Examples with PermissionTicketRepresentation org.keycloak.representations.idm.authorization.PermissionTicketRepresentation used on opensource projects

Example 11 with PermissionTicketRepresentation

use of org.keycloak.representations.idm.authorization.PermissionTicketRepresentation in project keycloak by keycloak.

the class UserManagedPermissionServiceTest method testPermissionInAdditionToUserGrantedPermission.

@Test
public void testPermissionInAdditionToUserGrantedPermission() {
    ResourceRepresentation resource = new ResourceRepresentation();
    resource.setName("Resource A");
    resource.setOwnerManagedAccess(true);
    resource.setOwner("marta");
    resource.addScope("Scope A", "Scope B", "Scope C");
    resource = getAuthzClient().protection().resource().create(resource);
    PermissionResponse ticketResponse = getAuthzClient().protection().permission().create(new PermissionRequest(resource.getId(), "Scope A"));
    AuthorizationRequest request = new AuthorizationRequest();
    request.setTicket(ticketResponse.getTicket());
    try {
        getAuthzClient().authorization("kolo", "password").authorize(request);
        fail("User should not have permission");
    } catch (Exception e) {
        assertTrue(AuthorizationDeniedException.class.isInstance(e));
        assertTrue(e.getMessage().contains("request_submitted"));
    }
    List<PermissionTicketRepresentation> tickets = getAuthzClient().protection().permission().findByResource(resource.getId());
    assertEquals(1, tickets.size());
    PermissionTicketRepresentation ticket = tickets.get(0);
    ticket.setGranted(true);
    getAuthzClient().protection().permission().update(ticket);
    AuthorizationResponse authzResponse = getAuthzClient().authorization("kolo", "password").authorize(request);
    assertNotNull(authzResponse);
    UmaPermissionRepresentation permission = new UmaPermissionRepresentation();
    permission.setName("Custom User-Managed Permission");
    permission.addScope("Scope A");
    permission.addRole("role_a");
    ProtectionResource protection = getAuthzClient().protection("marta", "password");
    permission = protection.policy(resource.getId()).create(permission);
    getAuthzClient().authorization("kolo", "password").authorize(request);
    ticket.setGranted(false);
    getAuthzClient().protection().permission().update(ticket);
    getAuthzClient().authorization("kolo", "password").authorize(request);
    permission = getAuthzClient().protection("marta", "password").policy(resource.getId()).findById(permission.getId());
    assertNotNull(permission);
    permission.removeRole("role_a");
    permission.addRole("role_b");
    getAuthzClient().protection("marta", "password").policy(resource.getId()).update(permission);
    try {
        getAuthzClient().authorization("kolo", "password").authorize(request);
        fail("User should not have permission");
    } catch (Exception e) {
        assertTrue(AuthorizationDeniedException.class.isInstance(e));
    }
    request = new AuthorizationRequest();
    request.addPermission(resource.getId());
    try {
        getAuthzClient().authorization("kolo", "password").authorize(request);
        fail("User should not have permission");
    } catch (Exception e) {
        assertTrue(AuthorizationDeniedException.class.isInstance(e));
    }
    getAuthzClient().protection("marta", "password").policy(resource.getId()).delete(permission.getId());
    try {
        getAuthzClient().authorization("kolo", "password").authorize(request);
        fail("User should not have permission");
    } catch (Exception e) {
        assertTrue(AuthorizationDeniedException.class.isInstance(e));
    }
}

Example 12 with PermissionTicketRepresentation

use of org.keycloak.representations.idm.authorization.PermissionTicketRepresentation in project keycloak by keycloak.

the class ResourcesRestServiceTest method testGetPermissionRequests.

@Test
public void testGetPermissionRequests() {
    Resource resource = getMyResources().get(0);
    List<Permission> requests = doGet("/" + resource.getId() + "/permissions/requests", new TypeReference<List<Permission>>() {
    });
    assertTrue(requests.isEmpty());
    for (String userName : userNames) {
        List<String> scopes = new ArrayList<>();
        if ("bob".equals(userName)) {
            scopes.add("Scope D");
        } else if ("alice".equals(userName)) {
            scopes.add("Scope C");
        } else if ("jdoe".equals(userName)) {
            scopes.add("Scope C");
            scopes.add("Scope D");
        }
        for (String scope : scopes) {
            PermissionTicketRepresentation ticket = new PermissionTicketRepresentation();
            ticket.setGranted(false);
            ticket.setOwner("test-user@localhost");
            ticket.setRequesterName(userName);
            ticket.setResource(resource.getId());
            ticket.setScopeName(scope);
            authzClient.protection("test-user@localhost", "password").permission().create(ticket);
        }
    }
    requests = doGet("/" + resource.getId() + "/permissions/requests", new TypeReference<List<Permission>>() {
    });
    assertEquals(3, requests.size());
    Iterator<Permission> iterator = requests.iterator();
    while (iterator.hasNext()) {
        Permission permission = iterator.next();
        String username = permission.getUsername();
        List<String> scopes = permission.getScopes();
        if ("bob".equals(username)) {
            assertEquals(1, scopes.size());
            assertTrue(scopes.contains("Scope D"));
            iterator.remove();
        } else if ("alice".equals(username)) {
            assertEquals(1, scopes.size());
            assertTrue(scopes.contains("Scope C"));
            iterator.remove();
        } else if ("jdoe".equals(username)) {
            assertEquals(2, scopes.size());
            assertTrue(scopes.contains("Scope C"));
            assertTrue(scopes.contains("Scope D"));
            iterator.remove();
        }
    }
    assertTrue(requests.isEmpty());
}

Example 13 with PermissionTicketRepresentation

use of org.keycloak.representations.idm.authorization.PermissionTicketRepresentation in project keycloak by keycloak.

the class ResourcesRestServiceTest method before.

@Override
public void before() {
    super.before();
    ClientResource resourceServer = getResourceServer();
    authzClient = createAuthzClient(resourceServer.toRepresentation());
    AuthorizationResource authorization = resourceServer.authorization();
    for (int i = 0; i < 30; i++) {
        ResourceRepresentation resource = new ResourceRepresentation();
        resource.setOwnerManagedAccess(true);
        try {
            resource.setOwner(JsonSerialization.readValue(new JWSInput(tokenUtil.getToken()).getContent(), AccessToken.class).getSubject());
        } catch (Exception cause) {
            throw new RuntimeException("Failed to parse access token", cause);
        }
        resource.setName("Resource " + i);
        resource.setDisplayName("Display Name " + i);
        resource.setIconUri("Icon Uri " + i);
        resource.addScope("Scope A", "Scope B", "Scope C", "Scope D");
        resource.setUri("http://resourceServer.com/resources/" + i);
        try (Response response1 = authorization.resources().create(resource)) {
            resource.setId(response1.readEntity(ResourceRepresentation.class).getId());
            assertTrue(resource.getId() != null);
        }
        for (String scope : Arrays.asList("Scope A", "Scope B")) {
            PermissionTicketRepresentation ticket = new PermissionTicketRepresentation();
            ticket.setGranted(true);
            ticket.setOwner(resource.getOwner().getId());
            ticket.setRequesterName(userNames.get(i % userNames.size()));
            ticket.setResource(resource.getId());
            ticket.setScopeName(scope);
            authzClient.protection("test-user@localhost", "password").permission().create(ticket);
        }
    }
}

Example 14 with PermissionTicketRepresentation

use of org.keycloak.representations.idm.authorization.PermissionTicketRepresentation in project keycloak by keycloak.

the class ResourcesRestServiceTest method testApprovePermissionRequest.

@Test
public void testApprovePermissionRequest() throws IOException {
    Resource resource = getMyResources().get(0);
    List<Permission> requests = doGet("/" + resource.getId() + "/permissions/requests", new TypeReference<List<Permission>>() {
    });
    assertTrue(requests.isEmpty());
    for (String userName : userNames) {
        List<String> scopes = new ArrayList<>();
        if ("bob".equals(userName)) {
            scopes.add("Scope D");
        } else if ("alice".equals(userName)) {
            scopes.add("Scope C");
        } else if ("jdoe".equals(userName)) {
            scopes.add("Scope C");
            scopes.add("Scope D");
        }
        for (String scope : scopes) {
            PermissionTicketRepresentation ticket = new PermissionTicketRepresentation();
            ticket.setGranted(false);
            ticket.setOwner("test-user@localhost");
            ticket.setRequesterName(userName);
            ticket.setResource(resource.getId());
            ticket.setScopeName(scope);
            authzClient.protection("test-user@localhost", "password").permission().create(ticket);
        }
    }
    requests = doGet("/" + resource.getId() + "/permissions/requests", new TypeReference<List<Permission>>() {
    });
    assertEquals(3, requests.size());
    Iterator<Permission> iterator = requests.iterator();
    while (iterator.hasNext()) {
        Permission permission = iterator.next();
        String username = permission.getUsername();
        List<String> scopes = permission.getScopes();
        if ("bob".equals(username)) {
            scopes.clear();
        } else if ("jdoe".equals(username)) {
            scopes.remove("Scope C");
        }
    }
    SimpleHttp.doPut(getAccountUrl("resources/" + resource.getId() + "/permissions"), httpClient).auth(tokenUtil.getToken()).json(requests).asResponse();
    requests = doGet("/" + resource.getId() + "/permissions/requests", new TypeReference<List<Permission>>() {
    });
    assertTrue(requests.isEmpty());
    for (String user : Arrays.asList("alice", "jdoe")) {
        AbstractResourceService.ResourcePermission sharedResource = getSharedWithMe(user).stream().filter(resource1 -> resource1.getId().equals(resource.getId())).findAny().orElse(null);
        assertNotNull(sharedResource);
        Set<ScopeRepresentation> scopes = sharedResource.getScopes();
        if ("alice".equals(user)) {
            assertEquals(1, scopes.size());
            assertTrue(scopes.stream().anyMatch(scope -> "Scope C".equals(scope.getName())));
        } else if ("jdoe".equals(user)) {
            assertEquals(1, scopes.size());
            assertTrue(scopes.stream().anyMatch(scope -> "Scope D".equals(scope.getName())));
        }
    }
}