Examples with PermissionRequest org.keycloak.representations.idm.authorization.PermissionRequest used on opensource projects

Example 31 with PermissionRequest

use of org.keycloak.representations.idm.authorization.PermissionRequest in project keycloak by keycloak.

the class AuthzClientCredentialsTest method testSuccessfulAuthorizationRequest.

@Test
public void testSuccessfulAuthorizationRequest() throws Exception {
    AuthzClient authzClient = getAuthzClient("keycloak-with-jwt-authentication.json");
    ProtectionResource protection = authzClient.protection();
    PermissionRequest request = new PermissionRequest("Default Resource");
    PermissionResponse ticketResponse = protection.permission().create(request);
    String ticket = ticketResponse.getTicket();
    AuthorizationResponse authorizationResponse = authzClient.authorization("marta", "password").authorize(new AuthorizationRequest(ticket));
    String rpt = authorizationResponse.getToken();
    assertNotNull(rpt);
    AccessToken accessToken = new JWSInput(rpt).readJsonContent(AccessToken.class);
    AccessToken.Authorization authorization = accessToken.getAuthorization();
    assertNotNull(authorization);
    List<Permission> permissions = new ArrayList<>(authorization.getPermissions());
    assertFalse(permissions.isEmpty());
    assertEquals("Default Resource", permissions.get(0).getResourceName());
}

Example 32 with PermissionRequest

use of org.keycloak.representations.idm.authorization.PermissionRequest in project keycloak by keycloak.

the class AbstractPermissionService method verifyRequestedResource.

private List<Permission> verifyRequestedResource(List<PermissionRequest> request) {
    ResourceStore resourceStore = authorization.getStoreFactory().getResourceStore();
    List<Permission> requestedResources = new ArrayList<>();
    for (PermissionRequest permissionRequest : request) {
        String resourceSetId = permissionRequest.getResourceId();
        List<Resource> resources = new ArrayList<>();
        if (resourceSetId == null) {
            if (permissionRequest.getScopes() == null || permissionRequest.getScopes().isEmpty()) {
                throw new ErrorResponseException("invalid_resource_id", "Resource id or name not provided.", Response.Status.BAD_REQUEST);
            }
        } else {
            Resource resource = resourceStore.findById(resourceSetId, resourceServer.getId());
            if (resource != null) {
                resources.add(resource);
            } else {
                Resource userResource = resourceStore.findByName(resourceSetId, identity.getId(), this.resourceServer.getId());
                if (userResource != null) {
                    resources.add(userResource);
                }
                if (!identity.isResourceServer()) {
                    Resource serverResource = resourceStore.findByName(resourceSetId, this.resourceServer.getId());
                    if (serverResource != null) {
                        resources.add(serverResource);
                    }
                }
            }
            if (resources.isEmpty()) {
                throw new ErrorResponseException("invalid_resource_id", "Resource set with id [" + resourceSetId + "] does not exists in this server.", Response.Status.BAD_REQUEST);
            }
        }
        if (resources.isEmpty()) {
            requestedResources.add(new Permission(null, verifyRequestedScopes(permissionRequest, null)));
        } else {
            for (Resource resource : resources) {
                requestedResources.add(new Permission(resource.getId(), verifyRequestedScopes(permissionRequest, resource)));
            }
        }
    }
    return requestedResources;
}

Example 33 with PermissionRequest

use of org.keycloak.representations.idm.authorization.PermissionRequest in project keycloak by keycloak.

the class RegexPolicyTest method testWithoutExpectedUserAttribute.

@Test
public void testWithoutExpectedUserAttribute() {
    // Access Resource A with taro.
    AuthzClient authzClient = getAuthzClient();
    PermissionRequest request = new PermissionRequest("Resource A");
    String ticket = authzClient.protection().permission().create(request).getTicket();
    try {
        authzClient.authorization("taro", "password").authorize(new AuthorizationRequest(ticket));
        fail("Should fail.");
    } catch (AuthorizationDeniedException ignore) {
    }
    // Access Resource B with taro.
    request = new PermissionRequest("Resource B");
    ticket = authzClient.protection().permission().create(request).getTicket();
    try {
        authzClient.authorization("taro", "password").authorize(new AuthorizationRequest(ticket));
        fail("Should fail.");
    } catch (AuthorizationDeniedException ignore) {
    }
}

Example 34 with PermissionRequest

use of org.keycloak.representations.idm.authorization.PermissionRequest in project keycloak by keycloak.

the class PermissionClaimTest method testPermissionWithClaimsDifferentPolicies.

@Test
public void testPermissionWithClaimsDifferentPolicies() throws Exception {
    ClientResource client = getClient(getRealm());
    AuthorizationResource authorization = client.authorization();
    ResourceRepresentation resource = new ResourceRepresentation("Resource B");
    authorization.resources().create(resource).close();
    ResourcePermissionRepresentation permission = new ResourcePermissionRepresentation();
    permission.setName(resource.getName() + " Permission");
    permission.addResource(resource.getName());
    permission.addPolicy(claimAPolicy.getName(), claimBPolicy.getName());
    authorization.permissions().resource().create(permission).close();
    PermissionRequest request = new PermissionRequest();
    request.setResourceId(resource.getName());
    String accessToken = new OAuthClient().realm("authz-test").clientId("test-client").doGrantAccessTokenRequest("secret", "marta", "password").getAccessToken();
    AuthzClient authzClient = getAuthzClient();
    String ticket = authzClient.protection().permission().forResource(request).getTicket();
    AuthorizationResponse response = authzClient.authorization(accessToken).authorize(new AuthorizationRequest(ticket));
    assertNotNull(response.getToken());
    AccessToken rpt = toAccessToken(response.getToken());
    Authorization authorizationClaim = rpt.getAuthorization();
    List<Permission> permissions = new ArrayList<>(authorizationClaim.getPermissions());
    assertEquals(1, permissions.size());
    Map<String, Set<String>> claims = permissions.get(0).getClaims();
    assertTrue(claims.containsKey("claim-a"));
    assertTrue(claims.containsKey("claim-b"));
}

Example 35 with PermissionRequest

use of org.keycloak.representations.idm.authorization.PermissionRequest in project keycloak by keycloak.

the class PermissionClaimTest method testPermissionWithClaims.

@Test
public void testPermissionWithClaims() throws Exception {
    ClientResource client = getClient(getRealm());
    AuthorizationResource authorization = client.authorization();
    ResourceRepresentation resource = new ResourceRepresentation("Resource A");
    authorization.resources().create(resource).close();
    ResourcePermissionRepresentation permission = new ResourcePermissionRepresentation();
    permission.setName(resource.getName() + " Permission");
    permission.addResource(resource.getName());
    permission.addPolicy(claimAPolicy.getName());
    authorization.permissions().resource().create(permission).close();
    PermissionRequest request = new PermissionRequest();
    request.setResourceId(resource.getName());
    String accessToken = new OAuthClient().realm("authz-test").clientId("test-client").doGrantAccessTokenRequest("secret", "marta", "password").getAccessToken();
    AuthzClient authzClient = getAuthzClient();
    String ticket = authzClient.protection().permission().create(request).getTicket();
    AuthorizationResponse response = authzClient.authorization(accessToken).authorize(new AuthorizationRequest(ticket));
    assertNotNull(response.getToken());
    AccessToken rpt = toAccessToken(response.getToken());
    Authorization authorizationClaim = rpt.getAuthorization();
    List<Permission> permissions = new ArrayList<>(authorizationClaim.getPermissions());
    assertEquals(1, permissions.size());
    assertTrue(permissions.get(0).getClaims().get("claim-a").containsAll(Arrays.asList("claim-a", "claim-a1")));
}