Examples with Permission org.keycloak.representations.idm.authorization.Permission used on opensource projects

Example 51 with Permission

use of org.keycloak.representations.idm.authorization.Permission in project keycloak by keycloak.

the class AuthorizationTest method testResourceServerWithSameNameDifferentOwner.

@Test
public void testResourceServerWithSameNameDifferentOwner() {
    ResourceRepresentation koloResource = createResource("Resource A", "kolo", "Scope A", "Scope B");
    createResourcePermission(koloResource, "Grant Policy");
    ResourceRepresentation serverResource = createResource("Resource A", null, "Scope A", "Scope B");
    createResourcePermission(serverResource, "Grant Policy");
    AuthorizationRequest request = new AuthorizationRequest();
    request.addPermission("Resource A");
    List<Permission> permissions = authorize("kolo", "password", request);
    assertEquals(2, permissions.size());
    for (Permission permission : permissions) {
        assertTrue(permission.getResourceId().equals(koloResource.getId()) || permission.getResourceId().equals(serverResource.getId()));
        assertEquals("Resource A", permission.getResourceName());
    }
}

Example 52 with Permission

use of org.keycloak.representations.idm.authorization.Permission in project keycloak by keycloak.

the class ConflictingScopePermissionTest method testWithPermissiveMode.

@Test
public void testWithPermissiveMode() throws Exception {
    ClientResource client = getClient(getRealm());
    AuthorizationResource authorization = client.authorization();
    ResourceServerRepresentation settings = authorization.getSettings();
    settings.setPolicyEnforcementMode(PolicyEnforcementMode.PERMISSIVE);
    settings.setDecisionStrategy(DecisionStrategy.UNANIMOUS);
    authorization.update(settings);
    Collection<Permission> permissions = getEntitlements("marta", "password");
    assertEquals(3, permissions.size());
    for (Permission permission : new ArrayList<>(permissions)) {
        String resourceSetName = permission.getResourceName();
        switch(resourceSetName) {
            case "Resource A":
                assertThat(permission.getScopes(), containsInAnyOrder("execute", "write"));
                permissions.remove(permission);
                break;
            case "Resource C":
                assertThat(permission.getScopes(), containsInAnyOrder("execute", "write", "read"));
                permissions.remove(permission);
                break;
            case "Resource B":
                assertThat(permission.getScopes(), containsInAnyOrder("execute", "write", "read"));
                permissions.remove(permission);
                break;
            default:
                fail("Unexpected permission for resource [" + resourceSetName + "]");
        }
    }
    assertTrue(permissions.isEmpty());
}

Example 53 with Permission

use of org.keycloak.representations.idm.authorization.Permission in project keycloak by keycloak.

the class UserManagedPermissionServiceTest method testGrantRequestedScopesOnly.

@Test
public void testGrantRequestedScopesOnly() {
    ResourceRepresentation resource = new ResourceRepresentation();
    resource.setName(UUID.randomUUID().toString());
    resource.setOwnerManagedAccess(true);
    resource.setOwner("marta");
    resource.addScope("view", "delete");
    ProtectionResource protection = getAuthzClient().protection("marta", "password");
    resource = protection.resource().create(resource);
    UmaPermissionRepresentation permission = new UmaPermissionRepresentation();
    permission.setName("Custom User-Managed Permission");
    permission.addScope("view");
    permission.addUser("kolo");
    permission = protection.policy(resource.getId()).create(permission);
    AuthorizationRequest request = new AuthorizationRequest();
    request.addPermission(resource.getId(), "view");
    AuthorizationResponse response = getAuthzClient().authorization("kolo", "password").authorize(request);
    AccessToken rpt = toAccessToken(response.getToken());
    Collection<Permission> permissions = rpt.getAuthorization().getPermissions();
    assertPermissions(permissions, resource.getId(), "view");
    assertTrue(permissions.isEmpty());
    request = new AuthorizationRequest();
    request.addPermission(resource.getId(), "delete");
    try {
        getAuthzClient().authorization("kolo", "password").authorize(request);
        fail("User should not have permission");
    } catch (Exception e) {
        assertTrue(AuthorizationDeniedException.class.isInstance(e));
    }
    request = new AuthorizationRequest();
    request.addPermission(resource.getId(), "delete");
    try {
        getAuthzClient().authorization("kolo", "password").authorize(request);
        fail("User should not have permission");
    } catch (Exception e) {
        assertTrue(AuthorizationDeniedException.class.isInstance(e));
    }
    request = new AuthorizationRequest();
    request.addPermission(resource.getId());
    response = getAuthzClient().authorization("kolo", "password").authorize(request);
    rpt = toAccessToken(response.getToken());
    permissions = rpt.getAuthorization().getPermissions();
    assertPermissions(permissions, resource.getId(), "view");
    assertTrue(permissions.isEmpty());
}

Example 54 with Permission

use of org.keycloak.representations.idm.authorization.Permission in project keycloak by keycloak.

the class UmaGrantTypeTest method testObtainRptUsingAccessToken.

@Test
public void testObtainRptUsingAccessToken() throws Exception {
    AccessTokenResponse accessTokenResponse = getAuthzClient().obtainAccessToken("marta", "password");
    AuthorizationResponse response = authorize(null, null, null, null, accessTokenResponse.getToken(), null, null, new PermissionRequest("Resource A", "ScopeA", "ScopeB"));
    String rpt = response.getToken();
    assertNotNull(rpt);
    assertFalse(response.isUpgraded());
    AccessToken accessToken = toAccessToken(rpt);
    AccessToken.Authorization authorization = accessToken.getAuthorization();
    assertNotNull(authorization);
    Collection<Permission> permissions = authorization.getPermissions();
    assertNotNull(permissions);
    assertPermissions(permissions, "Resource A", "ScopeA", "ScopeB");
    assertTrue(permissions.isEmpty());
}

Example 55 with Permission

use of org.keycloak.representations.idm.authorization.Permission in project keycloak by keycloak.

the class UmaGrantTypeTest method testTokenIntrospect.

@Test
public void testTokenIntrospect() throws Exception {
    AuthzClient authzClient = getAuthzClient();
    AccessTokenResponse accessTokenResponse = authzClient.obtainAccessToken("marta", "password");
    AuthorizationResponse response = authorize(null, null, null, null, accessTokenResponse.getToken(), null, null, new PermissionRequest("Resource A", "ScopeA", "ScopeB"));
    String rpt = response.getToken();
    assertNotNull(rpt);
    assertFalse(response.isUpgraded());
    AccessToken accessToken = toAccessToken(rpt);
    AccessToken.Authorization authorization = accessToken.getAuthorization();
    assertNotNull(authorization);
    Collection<Permission> permissions = authorization.getPermissions();
    assertNotNull(permissions);
    assertPermissions(permissions, "Resource A", "ScopeA", "ScopeB");
    assertTrue(permissions.isEmpty());
    TokenIntrospectionResponse introspectionResponse = authzClient.protection().introspectRequestingPartyToken(rpt);
    assertNotNull(introspectionResponse);
    assertNotNull(introspectionResponse.getPermissions());
    oauth.realm("authz-test");
    String introspectHttpResponse = oauth.introspectTokenWithClientCredential("resource-server-test", "secret", "requesting_party_token", rpt);
    Map jsonNode = JsonSerialization.readValue(introspectHttpResponse, Map.class);
    assertEquals(true, jsonNode.get("active"));
    Collection permissionClaims = (Collection) jsonNode.get("permissions");
    assertNotNull(permissionClaims);
    assertEquals(1, permissionClaims.size());
    Map<String, Object> claim = (Map) permissionClaims.iterator().next();
    assertThat(claim.keySet(), containsInAnyOrder("resource_id", "rsname", "resource_scopes", "scopes", "rsid"));
    assertThat(claim.get("rsname"), equalTo("Resource A"));
    ResourceRepresentation resourceRep = authzClient.protection().resource().findByName("Resource A");
    assertThat(claim.get("rsid"), equalTo(resourceRep.getId()));
    assertThat(claim.get("resource_id"), equalTo(resourceRep.getId()));
    assertThat((Collection<String>) claim.get("resource_scopes"), containsInAnyOrder("ScopeA", "ScopeB"));
    assertThat((Collection<String>) claim.get("scopes"), containsInAnyOrder("ScopeA", "ScopeB"));
}