Examples with AuthorizationRequest org.keycloak.representations.idm.authorization.AuthorizationRequest used on opensource projects

Example 46 with AuthorizationRequest

use of org.keycloak.representations.idm.authorization.AuthorizationRequest in project keycloak by keycloak.

the class PermissionManagementTest method testDeleteScopeAndPermissionTicket.

@Test
public void testDeleteScopeAndPermissionTicket() throws Exception {
    ResourceRepresentation resource = addResource("Resource A", "kolo", true, "ScopeA", "ScopeB", "ScopeC");
    PermissionRequest permissionRequest = new PermissionRequest(resource.getId());
    permissionRequest.setScopes(new HashSet<>(Arrays.asList("ScopeA", "ScopeB", "ScopeC")));
    AuthzClient authzClient = getAuthzClient();
    PermissionResponse response = authzClient.protection("marta", "password").permission().create(permissionRequest);
    assertNotNull(response.getTicket());
    AuthorizationRequest request = new AuthorizationRequest();
    request.setTicket(response.getTicket());
    request.setClaimToken(authzClient.obtainAccessToken("marta", "password").getToken());
    try {
        authzClient.authorization().authorize(request);
    } catch (Exception e) {
    }
    assertEquals(3, authzClient.protection().permission().findByResource(resource.getId()).size());
    AuthorizationResource authorization = getClient(getRealm()).authorization();
    ResourceScopesResource scopes = authorization.scopes();
    ScopeRepresentation scope = scopes.findByName("ScopeA");
    List permissions = authzClient.protection().permission().findByScope(scope.getId());
    assertFalse(permissions.isEmpty());
    assertEquals(1, permissions.size());
    resource.setScopes(Collections.emptySet());
    authorization.resources().resource(resource.getId()).update(resource);
    scopes.scope(scope.getId()).remove();
    assertTrue(authzClient.protection().permission().findByScope(scope.getId()).isEmpty());
    assertEquals(0, authzClient.protection().permission().findByResource(resource.getId()).size());
}

Example 47 with AuthorizationRequest

use of org.keycloak.representations.idm.authorization.AuthorizationRequest in project keycloak by keycloak.

the class RegexPolicyTest method testWithoutExpectedUserAttribute.

@Test
public void testWithoutExpectedUserAttribute() {
    // Access Resource A with taro.
    AuthzClient authzClient = getAuthzClient();
    PermissionRequest request = new PermissionRequest("Resource A");
    String ticket = authzClient.protection().permission().create(request).getTicket();
    try {
        authzClient.authorization("taro", "password").authorize(new AuthorizationRequest(ticket));
        fail("Should fail.");
    } catch (AuthorizationDeniedException ignore) {
    }
    // Access Resource B with taro.
    request = new PermissionRequest("Resource B");
    ticket = authzClient.protection().permission().create(request).getTicket();
    try {
        authzClient.authorization("taro", "password").authorize(new AuthorizationRequest(ticket));
        fail("Should fail.");
    } catch (AuthorizationDeniedException ignore) {
    }
}

Example 48 with AuthorizationRequest

use of org.keycloak.representations.idm.authorization.AuthorizationRequest in project keycloak by keycloak.

the class AuthorizationTest method testResourceServerWithSameNameDifferentOwner.

@Test
public void testResourceServerWithSameNameDifferentOwner() {
    ResourceRepresentation koloResource = createResource("Resource A", "kolo", "Scope A", "Scope B");
    createResourcePermission(koloResource, "Grant Policy");
    ResourceRepresentation serverResource = createResource("Resource A", null, "Scope A", "Scope B");
    createResourcePermission(serverResource, "Grant Policy");
    AuthorizationRequest request = new AuthorizationRequest();
    request.addPermission("Resource A");
    List<Permission> permissions = authorize("kolo", "password", request);
    assertEquals(2, permissions.size());
    for (Permission permission : permissions) {
        assertTrue(permission.getResourceId().equals(koloResource.getId()) || permission.getResourceId().equals(serverResource.getId()));
        assertEquals("Resource A", permission.getResourceName());
    }
}

Example 49 with AuthorizationRequest

use of org.keycloak.representations.idm.authorization.AuthorizationRequest in project keycloak by keycloak.

the class UserManagedPermissionServiceTest method testUserManagedPermission.

@Test
public void testUserManagedPermission() {
    ResourceRepresentation resource = new ResourceRepresentation();
    resource.setName("Resource A");
    resource.setOwnerManagedAccess(true);
    resource.setOwner("marta");
    resource.addScope("Scope A", "Scope B", "Scope C");
    resource = getAuthzClient().protection().resource().create(resource);
    UmaPermissionRepresentation permission = new UmaPermissionRepresentation();
    permission.setName("Custom User-Managed Permission");
    permission.setDescription("Users from specific roles are allowed to access");
    permission.addScope("Scope A");
    permission.addRole("role_a");
    ProtectionResource protection = getAuthzClient().protection("marta", "password");
    permission = protection.policy(resource.getId()).create(permission);
    AuthorizationResource authorization = getAuthzClient().authorization("kolo", "password");
    AuthorizationRequest request = new AuthorizationRequest();
    request.addPermission(resource.getId(), "Scope A");
    AuthorizationResponse authzResponse = authorization.authorize(request);
    assertNotNull(authzResponse);
    permission.removeRole("role_a");
    permission.addRole("role_b");
    protection.policy(resource.getId()).update(permission);
    try {
        authorization.authorize(request);
        fail("User should not have permission");
    } catch (Exception e) {
        assertTrue(AuthorizationDeniedException.class.isInstance(e));
    }
    try {
        getAuthzClient().authorization("alice", "password").authorize(request);
        fail("User should not have permission");
    } catch (Exception e) {
        assertTrue(AuthorizationDeniedException.class.isInstance(e));
    }
    permission.addRole("role_a");
    protection.policy(resource.getId()).update(permission);
    authzResponse = authorization.authorize(request);
    assertNotNull(authzResponse);
    protection.policy(resource.getId()).delete(permission.getId());
    try {
        authorization.authorize(request);
        fail("User should not have permission");
    } catch (Exception e) {
        assertTrue(AuthorizationDeniedException.class.isInstance(e));
    }
    try {
        getAuthzClient().protection("marta", "password").policy(resource.getId()).findById(permission.getId());
        fail("Permission must not exist");
    } catch (Exception e) {
        assertEquals(404, HttpResponseException.class.cast(e.getCause()).getStatusCode());
    }
    // create a user based permission, where only selected users are allowed access to the resource.
    permission = new UmaPermissionRepresentation();
    permission.setName("Custom User-Managed Permission");
    permission.setDescription("Specific users are allowed access to the resource");
    permission.addScope("Scope A");
    permission.addUser("alice");
    protection.policy(resource.getId()).create(permission);
    // alice should be able to access the resource with the updated permission.
    authzResponse = getAuthzClient().authorization("alice", "password").authorize(request);
    assertNotNull(authzResponse);
    // kolo shouldn't be able to access the resource with the updated permission.
    try {
        authorization.authorize(request);
        fail("User should not have permission to access the protected resource");
    } catch (Exception e) {
        assertTrue(AuthorizationDeniedException.class.isInstance(e));
    }
}

Example 50 with AuthorizationRequest

use of org.keycloak.representations.idm.authorization.AuthorizationRequest in project keycloak by keycloak.

the class UserManagedPermissionServiceTest method testGrantRequestedScopesOnly.

@Test
public void testGrantRequestedScopesOnly() {
    ResourceRepresentation resource = new ResourceRepresentation();
    resource.setName(UUID.randomUUID().toString());
    resource.setOwnerManagedAccess(true);
    resource.setOwner("marta");
    resource.addScope("view", "delete");
    ProtectionResource protection = getAuthzClient().protection("marta", "password");
    resource = protection.resource().create(resource);
    UmaPermissionRepresentation permission = new UmaPermissionRepresentation();
    permission.setName("Custom User-Managed Permission");
    permission.addScope("view");
    permission.addUser("kolo");
    permission = protection.policy(resource.getId()).create(permission);
    AuthorizationRequest request = new AuthorizationRequest();
    request.addPermission(resource.getId(), "view");
    AuthorizationResponse response = getAuthzClient().authorization("kolo", "password").authorize(request);
    AccessToken rpt = toAccessToken(response.getToken());
    Collection<Permission> permissions = rpt.getAuthorization().getPermissions();
    assertPermissions(permissions, resource.getId(), "view");
    assertTrue(permissions.isEmpty());
    request = new AuthorizationRequest();
    request.addPermission(resource.getId(), "delete");
    try {
        getAuthzClient().authorization("kolo", "password").authorize(request);
        fail("User should not have permission");
    } catch (Exception e) {
        assertTrue(AuthorizationDeniedException.class.isInstance(e));
    }
    request = new AuthorizationRequest();
    request.addPermission(resource.getId(), "delete");
    try {
        getAuthzClient().authorization("kolo", "password").authorize(request);
        fail("User should not have permission");
    } catch (Exception e) {
        assertTrue(AuthorizationDeniedException.class.isInstance(e));
    }
    request = new AuthorizationRequest();
    request.addPermission(resource.getId());
    response = getAuthzClient().authorization("kolo", "password").authorize(request);
    rpt = toAccessToken(response.getToken());
    permissions = rpt.getAuthorization().getPermissions();
    assertPermissions(permissions, resource.getId(), "view");
    assertTrue(permissions.isEmpty());
}