Examples with ClientScopeRepresentation org.keycloak.representations.idm.ClientScopeRepresentation used on opensource projects

Example 66 with ClientScopeRepresentation

use of org.keycloak.representations.idm.ClientScopeRepresentation in project keycloak by keycloak.

the class AccountRestServiceTest method listApplicationsThirdParty.

@Test
public void listApplicationsThirdParty() throws Exception {
    String appId = "third-party";
    TokenUtil token = new TokenUtil("view-applications-access", "password");
    ClientScopeRepresentation clientScopeRepresentation = testRealm().clientScopes().findAll().get(0);
    ConsentScopeRepresentation consentScopeRepresentation = new ConsentScopeRepresentation();
    consentScopeRepresentation.setId(clientScopeRepresentation.getId());
    ConsentRepresentation requestedConsent = new ConsentRepresentation();
    requestedConsent.setGrantedScopes(Collections.singletonList(consentScopeRepresentation));
    SimpleHttp.doPost(getAccountUrl("applications/" + appId + "/consent"), httpClient).header("Accept", "application/json").json(requestedConsent).auth(token.getToken()).asJson(ConsentRepresentation.class);
    List<ClientRepresentation> applications = SimpleHttp.doGet(getAccountUrl("applications"), httpClient).header("Accept", "application/json").auth(token.getToken()).asJson(new TypeReference<List<ClientRepresentation>>() {
    });
    assertFalse(applications.isEmpty());
    SimpleHttp.doDelete(getAccountUrl("applications/" + appId + "/consent"), httpClient).header("Accept", "application/json").auth(token.getToken()).asResponse();
    Map<String, ClientRepresentation> apps = applications.stream().collect(Collectors.toMap(x -> x.getClientId(), x -> x));
    Assert.assertThat(apps.keySet(), containsInAnyOrder(appId, "always-display-client", "direct-grant"));
    ClientRepresentation app = apps.get(appId);
    assertClientRep(app, null, "A third party application", true, false, false, null, "http://localhost:8180/auth/realms/master/app/auth");
    assertFalse(app.getConsent().getGrantedScopes().isEmpty());
    ConsentScopeRepresentation grantedScope = app.getConsent().getGrantedScopes().get(0);
    assertEquals(clientScopeRepresentation.getId(), grantedScope.getId());
    assertEquals(clientScopeRepresentation.getName(), grantedScope.getName());
}

Example 67 with ClientScopeRepresentation

use of org.keycloak.representations.idm.ClientScopeRepresentation in project keycloak by keycloak.

the class AccountRestServiceTest method createConsentForClient.

@Test
public void createConsentForClient() throws IOException {
    TokenUtil token = new TokenUtil("manage-consent-access", "password");
    String appId = "security-admin-console";
    ClientScopeRepresentation clientScopeRepresentation = testRealm().clientScopes().findAll().get(0);
    ConsentScopeRepresentation consentScopeRepresentation = new ConsentScopeRepresentation();
    consentScopeRepresentation.setId(clientScopeRepresentation.getId());
    ConsentRepresentation requestedConsent = new ConsentRepresentation();
    requestedConsent.setGrantedScopes(Collections.singletonList(consentScopeRepresentation));
    ConsentRepresentation consentRepresentation = SimpleHttp.doPost(getAccountUrl("applications/" + appId + "/consent"), httpClient).header("Accept", "application/json").json(requestedConsent).auth(token.getToken()).asJson(ConsentRepresentation.class);
    assertTrue(consentRepresentation.getCreatedDate() > 0);
    assertTrue(consentRepresentation.getLastUpdatedDate() > 0);
    assertEquals(1, consentRepresentation.getGrantedScopes().size());
    assertEquals(consentScopeRepresentation.getId(), consentRepresentation.getGrantedScopes().get(0).getId());
}

Example 68 with ClientScopeRepresentation

use of org.keycloak.representations.idm.ClientScopeRepresentation in project keycloak by keycloak.

the class ClientRegistrationPoliciesTest method testProviders.

@Test
public void testProviders() throws Exception {
    List<ComponentTypeRepresentation> reps = realmResource().clientRegistrationPolicy().getProviders();
    Map<String, ComponentTypeRepresentation> providersMap = reps.stream().collect(Collectors.toMap((ComponentTypeRepresentation rep) -> {
        return rep.getId();
    }, (ComponentTypeRepresentation rep) -> {
        return rep;
    }));
    // test that ProtocolMappersClientRegistrationPolicy provider contains available protocol mappers
    ComponentTypeRepresentation protMappersRep = providersMap.get(ProtocolMappersClientRegistrationPolicyFactory.PROVIDER_ID);
    List<String> availableMappers = getProviderConfigProperty(protMappersRep, ProtocolMappersClientRegistrationPolicyFactory.ALLOWED_PROTOCOL_MAPPER_TYPES);
    List<String> someExpectedMappers = Arrays.asList(UserAttributeStatementMapper.PROVIDER_ID, UserAttributeMapper.PROVIDER_ID, UserPropertyAttributeStatementMapper.PROVIDER_ID, UserPropertyMapper.PROVIDER_ID, HardcodedRole.PROVIDER_ID);
    availableMappers.containsAll(someExpectedMappers);
    // test that clientScope provider contains just the default client scopes
    ComponentTypeRepresentation clientScopeRep = providersMap.get(ClientScopesClientRegistrationPolicyFactory.PROVIDER_ID);
    List<String> clientScopes = getProviderConfigProperty(clientScopeRep, ClientScopesClientRegistrationPolicyFactory.ALLOWED_CLIENT_SCOPES);
    Assert.assertFalse(clientScopes.isEmpty());
    Assert.assertTrue(clientScopes.contains(OAuth2Constants.SCOPE_PROFILE));
    Assert.assertFalse(clientScopes.contains("foo"));
    Assert.assertFalse(clientScopes.contains("bar"));
    // Add some clientScopes
    ClientScopeRepresentation clientScope = new ClientScopeRepresentation();
    clientScope.setName("foo");
    clientScope.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
    Response response = realmResource().clientScopes().create(clientScope);
    String fooScopeId = ApiUtil.getCreatedId(response);
    response.close();
    clientScope = new ClientScopeRepresentation();
    clientScope.setName("bar");
    clientScope.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
    response = realmResource().clientScopes().create(clientScope);
    String barScopeId = ApiUtil.getCreatedId(response);
    response.close();
    // send request again and test that clientScope provider contains added client scopes
    reps = realmResource().clientRegistrationPolicy().getProviders();
    clientScopeRep = reps.stream().filter((ComponentTypeRepresentation rep1) -> {
        return rep1.getId().equals(ClientScopesClientRegistrationPolicyFactory.PROVIDER_ID);
    }).findFirst().get();
    clientScopes = getProviderConfigProperty(clientScopeRep, ClientScopesClientRegistrationPolicyFactory.ALLOWED_CLIENT_SCOPES);
    Assert.assertTrue(clientScopes.contains("foo"));
    Assert.assertTrue(clientScopes.contains("bar"));
    // Revert client scopes
    realmResource().clientScopes().get(fooScopeId).remove();
    realmResource().clientScopes().get(barScopeId).remove();
}

Example 69 with ClientScopeRepresentation

use of org.keycloak.representations.idm.ClientScopeRepresentation in project keycloak by keycloak.

the class ClientRegistrationPoliciesTest method testClientScopesPolicy.

@Test
// We would need to do domain name -> ip address to set trusted host
@AuthServerContainerExclude(AuthServer.REMOTE)
public void testClientScopesPolicy() throws Exception {
    setTrustedHost("localhost");
    // Add some clientScope through Admin REST
    ClientScopeRepresentation clientScope = new ClientScopeRepresentation();
    clientScope.setName("foo");
    clientScope.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
    Response response = realmResource().clientScopes().create(clientScope);
    String clientScopeId = ApiUtil.getCreatedId(response);
    response.close();
    // I can't register new client with this scope
    ClientRepresentation clientRep = createRep("test-app");
    clientRep.setDefaultClientScopes(Collections.singletonList("foo"));
    assertFail(ClientRegOp.CREATE, clientRep, 403, "Not permitted to use specified clientScope");
    // Register client without scope - should success
    clientRep.setDefaultClientScopes(null);
    ClientRepresentation registeredClient = reg.create(clientRep);
    reg.auth(Auth.token(registeredClient));
    // Try to update client with scope - should fail
    registeredClient.setDefaultClientScopes(Collections.singletonList("foo"));
    assertFail(ClientRegOp.UPDATE, registeredClient, 403, "Not permitted to use specified clientScope");
    // Update client with the clientScope via Admin REST
    ClientResource client = ApiUtil.findClientByClientId(realmResource(), "test-app");
    client.addDefaultClientScope(clientScopeId);
    // Now the update via clientRegistration is permitted too as scope was already set
    reg.update(registeredClient);
    // Revert client scope
    realmResource().clients().get(client.toRepresentation().getId()).remove();
    realmResource().clientScopes().get(clientScopeId).remove();
}

Example 70 with ClientScopeRepresentation

use of org.keycloak.representations.idm.ClientScopeRepresentation in project keycloak by keycloak.

the class OIDCProtocolMappersTest method testRolesAndAllowedOriginsRemovedFromAccessToken.

@Test
public void testRolesAndAllowedOriginsRemovedFromAccessToken() throws Exception {
    RealmResource realm = adminClient.realm("test");
    ClientScopeRepresentation allowedOriginsScope = ApiUtil.findClientScopeByName(realm, OIDCLoginProtocolFactory.WEB_ORIGINS_SCOPE).toRepresentation();
    ClientScopeRepresentation rolesScope = ApiUtil.findClientScopeByName(realm, OIDCLoginProtocolFactory.ROLES_SCOPE).toRepresentation();
    // Remove 'roles' and 'web-origins' scope from the client
    ClientResource testApp = ApiUtil.findClientByClientId(realm, "test-app");
    testApp.removeDefaultClientScope(allowedOriginsScope.getId());
    testApp.removeDefaultClientScope(rolesScope.getId());
    try {
        OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
        AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
        // Assert web origins are not in the token
        Assert.assertNull(accessToken.getAllowedOrigins());
        // Assert roles are not in the token
        Assert.assertNull(accessToken.getRealmAccess());
        Assert.assertTrue(accessToken.getResourceAccess().isEmpty());
        // Assert client not in the token audience. Just in "issuedFor"
        Assert.assertEquals("test-app", accessToken.getIssuedFor());
        Assert.assertFalse(accessToken.hasAudience("test-app"));
        // Assert IDToken still has "test-app" as an audience
        IDToken idToken = oauth.verifyIDToken(response.getIdToken());
        Assert.assertEquals("test-app", idToken.getIssuedFor());
        Assert.assertTrue(idToken.hasAudience("test-app"));
    } finally {
        // Revert
        testApp.addDefaultClientScope(allowedOriginsScope.getId());
        testApp.addDefaultClientScope(rolesScope.getId());
    }
}