOGOUT_URI, oauth.APP_ROOT + "/admin/frontchannelLogout");
    clients.get(rep.getId()).update(rep);
    try {
        oauth.clientSessionState("client-session");
        oauth.doLogin("test-user@localhost", "password");
        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
        String idTokenString = tokenResponse.getIdToken();
        String logoutUrl = oauth.getLogoutUrl().idTokenHint(idTokenString).build();
        driver.navigate().to(logoutUrl);
        LogoutToken logoutToken = testingClient.testApp().getFrontChannelLogoutToken();
        Assert.assertNotNull(logoutToken);
        IDToken idToken = new JWSInput(idTokenString).readJsonContent(IDToken.class);
        Assert.assertEquals(logoutToken.getIssuer(), idToken.getIssuer());
        Assert.assertEquals(logoutToken.getSid(), idToken.getSessionId());
        assertTrue(driver.getTitle().equals("Logging out"));
        assertTrue(driver.getPageSource().contains("You are logging out from following apps"));
        assertTrue(driver.getPageSource().contains("My Testing App"));
    } finally {
        rep.setFrontchannelLogout(false);
        rep.getAttributes().put(OIDCConfigAttributes.FRONT_CHANNEL_LOGOUT_URI, "");
        clients.get(rep.getId()).update(rep);
    }
}

Example 83 with IDToken

use of org.keycloak.representations.IDToken in project keycloak by keycloak.

the class LogoutTest method testFrontChannelLogoutWithPostLogoutRedirectUri.

@Test
public void testFrontChannelLogoutWithPostLogoutRedirectUri() throws Exception {
    ClientsResource clients = adminClient.realm(oauth.getRealm()).clients();
    ClientRepresentation rep = clients.findByClientId(oauth.getClientId()).get(0);
    rep.setFrontchannelLogout(true);
    rep.getAttributes().put(OIDCConfigAttributes.FRONT_CHANNEL_LOGOUT_URI, oauth.APP_ROOT + "/admin/frontchannelLogout");
    clients.get(rep.getId()).update(rep);
    try {
        oauth.clientSessionState("client-session");
        oauth.doLogin("test-user@localhost", "password");
        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
        String idTokenString = tokenResponse.getIdToken();
        String logoutUrl = oauth.getLogoutUrl().idTokenHint(idTokenString).postLogoutRedirectUri(oauth.APP_AUTH_ROOT).build();
        driver.navigate().to(logoutUrl);
        LogoutToken logoutToken = testingClient.testApp().getFrontChannelLogoutToken();
        Assert.assertNotNull(logoutToken);
        IDToken idToken = new JWSInput(idTokenString).readJsonContent(IDToken.class);
        Assert.assertEquals(logoutToken.getIssuer(), idToken.getIssuer());
        Assert.assertEquals(logoutToken.getSid(), idToken.getSessionId());
    } finally {
        rep.setFrontchannelLogout(false);
        rep.getAttributes().put(OIDCConfigAttributes.FRONT_CHANNEL_LOGOUT_URI, "");
        clients.get(rep.getId()).update(rep);
    }
}

Example 84 with IDToken

use of org.keycloak.representations.IDToken in project keycloak by keycloak.

the class ParTest method testIgnoreParameterIfNotSetinRequestObject.

@Test
public void testIgnoreParameterIfNotSetinRequestObject() throws Exception {
    try {
        // setup PAR realm settings
        int requestUriLifespan = 45;
        setParRealmSettings(requestUriLifespan);
        // create client dynamically
        String clientId = createClientDynamically(generateSuffixedName(CLIENT_NAME), (OIDCClientRepresentation clientRep) -> {
            clientRep.setRequirePushedAuthorizationRequests(Boolean.TRUE);
            clientRep.setRedirectUris(new ArrayList<>(Arrays.asList(CLIENT_REDIRECT_URI)));
        });
        oauth.clientId(clientId);
        OIDCClientRepresentation oidcCRep = getClientDynamically(clientId);
        String clientSecret = oidcCRep.getClientSecret();
        assertEquals(Boolean.TRUE, oidcCRep.getRequirePushedAuthorizationRequests());
        assertTrue(oidcCRep.getRedirectUris().contains(CLIENT_REDIRECT_URI));
        assertEquals(OIDCLoginProtocol.CLIENT_SECRET_BASIC, oidcCRep.getTokenEndpointAuthMethod());
        TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject requestObject = new TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject();
        requestObject.id(KeycloakModelUtils.generateId());
        requestObject.iat(Long.valueOf(Time.currentTime()));
        requestObject.exp(requestObject.getIat() + Long.valueOf(300));
        requestObject.nbf(requestObject.getIat());
        requestObject.setClientId(oauth.getClientId());
        requestObject.setResponseType("code");
        requestObject.setRedirectUriParam(CLIENT_REDIRECT_URI);
        requestObject.setScope("openid");
        requestObject.setNonce(KeycloakModelUtils.generateId());
        byte[] contentBytes = JsonSerialization.writeValueAsBytes(requestObject);
        String encodedRequestObject = Base64Url.encode(contentBytes);
        TestOIDCEndpointsApplicationResource client = testingClient.testApp().oidcClientEndpoints();
        // use and set jwks_url
        ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm(oauth.getRealm()), oauth.getClientId());
        ClientRepresentation clientRep = clientResource.toRepresentation();
        OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setUseJwksUrl(true);
        OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setJwksUrl(TestApplicationResourceUrls.clientJwksUri());
        clientResource.update(clientRep);
        client.generateKeys(org.keycloak.crypto.Algorithm.RS256);
        client.registerOIDCRequest(encodedRequestObject, org.keycloak.crypto.Algorithm.RS256);
        // do not send any other parameter but the request request parameter
        oauth.request(client.getOIDCRequest());
        oauth.responseType("code id_token");
        oauth.redirectUri("http://invalid");
        oauth.scope(null);
        oauth.nonce("12345");
        ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
        assertEquals(201, pResp.getStatusCode());
        String requestUri = pResp.getRequestUri();
        assertEquals(requestUriLifespan, pResp.getExpiresIn());
        oauth.scope("invalid");
        oauth.redirectUri("http://invalid");
        oauth.responseType("invalid");
        oauth.redirectUri(null);
        oauth.nonce("12345");
        oauth.request(null);
        oauth.requestUri(requestUri);
        String wrongState = oauth.stateParamRandom().getState();
        oauth.stateParamHardcoded(wrongState);
        OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
        assertNull(loginResponse.getState());
        assertNotEquals(requestObject.getState(), wrongState);
        // Token Request
        // get tokens, it needed. https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
        oauth.redirectUri(CLIENT_REDIRECT_URI);
        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(loginResponse.getCode(), clientSecret);
        assertEquals(200, res.getStatusCode());
        oauth.verifyToken(res.getAccessToken());
        IDToken idToken = oauth.verifyIDToken(res.getIdToken());
        assertEquals(requestObject.getNonce(), idToken.getNonce());
    } finally {
        restoreParRealmSettings();
    }
}

Example 85 with IDToken

use of org.keycloak.representations.IDToken in project keycloak by keycloak.

the class ParTest method testRequestParameterPrecedenceOverOtherParameters.

@Test
public void testRequestParameterPrecedenceOverOtherParameters() throws Exception {
    try {
        // setup PAR realm settings
        int requestUriLifespan = 45;
        setParRealmSettings(requestUriLifespan);
        // create client dynamically
        String clientId = createClientDynamically(generateSuffixedName(CLIENT_NAME), (OIDCClientRepresentation clientRep) -> {
            clientRep.setRequirePushedAuthorizationRequests(Boolean.TRUE);
            clientRep.setRedirectUris(new ArrayList<>(Arrays.asList(CLIENT_REDIRECT_URI)));
        });
        oauth.clientId(clientId);
        OIDCClientRepresentation oidcCRep = getClientDynamically(clientId);
        String clientSecret = oidcCRep.getClientSecret();
        assertEquals(Boolean.TRUE, oidcCRep.getRequirePushedAuthorizationRequests());
        assertTrue(oidcCRep.getRedirectUris().contains(CLIENT_REDIRECT_URI));
        assertEquals(OIDCLoginProtocol.CLIENT_SECRET_BASIC, oidcCRep.getTokenEndpointAuthMethod());
        TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject requestObject = new TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject();
        requestObject.id(KeycloakModelUtils.generateId());
        requestObject.iat(Long.valueOf(Time.currentTime()));
        requestObject.exp(requestObject.getIat() + Long.valueOf(300));
        requestObject.nbf(requestObject.getIat());
        requestObject.setClientId(oauth.getClientId());
        requestObject.setResponseType("code");
        requestObject.setRedirectUriParam(CLIENT_REDIRECT_URI);
        requestObject.setScope("openid");
        requestObject.setNonce(KeycloakModelUtils.generateId());
        requestObject.setState(oauth.stateParamRandom().getState());
        byte[] contentBytes = JsonSerialization.writeValueAsBytes(requestObject);
        String encodedRequestObject = Base64Url.encode(contentBytes);
        TestOIDCEndpointsApplicationResource client = testingClient.testApp().oidcClientEndpoints();
        // use and set jwks_url
        ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm(oauth.getRealm()), oauth.getClientId());
        ClientRepresentation clientRep = clientResource.toRepresentation();
        OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setUseJwksUrl(true);
        OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setJwksUrl(TestApplicationResourceUrls.clientJwksUri());
        clientResource.update(clientRep);
        client.generateKeys(org.keycloak.crypto.Algorithm.RS256);
        client.registerOIDCRequest(encodedRequestObject, org.keycloak.crypto.Algorithm.RS256);
        // do not send any other parameter but the request request parameter
        oauth.request(client.getOIDCRequest());
        oauth.responseType("code id_token");
        oauth.redirectUri("http://invalid");
        oauth.scope(null);
        oauth.nonce("12345");
        ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
        assertEquals(201, pResp.getStatusCode());
        String requestUri = pResp.getRequestUri();
        assertEquals(requestUriLifespan, pResp.getExpiresIn());
        oauth.scope("invalid");
        oauth.redirectUri("http://invalid");
        oauth.responseType("invalid");
        oauth.redirectUri(null);
        oauth.nonce("12345");
        oauth.request(null);
        oauth.requestUri(requestUri);
        String wrongState = oauth.stateParamRandom().getState();
        oauth.stateParamHardcoded(wrongState);
        OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
        assertEquals(requestObject.getState(), loginResponse.getState());
        assertNotEquals(requestObject.getState(), wrongState);
        // Token Request
        // get tokens, it needed. https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
        oauth.redirectUri(CLIENT_REDIRECT_URI);
        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(loginResponse.getCode(), clientSecret);
        assertEquals(200, res.getStatusCode());
        oauth.verifyToken(res.getAccessToken());
        IDToken idToken = oauth.verifyIDToken(res.getIdToken());
        assertEquals(requestObject.getNonce(), idToken.getNonce());
    } finally {
        restoreParRealmSettings();
    }
}