Examples with AuthorizationRequest org.keycloak.representations.idm.authorization.AuthorizationRequest used on opensource projects

Example 31 with AuthorizationRequest

use of org.keycloak.representations.idm.authorization.AuthorizationRequest in project keycloak by keycloak.

the class PermissionManagementTest method testCreatePermissionTicketWithResourceName.

@Test
public void testCreatePermissionTicketWithResourceName() throws Exception {
    ResourceRepresentation resource = addResource("Resource A", "kolo", true);
    AuthzClient authzClient = getAuthzClient();
    PermissionResponse response = authzClient.protection("marta", "password").permission().create(new PermissionRequest(resource.getId()));
    AuthorizationRequest request = new AuthorizationRequest();
    request.setTicket(response.getTicket());
    request.setClaimToken(authzClient.obtainAccessToken("marta", "password").getToken());
    try {
        authzClient.authorization().authorize(request);
    } catch (Exception e) {
    }
    assertPersistence(response, resource);
}

Example 32 with AuthorizationRequest

use of org.keycloak.representations.idm.authorization.AuthorizationRequest in project keycloak by keycloak.

the class AuthorizationAPITest method testResourceServerAsAudience.

public void testResourceServerAsAudience(String clientId, String resourceServerClientId, String authzConfigFile) throws Exception {
    AuthzClient authzClient = getAuthzClient(authzConfigFile);
    PermissionRequest request = new PermissionRequest();
    request.setResourceId("Resource A");
    String accessToken = new OAuthClient().realm("authz-test").clientId(clientId).doGrantAccessTokenRequest("secret", "marta", "password").getAccessToken();
    String ticket = authzClient.protection().permission().create(request).getTicket();
    // Ticket is opaque to client or resourceServer. The audience should be just an authorization server itself
    JsonWebToken ticketDecoded = JsonSerialization.readValue(new JWSInput(ticket).getContent(), JsonWebToken.class);
    Assert.assertFalse(ticketDecoded.hasAudience(clientId));
    Assert.assertFalse(ticketDecoded.hasAudience(resourceServerClientId));
    AuthorizationResponse response = authzClient.authorization(accessToken).authorize(new AuthorizationRequest(ticket));
    assertNotNull(response.getToken());
    AccessToken rpt = toAccessToken(response.getToken());
    assertEquals(resourceServerClientId, rpt.getAudience()[0]);
}

Example 33 with AuthorizationRequest

use of org.keycloak.representations.idm.authorization.AuthorizationRequest in project keycloak by keycloak.

the class ClientScopePolicyTest method testWithExpectedClientScope.

@Test
public void testWithExpectedClientScope() {
    // Access Resource A with client scope foo.
    AuthzClient authzClient = getAuthzClient();
    PermissionRequest request = new PermissionRequest("Resource A");
    String ticket = authzClient.protection().permission().create(request).getTicket();
    AuthorizationResponse response = authzClient.authorization("marta", "password", "foo").authorize(new AuthorizationRequest(ticket));
    assertNotNull(response.getToken());
    // Access Resource A with client scope bar.
    request = new PermissionRequest("Resource A");
    ticket = authzClient.protection().permission().create(request).getTicket();
    response = authzClient.authorization("marta", "password", "bar").authorize(new AuthorizationRequest(ticket));
    assertNotNull(response.getToken());
    // Access Resource B with client scope bar.
    request = new PermissionRequest("Resource B");
    ticket = authzClient.protection().permission().create(request).getTicket();
    response = authzClient.authorization("marta", "password", "bar").authorize(new AuthorizationRequest(ticket));
    assertNotNull(response.getToken());
}

Example 34 with AuthorizationRequest

use of org.keycloak.representations.idm.authorization.AuthorizationRequest in project keycloak by keycloak.

the class AuthorizationTest method testResourceWithSameNameDifferentOwner.

@Test
public void testResourceWithSameNameDifferentOwner() throws JWSInputException {
    ResourceRepresentation koloResource = createResource("Resource A", "kolo", "Scope A", "Scope B");
    createResourcePermission(koloResource, "Grant Policy");
    ResourceRepresentation martaResource = createResource("Resource A", "marta", "Scope A", "Scope B");
    createResourcePermission(martaResource, "Grant Policy");
    assertNotEquals(koloResource.getId(), martaResource.getId());
    AuthorizationRequest request = new AuthorizationRequest();
    request.addPermission("Resource A");
    List<Permission> permissions = authorize("kolo", "password", request);
    assertEquals(1, permissions.size());
    Permission permission = permissions.get(0);
    assertTrue(permission.getScopes().containsAll(Arrays.asList("Scope A", "Scope B")));
    assertEquals(koloResource.getId(), permission.getResourceId());
    permissions = authorize("marta", "password", request);
    assertEquals(1, permissions.size());
    permission = permissions.get(0);
    assertEquals(martaResource.getId(), permission.getResourceId());
    assertTrue(permission.getScopes().containsAll(Arrays.asList("Scope A", "Scope B")));
}

Example 35 with AuthorizationRequest

use of org.keycloak.representations.idm.authorization.AuthorizationRequest in project keycloak by keycloak.

the class RolePolicyTest method testUserWithGroupRole.

@Test
public void testUserWithGroupRole() throws InterruptedException {
    AuthzClient authzClient = getAuthzClient();
    PermissionRequest request = new PermissionRequest();
    request.setResourceId("Resource C");
    String ticket = authzClient.protection().permission().create(request).getTicket();
    assertNotNull(authzClient.authorization("alice", "password").authorize(new AuthorizationRequest(ticket)));
    UserRepresentation user = getRealm().users().search("alice").get(0);
    GroupRepresentation groupB = getRealm().groups().groups().stream().filter(representation -> "Group B".equals(representation.getName())).findFirst().get();
    getRealm().users().get(user.getId()).leaveGroup(groupB.getId());
    try {
        authzClient.authorization("alice", "password").authorize(new AuthorizationRequest(ticket));
        fail("Should fail because user is not granted with expected role");
    } catch (AuthorizationDeniedException ignore) {
    }
    request.setResourceId("Resource A");
    ticket = authzClient.protection().permission().create(request).getTicket();
    try {
        authzClient.authorization("alice", "password").authorize(new AuthorizationRequest(ticket));
        fail("Should fail because user is not granted with expected role");
    } catch (AuthorizationDeniedException ignore) {
    }
    GroupRepresentation groupA = getRealm().groups().groups().stream().filter(representation -> "Group A".equals(representation.getName())).findFirst().get();
    getRealm().users().get(user.getId()).joinGroup(groupA.getId());
    assertNotNull(authzClient.authorization("alice", "password").authorize(new AuthorizationRequest(ticket)));
}