Examples with AuthorizationRequest org.keycloak.representations.idm.authorization.AuthorizationRequest used on opensource projects

Example 26 with AuthorizationRequest

use of org.keycloak.representations.idm.authorization.AuthorizationRequest in project keycloak by keycloak.

the class RolePolicyTest method testUserWithoutExpectedRole.

@Test
public void testUserWithoutExpectedRole() {
    AuthzClient authzClient = getAuthzClient();
    PermissionRequest request = new PermissionRequest("Resource A");
    String ticket = authzClient.protection().permission().create(request).getTicket();
    try {
        authzClient.authorization("kolo", "password").authorize(new AuthorizationRequest(ticket));
        fail("Should fail because user is not granted with expected role");
    } catch (AuthorizationDeniedException ignore) {
    }
    request.setResourceId("Resource B");
    ticket = authzClient.protection().permission().create(request).getTicket();
    assertNotNull(authzClient.authorization("kolo", "password").authorize(new AuthorizationRequest(ticket)));
    UserRepresentation user = getRealm().users().search("kolo").get(0);
    RoleRepresentation roleA = getRealm().roles().get("Role A").toRepresentation();
    getRealm().users().get(user.getId()).roles().realmLevel().add(Arrays.asList(roleA));
    request.setResourceId("Resource A");
    ticket = authzClient.protection().permission().create(request).getTicket();
    assertNotNull(authzClient.authorization("kolo", "password").authorize(new AuthorizationRequest(ticket)));
}

Example 27 with AuthorizationRequest

use of org.keycloak.representations.idm.authorization.AuthorizationRequest in project keycloak by keycloak.

the class GroupNamePolicyTest method testExactNameMatch.

@Test
public void testExactNameMatch() {
    AuthzClient authzClient = getAuthzClient();
    PermissionRequest request = new PermissionRequest("Resource A");
    String ticket = authzClient.protection().permission().create(request).getTicket();
    AuthorizationResponse response = authzClient.authorization("marta", "password").authorize(new AuthorizationRequest(ticket));
    assertNotNull(response.getToken());
    try {
        authzClient.authorization("kolo", "password").authorize(new AuthorizationRequest(ticket));
        fail("Should fail because user is not granted with expected group");
    } catch (AuthorizationDeniedException ignore) {
    }
    try {
        authzClient.authorization("alice", "password").authorize(new AuthorizationRequest(ticket));
        fail("Should fail because user is not granted with expected group");
    } catch (AuthorizationDeniedException ignore) {
    }
    try {
        authzClient.authorization(authzClient.obtainAccessToken().getToken()).authorize(new AuthorizationRequest(ticket));
        fail("Should fail because service account is not granted with expected group");
    } catch (AuthorizationDeniedException ignore) {
    }
}

Example 28 with AuthorizationRequest

use of org.keycloak.representations.idm.authorization.AuthorizationRequest in project keycloak by keycloak.

the class GroupNamePolicyTest method testOnlyChildrenPolicy.

@Test
public void testOnlyChildrenPolicy() throws Exception {
    RealmResource realm = getRealm();
    AuthzClient authzClient = getAuthzClient();
    PermissionRequest request = new PermissionRequest("Resource B");
    String ticket = authzClient.protection().permission().create(request).getTicket();
    try {
        authzClient.authorization("kolo", "password").authorize(new AuthorizationRequest(ticket));
        fail("Should fail because user is not granted with expected group");
    } catch (AuthorizationDeniedException ignore) {
    }
    AuthorizationResponse response = authzClient.authorization("alice", "password").authorize(new AuthorizationRequest(ticket));
    assertNotNull(response.getToken());
    try {
        authzClient.authorization("marta", "password").authorize(new AuthorizationRequest(ticket));
        fail("Should fail because user is not granted with expected role");
    } catch (AuthorizationDeniedException ignore) {
    }
    request = new PermissionRequest("Resource C");
    ticket = authzClient.protection().permission().create(request).getTicket();
    response = authzClient.authorization("kolo", "password").authorize(new AuthorizationRequest(ticket));
    assertNotNull(response.getToken());
}

Example 29 with AuthorizationRequest

use of org.keycloak.representations.idm.authorization.AuthorizationRequest in project keycloak by keycloak.

the class PermissionManagementTest method testDeleteResourceAndPermissionTicket.

@Test
public void testDeleteResourceAndPermissionTicket() throws Exception {
    ResourceRepresentation resource = addResource("Resource A", "kolo", true, "ScopeA", "ScopeB", "ScopeC");
    AuthzClient authzClient = getAuthzClient();
    PermissionResponse response = authzClient.protection("marta", "password").permission().create(new PermissionRequest(resource.getId(), "ScopeA", "ScopeB", "ScopeC"));
    AuthorizationRequest request = new AuthorizationRequest();
    request.setTicket(response.getTicket());
    request.setClaimToken(authzClient.obtainAccessToken("marta", "password").getToken());
    try {
        authzClient.authorization().authorize(request);
    } catch (Exception e) {
    }
    assertPersistence(response, resource, "ScopeA", "ScopeB", "ScopeC");
    getAuthzClient().protection().resource().delete(resource.getId());
    assertTrue(getAuthzClient().protection().permission().findByResource(resource.getId()).isEmpty());
}

Example 30 with AuthorizationRequest

use of org.keycloak.representations.idm.authorization.AuthorizationRequest in project keycloak by keycloak.

the class PermissionManagementTest method testTicketNotCreatedWhenResourceOwner.

@Test
public void testTicketNotCreatedWhenResourceOwner() throws Exception {
    ResourceRepresentation resource = addResource("Resource A", "marta", true);
    AuthzClient authzClient = getAuthzClient();
    PermissionResponse response = authzClient.protection("marta", "password").permission().create(new PermissionRequest(resource.getId()));
    assertNotNull(response.getTicket());
    AuthorizationRequest request = new AuthorizationRequest();
    request.setTicket(response.getTicket());
    request.setClaimToken(authzClient.obtainAccessToken("marta", "password").getToken());
    try {
        authzClient.authorization().authorize(request);
    } catch (Exception e) {
        e.printStackTrace();
    }
    List permissions = authzClient.protection().permission().findByResource(resource.getId());
    assertTrue(permissions.isEmpty());
    response = authzClient.protection("kolo", "password").permission().create(new PermissionRequest(resource.getId()));
    assertNotNull(response.getTicket());
    request = new AuthorizationRequest();
    request.setTicket(response.getTicket());
    request.setClaimToken(authzClient.obtainAccessToken("kolo", "password").getToken());
    try {
        authzClient.authorization().authorize(request);
    } catch (Exception e) {
    }
    permissions = authzClient.protection().permission().findByResource(resource.getId());
    assertFalse(permissions.isEmpty());
    assertEquals(1, permissions.size());
}