Examples with AuthenticationExecutionInfoRepresentation org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation used on opensource projects

Example 26 with AuthenticationExecutionInfoRepresentation

use of org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation in project keycloak by keycloak.

the class UserStorageRestTest method testKerberosAuthenticatorEnabledAutomatically.

@Test
@AuthServerContainerExclude(AuthServer.REMOTE)
public void testKerberosAuthenticatorEnabledAutomatically() {
    // Assert kerberos authenticator DISABLED
    AuthenticationExecutionInfoRepresentation kerberosExecution = findKerberosExecution();
    Assert.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.DISABLED.toString());
    // create LDAP provider with kerberos
    ComponentRepresentation ldapRep = createBasicLDAPProviderRep();
    ldapRep.getConfig().putSingle(KerberosConstants.ALLOW_KERBEROS_AUTHENTICATION, "true");
    String id = createComponent(ldapRep);
    // Assert kerberos authenticator ALTERNATIVE
    kerberosExecution = findKerberosExecution();
    Assert.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.ALTERNATIVE.toString());
    // Switch kerberos authenticator to DISABLED
    kerberosExecution.setRequirement(AuthenticationExecutionModel.Requirement.DISABLED.toString());
    realm.flows().updateExecutions("browser", kerberosExecution);
    assertAdminEvents.assertEvent(realmId, OperationType.UPDATE, AdminEventPaths.authUpdateExecutionPath("browser"), kerberosExecution, ResourceType.AUTH_EXECUTION);
    // update LDAP provider with kerberos (without changing kerberos switch)
    ldapRep = realm.components().component(id).toRepresentation();
    realm.components().component(id).update(ldapRep);
    assertAdminEvents.clear();
    // Assert kerberos authenticator is still DISABLED
    kerberosExecution = findKerberosExecution();
    Assert.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.DISABLED.toString());
    // update LDAP provider with kerberos (with changing kerberos switch to disabled)
    ldapRep = realm.components().component(id).toRepresentation();
    ldapRep.getConfig().putSingle(KerberosConstants.ALLOW_KERBEROS_AUTHENTICATION, "false");
    realm.components().component(id).update(ldapRep);
    assertAdminEvents.clear();
    // Assert kerberos authenticator is still DISABLED
    kerberosExecution = findKerberosExecution();
    Assert.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.DISABLED.toString());
    // update LDAP provider with kerberos (with changing kerberos switch to enabled)
    ldapRep = realm.components().component(id).toRepresentation();
    ldapRep.getConfig().putSingle(KerberosConstants.ALLOW_KERBEROS_AUTHENTICATION, "true");
    realm.components().component(id).update(ldapRep);
    assertAdminEvents.clear();
    // Assert kerberos authenticator is still ALTERNATIVE
    kerberosExecution = findKerberosExecution();
    Assert.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.ALTERNATIVE.toString());
    // Cleanup
    kerberosExecution.setRequirement(AuthenticationExecutionModel.Requirement.DISABLED.toString());
    realm.flows().updateExecutions("browser", kerberosExecution);
    assertAdminEvents.assertEvent(realmId, OperationType.UPDATE, AdminEventPaths.authUpdateExecutionPath("browser"), kerberosExecution, ResourceType.AUTH_EXECUTION);
    removeComponent(id);
}

Example 27 with AuthenticationExecutionInfoRepresentation

use of org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation in project keycloak by keycloak.

the class AbstractCustomAccountManagementTest method updateRequirement.

protected void updateRequirement(String flowAlias, String provider, AuthenticationExecutionModel.Requirement requirement) {
    AuthenticationExecutionInfoRepresentation exec = getExecution(flowAlias, provider);
    exec.setRequirement(requirement.name());
    authMgmtResource.updateExecutions(flowAlias, exec);
}

Example 28 with AuthenticationExecutionInfoRepresentation

use of org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation in project keycloak by keycloak.

the class AbstractCustomAccountManagementTest method updateRequirement.

protected void updateRequirement(String flowAlias, AuthenticationExecutionModel.Requirement requirement, Function<AuthenticationExecutionInfoRepresentation, Boolean> filterFunc) {
    List<AuthenticationExecutionInfoRepresentation> executionReps = authMgmtResource.getExecutions(flowAlias);
    AuthenticationExecutionInfoRepresentation exec = executionReps.stream().filter(filterFunc::apply).findFirst().orElse(null);
    if (exec != null) {
        exec.setRequirement(requirement.name());
        authMgmtResource.updateExecutions(flowAlias, exec);
    }
}

Example 29 with AuthenticationExecutionInfoRepresentation

use of org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation in project keycloak by keycloak.

the class BrokerTest method testLogoutPropagatesToSamlIdentityProvider.

@Test
public void testLogoutPropagatesToSamlIdentityProvider() throws IOException {
    final RealmResource realm = adminClient.realm(REALM_NAME);
    final ClientsResource clients = realm.clients();
    AuthenticationExecutionInfoRepresentation reviewProfileAuthenticator = null;
    String firstBrokerLoginFlowAlias = null;
    try (IdentityProviderCreator idp = new IdentityProviderCreator(realm, addIdentityProvider("https://saml.idp/saml"))) {
        IdentityProviderRepresentation idpRepresentation = idp.identityProvider().toRepresentation();
        firstBrokerLoginFlowAlias = idpRepresentation.getFirstBrokerLoginFlowAlias();
        List<AuthenticationExecutionInfoRepresentation> executions = realm.flows().getExecutions(firstBrokerLoginFlowAlias);
        reviewProfileAuthenticator = executions.stream().filter(ex -> Objects.equals(ex.getProviderId(), IdpReviewProfileAuthenticatorFactory.PROVIDER_ID)).findFirst().orElseGet(() -> {
            Assert.fail("Could not find update profile in first broker login flow");
            return null;
        });
        reviewProfileAuthenticator.setRequirement(Requirement.DISABLED.name());
        realm.flows().updateExecutions(firstBrokerLoginFlowAlias, reviewProfileAuthenticator);
        SAMLDocumentHolder samlResponse = new SamlClientBuilder().authnRequest(getAuthServerSamlEndpoint(REALM_NAME), SAML_CLIENT_ID_SALES_POST, SAML_ASSERTION_CONSUMER_URL_SALES_POST, POST).transformObject(ar -> {
            NameIDPolicyType nameIDPolicy = new NameIDPolicyType();
            nameIDPolicy.setAllowCreate(Boolean.TRUE);
            nameIDPolicy.setFormat(JBossSAMLURIConstants.NAMEID_FORMAT_EMAIL.getUri());
            ar.setNameIDPolicy(nameIDPolicy);
            return ar;
        }).build().login().idp(SAML_BROKER_ALIAS).build().processSamlResponse(REDIRECT).transformObject(this::createAuthnResponse).targetAttributeSamlResponse().targetUri(getSamlBrokerUrl(REALM_NAME)).build().followOneRedirect().followOneRedirect().getSamlResponse(POST);
        assertThat(samlResponse.getSamlObject(), isSamlStatusResponse(JBossSAMLURIConstants.STATUS_RESPONDER, JBossSAMLURIConstants.STATUS_INVALID_NAMEIDPOLICY));
    } finally {
        reviewProfileAuthenticator.setRequirement(Requirement.REQUIRED.name());
        realm.flows().updateExecutions(firstBrokerLoginFlowAlias, reviewProfileAuthenticator);
    }
}

Example 30 with AuthenticationExecutionInfoRepresentation

use of org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation in project keycloak by keycloak.

the class AuthenticationManagementResource method recurseExecutions.

public void recurseExecutions(AuthenticationFlowModel flow, List<AuthenticationExecutionInfoRepresentation> result, int level) {
    AtomicInteger index = new AtomicInteger(0);
    realm.getAuthenticationExecutionsStream(flow.getId()).forEachOrdered(execution -> {
        AuthenticationExecutionInfoRepresentation rep = new AuthenticationExecutionInfoRepresentation();
        rep.setLevel(level);
        rep.setIndex(index.getAndIncrement());
        rep.setRequirementChoices(new LinkedList<>());
        if (execution.isAuthenticatorFlow()) {
            AuthenticationFlowModel flowRef = realm.getAuthenticationFlowById(execution.getFlowId());
            if (AuthenticationFlow.BASIC_FLOW.equals(flowRef.getProviderId())) {
                rep.getRequirementChoices().add(AuthenticationExecutionModel.Requirement.REQUIRED.name());
                rep.getRequirementChoices().add(AuthenticationExecutionModel.Requirement.ALTERNATIVE.name());
                rep.getRequirementChoices().add(AuthenticationExecutionModel.Requirement.DISABLED.name());
                rep.getRequirementChoices().add(AuthenticationExecutionModel.Requirement.CONDITIONAL.name());
            } else if (AuthenticationFlow.FORM_FLOW.equals(flowRef.getProviderId())) {
                rep.getRequirementChoices().add(AuthenticationExecutionModel.Requirement.REQUIRED.name());
                rep.getRequirementChoices().add(AuthenticationExecutionModel.Requirement.DISABLED.name());
                rep.setProviderId(execution.getAuthenticator());
                rep.setAuthenticationConfig(execution.getAuthenticatorConfig());
            } else if (AuthenticationFlow.CLIENT_FLOW.equals(flowRef.getProviderId())) {
                rep.getRequirementChoices().add(AuthenticationExecutionModel.Requirement.ALTERNATIVE.name());
                rep.getRequirementChoices().add(AuthenticationExecutionModel.Requirement.REQUIRED.name());
                rep.getRequirementChoices().add(AuthenticationExecutionModel.Requirement.DISABLED.name());
            }
            rep.setDisplayName(flowRef.getAlias());
            rep.setDescription(flowRef.getDescription());
            rep.setConfigurable(false);
            rep.setId(execution.getId());
            rep.setAuthenticationFlow(execution.isAuthenticatorFlow());
            rep.setRequirement(execution.getRequirement().name());
            rep.setFlowId(execution.getFlowId());
            result.add(rep);
            AuthenticationFlowModel subFlow = realm.getAuthenticationFlowById(execution.getFlowId());
            recurseExecutions(subFlow, result, level + 1);
        } else {
            String providerId = execution.getAuthenticator();
            ConfigurableAuthenticatorFactory factory = CredentialHelper.getConfigurableAuthenticatorFactory(session, providerId);
            if (factory == null) {
                logger.warnf("Cannot find authentication provider implementation with provider ID '%s'", providerId);
                throw new NotFoundException("Could not find authenticator provider");
            }
            rep.setDisplayName(factory.getDisplayType());
            rep.setConfigurable(factory.isConfigurable());
            for (AuthenticationExecutionModel.Requirement choice : factory.getRequirementChoices()) {
                rep.getRequirementChoices().add(choice.name());
            }
            rep.setId(execution.getId());
            if (factory.isConfigurable()) {
                String authenticatorConfigId = execution.getAuthenticatorConfig();
                if (authenticatorConfigId != null) {
                    AuthenticatorConfigModel authenticatorConfig = realm.getAuthenticatorConfigById(authenticatorConfigId);
                    if (authenticatorConfig != null) {
                        rep.setAlias(authenticatorConfig.getAlias());
                    }
                }
            }
            rep.setRequirement(execution.getRequirement().name());
            rep.setProviderId(execution.getAuthenticator());
            rep.setAuthenticationConfig(execution.getAuthenticatorConfig());
            result.add(rep);
        }
    });
}