Examples with PermissionRequest org.keycloak.representations.idm.authorization.PermissionRequest used on opensource projects

Example 26 with PermissionRequest

use of org.keycloak.representations.idm.authorization.PermissionRequest in project keycloak by keycloak.

the class GroupNamePolicyTest method testOnlyChildrenPolicy.

@Test
public void testOnlyChildrenPolicy() throws Exception {
    RealmResource realm = getRealm();
    AuthzClient authzClient = getAuthzClient();
    PermissionRequest request = new PermissionRequest("Resource B");
    String ticket = authzClient.protection().permission().create(request).getTicket();
    try {
        authzClient.authorization("kolo", "password").authorize(new AuthorizationRequest(ticket));
        fail("Should fail because user is not granted with expected group");
    } catch (AuthorizationDeniedException ignore) {
    }
    AuthorizationResponse response = authzClient.authorization("alice", "password").authorize(new AuthorizationRequest(ticket));
    assertNotNull(response.getToken());
    try {
        authzClient.authorization("marta", "password").authorize(new AuthorizationRequest(ticket));
        fail("Should fail because user is not granted with expected role");
    } catch (AuthorizationDeniedException ignore) {
    }
    request = new PermissionRequest("Resource C");
    ticket = authzClient.protection().permission().create(request).getTicket();
    response = authzClient.authorization("kolo", "password").authorize(new AuthorizationRequest(ticket));
    assertNotNull(response.getToken());
}

Example 27 with PermissionRequest

use of org.keycloak.representations.idm.authorization.PermissionRequest in project keycloak by keycloak.

the class PermissionManagementTest method testDeleteResourceAndPermissionTicket.

@Test
public void testDeleteResourceAndPermissionTicket() throws Exception {
    ResourceRepresentation resource = addResource("Resource A", "kolo", true, "ScopeA", "ScopeB", "ScopeC");
    AuthzClient authzClient = getAuthzClient();
    PermissionResponse response = authzClient.protection("marta", "password").permission().create(new PermissionRequest(resource.getId(), "ScopeA", "ScopeB", "ScopeC"));
    AuthorizationRequest request = new AuthorizationRequest();
    request.setTicket(response.getTicket());
    request.setClaimToken(authzClient.obtainAccessToken("marta", "password").getToken());
    try {
        authzClient.authorization().authorize(request);
    } catch (Exception e) {
    }
    assertPersistence(response, resource, "ScopeA", "ScopeB", "ScopeC");
    getAuthzClient().protection().resource().delete(resource.getId());
    assertTrue(getAuthzClient().protection().permission().findByResource(resource.getId()).isEmpty());
}

Example 28 with PermissionRequest

use of org.keycloak.representations.idm.authorization.PermissionRequest in project keycloak by keycloak.

the class AuthorizationAPITest method testResourceServerAsAudience.

public void testResourceServerAsAudience(String clientId, String resourceServerClientId, String authzConfigFile) throws Exception {
    AuthzClient authzClient = getAuthzClient(authzConfigFile);
    PermissionRequest request = new PermissionRequest();
    request.setResourceId("Resource A");
    String accessToken = new OAuthClient().realm("authz-test").clientId(clientId).doGrantAccessTokenRequest("secret", "marta", "password").getAccessToken();
    String ticket = authzClient.protection().permission().create(request).getTicket();
    // Ticket is opaque to client or resourceServer. The audience should be just an authorization server itself
    JsonWebToken ticketDecoded = JsonSerialization.readValue(new JWSInput(ticket).getContent(), JsonWebToken.class);
    Assert.assertFalse(ticketDecoded.hasAudience(clientId));
    Assert.assertFalse(ticketDecoded.hasAudience(resourceServerClientId));
    AuthorizationResponse response = authzClient.authorization(accessToken).authorize(new AuthorizationRequest(ticket));
    assertNotNull(response.getToken());
    AccessToken rpt = toAccessToken(response.getToken());
    assertEquals(resourceServerClientId, rpt.getAudience()[0]);
}

Example 29 with PermissionRequest

use of org.keycloak.representations.idm.authorization.PermissionRequest in project keycloak by keycloak.

the class ClientScopePolicyTest method testWithoutExpectedClientScope.

@Test
public void testWithoutExpectedClientScope() {
    // Access Resource A with client scope baz.
    AuthzClient authzClient = getAuthzClient();
    PermissionRequest request = new PermissionRequest("Resource A");
    String ticket = authzClient.protection().permission().create(request).getTicket();
    try {
        authzClient.authorization("marta", "password", "baz").authorize(new AuthorizationRequest(ticket));
        fail("Should fail.");
    } catch (AuthorizationDeniedException ignore) {
    }
    // Access Resource B with client scope foo.
    request = new PermissionRequest("Resource B");
    ticket = authzClient.protection().permission().create(request).getTicket();
    try {
        authzClient.authorization("marta", "password", "foo").authorize(new AuthorizationRequest(ticket));
        fail("Should fail.");
    } catch (AuthorizationDeniedException ignore) {
    }
}

Example 30 with PermissionRequest

use of org.keycloak.representations.idm.authorization.PermissionRequest in project keycloak by keycloak.

the class AuthorizationAPITest method testAccessTokenWithUmaAuthorization.

public void testAccessTokenWithUmaAuthorization(String authzConfigFile) {
    AuthzClient authzClient = getAuthzClient(authzConfigFile);
    PermissionRequest request = new PermissionRequest("Resource A");
    String ticket = authzClient.protection().permission().create(request).getTicket();
    AuthorizationResponse response = authzClient.authorization("marta", "password").authorize(new AuthorizationRequest(ticket));
    assertNotNull(response.getToken());
}