Examples with FederatedIdentityRepresentation org.keycloak.representations.idm.FederatedIdentityRepresentation used on opensource projects

Example 6 with FederatedIdentityRepresentation

use of org.keycloak.representations.idm.FederatedIdentityRepresentation in project keycloak by keycloak.

the class ClientInitiatedAccountLinkTest method testLinkOnlyProvider.

@Test
public void testLinkOnlyProvider() throws Exception {
    RealmResource realm = adminClient.realms().realm(CHILD_IDP);
    IdentityProviderRepresentation rep = realm.identityProviders().get(PARENT_IDP).toRepresentation();
    rep.setLinkOnly(true);
    realm.identityProviders().get(PARENT_IDP).update(rep);
    try {
        List<FederatedIdentityRepresentation> links = realm.users().get(childUserId).getFederatedIdentity();
        Assert.assertTrue(links.isEmpty());
        UriBuilder linkBuilder = UriBuilder.fromUri(appPage.getInjectedUrl().toString()).path("link");
        String linkUrl = linkBuilder.clone().queryParam("realm", CHILD_IDP).queryParam("provider", PARENT_IDP).build().toString();
        navigateTo(linkUrl);
        Assert.assertTrue(loginPage.isCurrent(CHILD_IDP));
        // should not be on login page.  This is what we are testing
        Assert.assertFalse(driver.getPageSource().contains(PARENT_IDP));
        // now test that we can still link.
        loginPage.login("child", "password");
        Assert.assertTrue(loginPage.isCurrent(PARENT_IDP));
        loginPage.login(PARENT_USERNAME, "password");
        System.out.println("After linking: " + driver.getCurrentUrl());
        System.out.println(driver.getPageSource());
        Assert.assertTrue(driver.getCurrentUrl().startsWith(linkBuilder.toTemplate()));
        Assert.assertTrue(driver.getPageSource().contains("Account Linked"));
        links = realm.users().get(childUserId).getFederatedIdentity();
        Assert.assertFalse(links.isEmpty());
        realm.users().get(childUserId).removeFederatedIdentity(PARENT_IDP);
        links = realm.users().get(childUserId).getFederatedIdentity();
        Assert.assertTrue(links.isEmpty());
        logoutAll();
        System.out.println("testing link-only attack");
        navigateTo(linkUrl);
        Assert.assertTrue(loginPage.isCurrent(CHILD_IDP));
        System.out.println("login page uri is: " + driver.getCurrentUrl());
        // ok, now scrape the code from page
        String pageSource = driver.getPageSource();
        String action = ActionURIUtils.getActionURIFromPageSource(pageSource);
        System.out.println("action uri: " + action);
        Map<String, String> queryParams = ActionURIUtils.parseQueryParamsFromActionURI(action);
        System.out.println("query params: " + queryParams);
        // now try and use the code to login to remote link-only idp
        String uri = "/auth/realms/child/broker/parent-idp/login";
        uri = UriBuilder.fromUri(getAuthServerContextRoot()).path(uri).queryParam(LoginActionsService.SESSION_CODE, queryParams.get(LoginActionsService.SESSION_CODE)).queryParam(Constants.CLIENT_ID, queryParams.get(Constants.CLIENT_ID)).queryParam(Constants.TAB_ID, queryParams.get(Constants.TAB_ID)).build().toString();
        System.out.println("hack uri: " + uri);
        navigateTo(uri);
        Assert.assertTrue(driver.getPageSource().contains("Could not send authentication request to identity provider."));
    } finally {
        rep.setLinkOnly(false);
        realm.identityProviders().get(PARENT_IDP).update(rep);
    }
}

Example 7 with FederatedIdentityRepresentation

use of org.keycloak.representations.idm.FederatedIdentityRepresentation in project keycloak by keycloak.

the class ExportUtils method exportSocialLink.

public static FederatedIdentityRepresentation exportSocialLink(FederatedIdentityModel socialLink) {
    FederatedIdentityRepresentation socialLinkRep = new FederatedIdentityRepresentation();
    socialLinkRep.setIdentityProvider(socialLink.getIdentityProvider());
    socialLinkRep.setUserId(socialLink.getUserId());
    socialLinkRep.setUserName(socialLink.getUserName());
    return socialLinkRep;
}

Example 8 with FederatedIdentityRepresentation

use of org.keycloak.representations.idm.FederatedIdentityRepresentation in project keycloak by keycloak.

the class UserTest method createFederatedIdentities.

@Test
public void createFederatedIdentities() {
    String identityProviderAlias = "social-provider-id";
    String username = "federated-identities";
    String federatedUserId = "federated-user-id";
    addSampleIdentityProvider();
    UserRepresentation build = UserBuilder.create().username(username).federatedLink(identityProviderAlias, federatedUserId).build();
    // when
    String userId = createUser(build, false);
    List<FederatedIdentityRepresentation> obtainedFederatedIdentities = realm.users().get(userId).getFederatedIdentity();
    // then
    assertEquals(1, obtainedFederatedIdentities.size());
    assertEquals(federatedUserId, obtainedFederatedIdentities.get(0).getUserId());
    assertEquals(username, obtainedFederatedIdentities.get(0).getUserName());
    assertEquals(identityProviderAlias, obtainedFederatedIdentities.get(0).getIdentityProvider());
}

Example 9 with FederatedIdentityRepresentation

use of org.keycloak.representations.idm.FederatedIdentityRepresentation in project keycloak by keycloak.

the class UserTest method getFederatedIdentities.

@Test
public void getFederatedIdentities() {
    // Add sample identity provider
    addSampleIdentityProvider();
    // Add sample user
    String id = createUser();
    UserResource user = realm.users().get(id);
    assertEquals(0, user.getFederatedIdentity().size());
    // Add social link to the user
    FederatedIdentityRepresentation link = new FederatedIdentityRepresentation();
    link.setUserId("social-user-id");
    link.setUserName("social-username");
    addFederatedIdentity(id, "social-provider-id", link);
    // Verify social link is here
    user = realm.users().get(id);
    List<FederatedIdentityRepresentation> federatedIdentities = user.getFederatedIdentity();
    assertEquals(1, federatedIdentities.size());
    link = federatedIdentities.get(0);
    assertEquals("social-provider-id", link.getIdentityProvider());
    assertEquals("social-user-id", link.getUserId());
    assertEquals("social-username", link.getUserName());
    // Remove social link now
    user.removeFederatedIdentity("social-provider-id");
    assertAdminEvents.assertEvent(realmId, OperationType.DELETE, AdminEventPaths.userFederatedIdentityLink(id, "social-provider-id"), ResourceType.USER);
    assertEquals(0, user.getFederatedIdentity().size());
    removeSampleIdentityProvider();
}

Example 10 with FederatedIdentityRepresentation

use of org.keycloak.representations.idm.FederatedIdentityRepresentation in project keycloak by keycloak.

the class KcSamlIdPInitiatedSsoTest method testProviderTransientIdpInitiatedLogin.

@Test
public void testProviderTransientIdpInitiatedLogin() throws Exception {
    IdentityProviderResource idp = adminClient.realm(REALM_CONS_NAME).identityProviders().get("saml-leaf");
    IdentityProviderRepresentation rep = idp.toRepresentation();
    rep.getConfig().put(SAMLIdentityProviderConfig.NAME_ID_POLICY_FORMAT, JBossSAMLURIConstants.NAMEID_FORMAT_TRANSIENT.get());
    rep.getConfig().put(SAMLIdentityProviderConfig.PRINCIPAL_TYPE, SamlPrincipalType.ATTRIBUTE.name());
    rep.getConfig().put(SAMLIdentityProviderConfig.PRINCIPAL_ATTRIBUTE, X500SAMLProfileConstants.UID.get());
    idp.update(rep);
    SAMLDocumentHolder samlResponse = new SamlClientBuilder().navigateTo(getSamlIdpInitiatedUrl(REALM_PROV_NAME, "samlbroker")).login().user(PROVIDER_REALM_USER_NAME, PROVIDER_REALM_USER_PASSWORD).build().processSamlResponse(Binding.POST).transformObject(ob -> {
        assertThat(ob, Matchers.isSamlResponse(JBossSAMLURIConstants.STATUS_SUCCESS));
        ResponseType resp = (ResponseType) ob;
        assertThat(resp.getDestination(), is(getSamlBrokerIdpInitiatedUrl(REALM_CONS_NAME, "sales")));
        assertAudience(resp, getSamlBrokerIdpInitiatedUrl(REALM_CONS_NAME, "sales"));
        NameIDType nameId = new NameIDType();
        nameId.setFormat(URI.create(JBossSAMLURIConstants.NAMEID_FORMAT_TRANSIENT.get()));
        nameId.setValue("subjectId1");
        resp.getAssertions().get(0).getAssertion().getSubject().getSubType().addBaseID(nameId);
        Set<StatementAbstractType> statements = resp.getAssertions().get(0).getAssertion().getStatements();
        AttributeStatementType attributeType = (AttributeStatementType) statements.stream().filter(statement -> statement instanceof AttributeStatementType).findFirst().orElse(new AttributeStatementType());
        AttributeType attr = new AttributeType(X500SAMLProfileConstants.UID.get());
        attr.addAttributeValue(PROVIDER_REALM_USER_NAME);
        attributeType.addAttribute(new AttributeStatementType.ASTChoiceType(attr));
        resp.getAssertions().get(0).getAssertion().addStatement(attributeType);
        return ob;
    }).build().navigateTo(getSamlIdpInitiatedUrl(REALM_PROV_NAME, "samlbroker-2")).login().sso(true).build().processSamlResponse(Binding.POST).transformObject(ob -> {
        assertThat(ob, Matchers.isSamlResponse(JBossSAMLURIConstants.STATUS_SUCCESS));
        ResponseType resp = (ResponseType) ob;
        assertThat(resp.getDestination(), is(getSamlBrokerIdpInitiatedUrl(REALM_CONS_NAME, "sales2")));
        assertAudience(resp, getSamlBrokerIdpInitiatedUrl(REALM_CONS_NAME, "sales2"));
        NameIDType nameId = new NameIDType();
        nameId.setFormat(URI.create(JBossSAMLURIConstants.NAMEID_FORMAT_TRANSIENT.get()));
        nameId.setValue("subjectId2");
        resp.getAssertions().get(0).getAssertion().getSubject().getSubType().addBaseID(nameId);
        Set<StatementAbstractType> statements = resp.getAssertions().get(0).getAssertion().getStatements();
        AttributeStatementType attributeType = (AttributeStatementType) statements.stream().filter(statement -> statement instanceof AttributeStatementType).findFirst().orElse(new AttributeStatementType());
        AttributeType attr = new AttributeType(X500SAMLProfileConstants.UID.get());
        attr.addAttributeValue(PROVIDER_REALM_USER_NAME);
        attributeType.addAttribute(new AttributeStatementType.ASTChoiceType(attr));
        resp.getAssertions().get(0).getAssertion().addStatement(attributeType);
        return ob;
    }).build().updateProfile().username(CONSUMER_CHOSEN_USERNAME).email("test@localhost").firstName("Firstname").lastName("Lastname").build().followOneRedirect().getSamlResponse(Binding.POST);
    assertThat(samlResponse.getSamlObject(), Matchers.isSamlResponse(JBossSAMLURIConstants.STATUS_SUCCESS));
    ResponseType resp = (ResponseType) samlResponse.getSamlObject();
    assertThat(resp.getDestination(), is(urlRealmConsumer + "/app/auth2/saml"));
    assertAudience(resp, urlRealmConsumer + "/app/auth2");
    UsersResource users = adminClient.realm(REALM_CONS_NAME).users();
    List<UserRepresentation> userList = users.search(CONSUMER_CHOSEN_USERNAME);
    assertEquals(1, userList.size());
    String id = userList.get(0).getId();
    FederatedIdentityRepresentation fed = users.get(id).getFederatedIdentity().get(0);
    assertThat(fed.getUserId(), is(PROVIDER_REALM_USER_NAME));
    assertThat(fed.getUserName(), is(PROVIDER_REALM_USER_NAME));
    // check that no user with sent subject-id was sent
    userList = users.search("subjectId1");
    assertTrue(userList.isEmpty());
    userList = users.search("subjectId2");
    assertTrue(userList.isEmpty());
}