use of org.keycloak.representations.idm.ProtocolMapperRepresentation in project keycloak by keycloak.
the class UndeployedScriptMapperNotAvailableTest method testMapperNotRecognizedWhenDisabled.
@Test
@EnableFeature(value = SCRIPTS, skipRestart = true, executeAsLast = false)
public void testMapperNotRecognizedWhenDisabled() throws Exception {
ClientResource app = findClientResourceByClientId(adminClient.realm("test"), "test-app");
{
ProtocolMapperRepresentation mapper = createScriptMapper("test-script-mapper1", "computed-via-script", "computed-via-script", "String", true, true, "'hello_' + user.username", false);
mapper.setProtocolMapper("script-mapper-a.js");
app.getProtocolMappers().createMapper(mapper).close();
}
deployer.undeploy(SCRIPT_DEPLOYMENT_NAME);
reconnectAdminClient();
ClientResource cl = findClientResourceByClientId(adminClient.realm("test"), "test-app");
assertTrue(cl.getProtocolMappers().getMappers().isEmpty());
assertTrue(cl.getProtocolMappers().getMappersPerProtocol(cl.toRepresentation().getProtocol()).isEmpty());
}
use of org.keycloak.representations.idm.ProtocolMapperRepresentation in project keycloak by keycloak.
the class PermissionsTest method clients.
@Test
public void clients() {
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().findAll();
}
}, Resource.CLIENT, false, true);
List<ClientRepresentation> l = clients.get(AdminRoles.QUERY_CLIENTS).realm(REALM_NAME).clients().findAll();
Assert.assertThat(l, Matchers.empty());
l = clients.get(AdminRoles.VIEW_CLIENTS).realm(REALM_NAME).clients().findAll();
Assert.assertThat(l, Matchers.not(Matchers.empty()));
ClientRepresentation client = l.get(0);
invoke(new InvocationWithResponse() {
@Override
public void invoke(RealmResource realm, AtomicReference<Response> response) {
response.set(clients.get(AdminRoles.QUERY_USERS).realm(REALM_NAME).clients().create(client));
}
}, clients.get(AdminRoles.QUERY_USERS), false);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
clients.get(AdminRoles.QUERY_USERS).realm(REALM_NAME).clients().get(client.getId()).toRepresentation();
}
}, clients.get(AdminRoles.QUERY_USERS), false);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
clients.get(AdminRoles.QUERY_USERS).realm(REALM_NAME).clients().get(client.getId()).update(client);
}
}, clients.get(AdminRoles.QUERY_USERS), false);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
clients.get(AdminRoles.QUERY_USERS).realm(REALM_NAME).clients().get(client.getId()).remove();
}
}, clients.get(AdminRoles.QUERY_USERS), false);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.convertClientDescription("blahblah");
}
}, Resource.CLIENT, true);
invoke(new InvocationWithResponse() {
public void invoke(RealmResource realm, AtomicReference<Response> response) {
response.set(realm.clients().create(ClientBuilder.create().clientId("foo").build()));
}
}, Resource.CLIENT, true);
ClientRepresentation foo = adminClient.realms().realm(REALM_NAME).clients().findByClientId("foo").get(0);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).toRepresentation();
}
}, Resource.CLIENT, false);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getInstallationProvider("nosuch");
}
}, Resource.CLIENT, false);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).update(foo);
}
}, Resource.CLIENT, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).remove();
realm.clients().create(foo);
ClientRepresentation temp = realm.clients().findByClientId("foo").get(0);
foo.setId(temp.getId());
}
}, Resource.CLIENT, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).generateNewSecret();
}
}, Resource.CLIENT, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).regenerateRegistrationAccessToken();
}
}, Resource.CLIENT, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getSecret();
}
}, Resource.CLIENT, false);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getServiceAccountUser();
}
}, Resource.CLIENT, false);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).pushRevocation();
}
}, Resource.CLIENT, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getApplicationSessionCount();
}
}, Resource.CLIENT, false);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getUserSessions(0, 100);
}
}, Resource.CLIENT, false);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getOfflineSessionCount();
}
}, Resource.CLIENT, false);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getOfflineUserSessions(0, 100);
}
}, Resource.CLIENT, false);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).registerNode(Collections.<String, String>emptyMap());
}
}, Resource.CLIENT, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).unregisterNode("nosuch");
}
}, Resource.CLIENT, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).testNodesAvailable();
}
}, Resource.CLIENT, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getCertficateResource("nosuch").generate();
}
}, Resource.CLIENT, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getCertficateResource("nosuch").generateAndGetKeystore(new KeyStoreConfig());
}
}, Resource.CLIENT, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getCertficateResource("nosuch").getKeyInfo();
}
}, Resource.CLIENT, false);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getCertficateResource("nosuch").getKeystore(new KeyStoreConfig());
}
}, Resource.CLIENT, false);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getCertficateResource("nosuch").uploadJks(new MultipartFormDataOutput());
}
}, Resource.CLIENT, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getCertficateResource("nosuch").uploadJksCertificate(new MultipartFormDataOutput());
}
}, Resource.CLIENT, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getProtocolMappers().createMapper(Collections.EMPTY_LIST);
}
}, Resource.CLIENT, true);
invoke(new InvocationWithResponse() {
public void invoke(RealmResource realm, AtomicReference<Response> response) {
response.set(realm.clients().get(foo.getId()).getProtocolMappers().createMapper(new ProtocolMapperRepresentation()));
}
}, Resource.CLIENT, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getProtocolMappers().getMapperById("nosuch");
}
}, Resource.CLIENT, false, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getProtocolMappers().getMappers();
}
}, Resource.CLIENT, false, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getProtocolMappers().getMappersPerProtocol("nosuch");
}
}, Resource.CLIENT, false, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getProtocolMappers().update("nosuch", new ProtocolMapperRepresentation());
}
}, Resource.CLIENT, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getProtocolMappers().delete("nosuch");
}
}, Resource.CLIENT, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getScopeMappings().getAll();
}
}, Resource.CLIENT, false);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getScopeMappings().realmLevel().listAll();
}
}, Resource.CLIENT, false);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getScopeMappings().realmLevel().listEffective();
}
}, Resource.CLIENT, false);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getScopeMappings().realmLevel().listAvailable();
}
}, Resource.CLIENT, false);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getScopeMappings().realmLevel().add(Collections.<RoleRepresentation>emptyList());
}
}, Resource.CLIENT, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).getScopeMappings().realmLevel().remove(Collections.<RoleRepresentation>emptyList());
}
}, Resource.CLIENT, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(UUID.randomUUID().toString()).roles().list();
}
}, Resource.CLIENT, false, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).roles().create(new RoleRepresentation());
}
}, Resource.CLIENT, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).roles().get("nosuch").toRepresentation();
}
}, Resource.CLIENT, false);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).roles().deleteRole("nosuch");
}
}, Resource.CLIENT, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).roles().get("nosuch").update(new RoleRepresentation());
}
}, Resource.CLIENT, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).roles().get("nosuch").addComposites(Collections.<RoleRepresentation>emptyList());
}
}, Resource.CLIENT, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).roles().get("nosuch").deleteComposites(Collections.<RoleRepresentation>emptyList());
}
}, Resource.CLIENT, true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).roles().get("nosuch").getRoleComposites();
}
}, Resource.CLIENT, false);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).roles().get("nosuch").getRealmRoleComposites();
}
}, Resource.CLIENT, false);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.clients().get(foo.getId()).roles().get("nosuch").getClientRoleComposites("nosuch");
}
}, Resource.CLIENT, false);
// users with query-client role should be able to query flows so the client detail page can be rendered successfully when fine-grained permissions are enabled.
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.flows().getFlows();
}
}, clients.get(AdminRoles.QUERY_CLIENTS), true);
// the same for ClientAuthenticatorProviders and PerClientConfigDescription
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.flows().getClientAuthenticatorProviders();
}
}, clients.get(AdminRoles.QUERY_CLIENTS), true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.flows().getClientAuthenticatorProviders();
}
}, clients.get(AdminRoles.VIEW_CLIENTS), true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.flows().getClientAuthenticatorProviders();
}
}, clients.get(AdminRoles.MANAGE_CLIENTS), true);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.flows().getClientAuthenticatorProviders();
}
}, clients.get(AdminRoles.QUERY_USERS), false);
invoke(new Invocation() {
public void invoke(RealmResource realm) {
realm.flows().getPerClientConfigDescription();
}
}, clients.get(AdminRoles.QUERY_CLIENTS), true);
}
use of org.keycloak.representations.idm.ProtocolMapperRepresentation in project keycloak by keycloak.
the class AccessTokenTest method testKeycloak2221.
@Test
public void testKeycloak2221() throws Exception {
Client client = AdminClientUtil.createResteasyClient();
UriBuilder builder = UriBuilder.fromUri(AUTH_SERVER_ROOT);
URI grantUri = OIDCLoginProtocolService.tokenUrl(builder).build("test");
WebTarget grantTarget = client.target(grantUri);
ClientResource clientResource;
{
clientResource = findClientByClientId(adminClient.realm("test"), "test-app");
clientResource.getProtocolMappers().createMapper(createRoleNameMapper("rename-role", "user", "realm-user"));
clientResource.getProtocolMappers().createMapper(createRoleNameMapper("rename-role2", "admin", "the-admin"));
}
{
Response response = executeGrantRequest(grantTarget, "no-permissions", "password");
assertEquals(200, response.getStatus());
org.keycloak.representations.AccessTokenResponse tokenResponse = response.readEntity(org.keycloak.representations.AccessTokenResponse.class);
AccessToken accessToken = getAccessToken(tokenResponse);
assertEquals(accessToken.getRealmAccess().getRoles().size(), 1);
assertTrue(accessToken.getRealmAccess().getRoles().contains("realm-user"));
response.close();
}
// undo mappers
{
ClientResource app = findClientByClientId(adminClient.realm("test"), "test-app");
ClientRepresentation clientRepresentation = app.toRepresentation();
for (ProtocolMapperRepresentation protocolRep : clientRepresentation.getProtocolMappers()) {
if (protocolRep.getName().startsWith("rename-role")) {
clientResource.getProtocolMappers().delete(protocolRep.getId());
}
}
}
events.clear();
}
use of org.keycloak.representations.idm.ProtocolMapperRepresentation in project keycloak by keycloak.
the class OIDCProtocolMappersTest method testUserGroupRoleToAttributeMappers.
@Test
@AuthServerContainerExclude(AuthServer.REMOTE)
public void testUserGroupRoleToAttributeMappers() throws Exception {
// Add mapper for realm roles
String clientId = "test-app";
ProtocolMapperRepresentation realmMapper = ProtocolMapperUtil.createUserRealmRoleMappingMapper("pref.", "Realm roles mapper", "roles-custom.realm", true, true);
ProtocolMapperRepresentation clientMapper = ProtocolMapperUtil.createUserClientRoleMappingMapper(clientId, "ta.", "Client roles mapper", "roles-custom.test-app", true, true);
ProtocolMappersResource protocolMappers = ApiUtil.findClientResourceByClientId(adminClient.realm("test"), clientId).getProtocolMappers();
protocolMappers.createMapper(Arrays.asList(realmMapper, clientMapper));
// Login user
OAuthClient.AccessTokenResponse response = browserLogin("password", "rich.roles@redhat.com", "password");
IDToken idToken = oauth.verifyIDToken(response.getIdToken());
// Verify attribute is filled
Map<String, Object> roleMappings = (Map<String, Object>) idToken.getOtherClaims().get("roles-custom");
Assert.assertThat(roleMappings.keySet(), containsInAnyOrder("realm", clientId));
String realmRoleMappings = (String) roleMappings.get("realm");
String testAppMappings = (String) roleMappings.get(clientId);
assertRolesString(realmRoleMappings, // from direct assignment to /roleRichGroup/level2group
"pref.admin", // from parent group of /roleRichGroup/level2group, i.e. from /roleRichGroup
"pref.user", // from client role customer-admin-composite-role - realm role for test-app
"pref.customer-user-premium", // from parent group of /roleRichGroup/level2group, i.e. from /roleRichGroup
"pref.realm-composite-role", // from realm role realm-composite-role
"pref.sample-realm-role");
assertRolesString(testAppMappings, // from direct assignment to /roleRichGroup/level2group
"ta.customer-user", // from direct assignment to /roleRichGroup/level2group
"ta.customer-admin-composite-role", // from client role customer-admin-composite-role - client role for test-app
"ta.customer-admin", // from realm role realm-composite-role - client role for test-app
"ta.sample-client-role");
// Revert
deleteMappers(protocolMappers);
}
use of org.keycloak.representations.idm.ProtocolMapperRepresentation in project keycloak by keycloak.
the class OIDCProtocolMappersTest method testUserGroupRoleToAttributeMappersNotScopedOtherApp.
@Test
public void testUserGroupRoleToAttributeMappersNotScopedOtherApp() throws Exception {
String clientId = "test-app-authz";
ProtocolMapperRepresentation realmMapper = ProtocolMapperUtil.createUserRealmRoleMappingMapper("pref.", "Realm roles mapper", "roles-custom.realm", true, true);
ProtocolMapperRepresentation clientMapper = ProtocolMapperUtil.createUserClientRoleMappingMapper(clientId, null, "Client roles mapper", "roles-custom." + clientId, true, true);
ProtocolMappersResource protocolMappers = ApiUtil.findClientResourceByClientId(adminClient.realm("test"), clientId).getProtocolMappers();
protocolMappers.createMapper(Arrays.asList(realmMapper, clientMapper));
// Login user
ClientManager.realm(adminClient.realm("test")).clientId(clientId).directAccessGrant(true);
oauth.clientId(clientId);
String oldRedirectUri = oauth.getRedirectUri();
oauth.redirectUri(UriUtils.getOrigin(oldRedirectUri) + "/test-app-authz");
OAuthClient.AccessTokenResponse response = browserLogin("secret", "rich.roles@redhat.com", "password");
IDToken idToken = oauth.verifyIDToken(response.getIdToken());
// revert redirect_uri
oauth.redirectUri(oldRedirectUri);
// Verify attribute is filled
Map<String, Object> roleMappings = (Map<String, Object>) idToken.getOtherClaims().get("roles-custom");
Assert.assertThat(roleMappings.keySet(), containsInAnyOrder("realm"));
String realmRoleMappings = (String) roleMappings.get("realm");
String testAppAuthzMappings = (String) roleMappings.get(clientId);
assertRolesString(realmRoleMappings, // from direct assignment to /roleRichGroup/level2group
"pref.admin", // from parent group of /roleRichGroup/level2group, i.e. from /roleRichGroup
"pref.user", // from client role customer-admin-composite-role - realm role for test-app
"pref.customer-user-premium", // from parent group of /roleRichGroup/level2group, i.e. from /roleRichGroup
"pref.realm-composite-role", // from realm role realm-composite-role
"pref.sample-realm-role");
// There is no client role defined for test-app-authz
assertNull(testAppAuthzMappings);
// Revert
deleteMappers(protocolMappers);
}
Aggregations