Examples with PolicyRepresentation org.keycloak.representations.idm.authorization.PolicyRepresentation used on opensource projects

Example 16 with PolicyRepresentation

use of org.keycloak.representations.idm.authorization.PolicyRepresentation in project keycloak by keycloak.

the class AbstractPhotozExampleAdapterTest method testPathConfigInvalidation.

@Test
public void testPathConfigInvalidation() throws Exception {
    loginToClientPage(aliceUser);
    clientPage.createAlbum(ALICE_ALBUM_NAME);
    loginToClientPage(adminUser);
    clientPage.navigateToAdminAlbum(this::assertWasNotDenied);
    log.debug("Check if alice has resources stored");
    assertThat(getResourcesOfUser("alice"), is(not(empty())));
    log.debug("Adding applyPolicies \"Only Owner Policy\" to \"Delete Album Permission\" policies.");
    for (PolicyRepresentation policy : getAuthorizationResource().policies().policies()) {
        if ("Delete Album Permission".equals(policy.getName())) {
            policy.getConfig().put("applyPolicies", "[\"Only Owner Policy\"]");
            getAuthorizationResource().policies().policy(policy.getId()).update(policy);
        }
    }
    printUpdatedPolicies();
    loginToClientPage(adminUser);
    clientPage.navigateToAdminAlbum(this::assertWasNotDenied);
    clientPage.deleteAlbum(ALICE_ALBUM_NAME, this::assertWasDenied);
    log.debug("Check if alice has resources stored");
    assertThat(getResourcesOfUser("alice"), is(not(empty())));
    log.debug("Adding applyPolicies \"Only Owner and Administrators Policy\" to \"Delete Album Permission\" policies.");
    for (PolicyRepresentation policy : getAuthorizationResource().policies().policies()) {
        if ("Delete Album Permission".equals(policy.getName())) {
            policy.getConfig().put("applyPolicies", "[\"Only Owner and Administrators Policy\"]");
            getAuthorizationResource().policies().policy(policy.getId()).update(policy);
        }
    }
    printUpdatedPolicies();
    clientPage.navigateToAdminAlbum(this::assertWasNotDenied);
    clientPage.deleteAlbum(ALICE_ALBUM_NAME, this::assertWasNotDenied);
    log.debug("Check if alice has resources deleted");
    assertThat(getResourcesOfUser("alice"), is(empty()));
}

Example 17 with PolicyRepresentation

use of org.keycloak.representations.idm.authorization.PolicyRepresentation in project keycloak by keycloak.

the class AbstractPhotozExampleAdapterTest method testAdminWithoutPermissionsToDeleteAlbum.

@Test
public void testAdminWithoutPermissionsToDeleteAlbum() throws Exception {
    loginToClientPage(aliceUser);
    clientPage.createAlbum(ALICE_ALBUM_NAME);
    loginToClientPage(adminUser);
    clientPage.navigateToAdminAlbum(this::assertWasNotDenied);
    clientPage.viewAlbum(ALICE_ALBUM_NAME, this::assertWasNotDenied);
    clientPage.deleteAlbum(ALICE_ALBUM_NAME, this::assertWasNotDenied);
    assertThat(getResourcesOfUser("alice"), is(empty()));
    PoliciesResource policiesResource = getAuthorizationResource().policies();
    List<PolicyRepresentation> policies = policiesResource.policies();
    for (PolicyRepresentation policy : policies) {
        if ("Delete Album Permission".equals(policy.getName())) {
            policy.getConfig().put("applyPolicies", "[\"Only Owner Policy\"]");
            policiesResource.policy(policy.getId()).update(policy);
        }
    }
    printUpdatedPolicies();
    loginToClientPage(aliceUser);
    clientPage.createAlbum(ALICE_ALBUM_NAME);
    loginToClientPage(adminUser);
    clientPage.viewAlbum(ALICE_ALBUM_NAME, this::assertWasNotDenied);
    assertThat(getResourcesOfUser("alice"), is(not(empty())));
    clientPage.deleteAlbum(ALICE_ALBUM_NAME, this::assertWasDenied);
    for (PolicyRepresentation policy : policies) {
        if ("Delete Album Permission".equals(policy.getName())) {
            policy.getConfig().put("applyPolicies", "[\"Only Owner and Administrators Policy\"]");
            policiesResource.policy(policy.getId()).update(policy);
        }
    }
    printUpdatedPolicies();
    // Clear cache
    loginToClientPage(adminUser);
    clientPage.deleteAlbum(ALICE_ALBUM_NAME, this::assertWasNotDenied);
    assertThat(getResourcesOfUser("alice"), is(empty()));
}

Example 18 with PolicyRepresentation

use of org.keycloak.representations.idm.authorization.PolicyRepresentation in project keycloak by keycloak.

the class AbstractPhotozExampleAdapterTest method testAdminOnlyFromSpecificAddress.

@Test
public void testAdminOnlyFromSpecificAddress() throws Exception {
    loginToClientPage(adminUser);
    clientPage.navigateToAdminAlbum(this::assertWasNotDenied);
    log.debug("Changing codes \"127.0.0.1\" to \"127.3.3.3\" of \"Only From a Specific Client Address\" policies.");
    for (PolicyRepresentation policy : getAuthorizationResource().policies().policies()) {
        if ("Only From a Specific Client Address".equals(policy.getName())) {
            String code = policy.getConfig().get("code").replaceAll("127.0.0.1", "127.3.3.3").replaceAll("0:0:0:0:0:0:0:1", "0:0:0:0:0:ffff:7f03:303");
            policy.getConfig().put("code", code);
            getAuthorizationResource().policies().policy(policy.getId()).update(policy);
        }
    }
    printUpdatedPolicies();
    loginToClientPage(adminUser);
    clientPage.navigateToAdminAlbum(this::assertWasDenied);
}

Example 19 with PolicyRepresentation

use of org.keycloak.representations.idm.authorization.PolicyRepresentation in project keycloak by keycloak.

the class AbstractPhotozExampleAdapterTest method testClientRoleNotRequired.

@Test
public void testClientRoleNotRequired() throws Exception {
    loginToClientPage(aliceUser);
    clientPage.createAlbum(ALICE_ALBUM_NAME);
    clientPage.viewAlbum(ALICE_ALBUM_NAME, this::assertWasNotDenied);
    UsersResource usersResource = realmsResouce().realm(REALM_NAME).users();
    List<UserRepresentation> users = usersResource.search("alice", null, null, null, null, null);
    assertFalse(users.isEmpty());
    UserRepresentation userRepresentation = users.get(0);
    UserResource userResource = usersResource.get(userRepresentation.getId());
    ClientResource html5ClientApp = getClientResource("photoz-html5-client");
    userResource.revokeConsent(html5ClientApp.toRepresentation().getClientId());
    ClientResource resourceServerClient = getClientResource(RESOURCE_SERVER_ID);
    RoleResource manageAlbumRole = resourceServerClient.roles().get("manage-albums");
    RoleRepresentation roleRepresentation = manageAlbumRole.toRepresentation();
    setManageAlbumScopeRequired();
    manageAlbumRole.update(roleRepresentation);
    loginToClientPage(aliceUser);
    clientPage.viewAlbum(ALICE_ALBUM_NAME, this::assertWasDenied);
    for (PolicyRepresentation policy : getAuthorizationResource().policies().policies()) {
        if ("Any User Policy".equals(policy.getName())) {
            List<Map<String, Object>> roles = JsonSerialization.readValue(policy.getConfig().get("roles"), List.class);
            roles.forEach(role -> {
                String roleId = (String) role.get("id");
                if (roleId.equals(manageAlbumRole.toRepresentation().getId())) {
                    role.put("required", false);
                }
            });
            policy.getConfig().put("roles", JsonSerialization.writeValueAsString(roles));
            getAuthorizationResource().policies().policy(policy.getId()).update(policy);
        }
    }
    printUpdatedPolicies();
    loginToClientPage(aliceUser);
    clientPage.viewAlbum(ALICE_ALBUM_NAME, this::assertWasNotDenied);
}

Example 20 with PolicyRepresentation

use of org.keycloak.representations.idm.authorization.PolicyRepresentation in project keycloak by keycloak.

the class ConflictingScopePermissionTest method createUserPolicy.

private void createUserPolicy(String name, RealmResource realm, ClientResource client, String username) throws IOException {
    String userId = realm.users().search(username).stream().map(representation -> representation.getId()).findFirst().orElseThrow(() -> new RuntimeException("Expected user [userId]"));
    PolicyRepresentation representation = new PolicyRepresentation();
    representation.setName(name);
    representation.setType("user");
    Map<String, String> config = new HashMap<>();
    config.put("users", JsonSerialization.writeValueAsString(new String[] { userId }));
    representation.setConfig(config);
    client.authorization().policies().create(representation).close();
}