Examples with ResourcePermissionRepresentation org.keycloak.representations.idm.authorization.ResourcePermissionRepresentation used on opensource projects

Example 41 with ResourcePermissionRepresentation

use of org.keycloak.representations.idm.authorization.ResourcePermissionRepresentation in project keycloak by keycloak.

the class UserManagedAccessTest method testUserGrantsAccessToResource.

@Test
public void testUserGrantsAccessToResource() throws Exception {
    ResourcePermissionRepresentation permission = new ResourcePermissionRepresentation();
    resource = addResource("Resource A", "marta", true, "ScopeA", "ScopeB");
    permission.setName(resource.getName() + " Permission");
    permission.addResource(resource.getId());
    permission.addPolicy("Only Owner Policy");
    ClientResource client = getClient(getRealm());
    client.authorization().permissions().resource().create(permission).close();
    AuthorizationResponse response = authorize("marta", "password", "Resource A", new String[] { "ScopeA", "ScopeB" });
    String rpt = response.getToken();
    assertNotNull(rpt);
    assertFalse(response.isUpgraded());
    AccessToken accessToken = toAccessToken(rpt);
    AccessToken.Authorization authorization = accessToken.getAuthorization();
    assertNotNull(authorization);
    Collection<Permission> permissions = authorization.getPermissions();
    assertNotNull(permissions);
    assertPermissions(permissions, "Resource A", "ScopeA", "ScopeB");
    assertTrue(permissions.isEmpty());
    getTestContext().getTestingClient().testing().clearEventQueue();
    try {
        response = authorize("kolo", "password", resource.getId(), new String[] {});
        fail("User should not have access to resource from another user");
    } catch (AuthorizationDeniedException ade) {
    }
    String realmId = getRealm().toRepresentation().getId();
    String clientId = client.toRepresentation().getClientId();
    events.expectLogin().realm(realmId).client(clientId).user(isUUID()).clearDetails().assertEvent();
    events.expectLogin().realm(realmId).client(clientId).user(isUUID()).clearDetails().assertEvent();
    events.expect(EventType.PERMISSION_TOKEN_ERROR).realm(realmId).client(clientId).user(isUUID()).session((String) null).error("access_denied").detail("reason", "request_submitted").assertEvent();
    PermissionResource permissionResource = getAuthzClient().protection().permission();
    List<PermissionTicketRepresentation> permissionTickets = permissionResource.findByResource(resource.getId());
    assertFalse(permissionTickets.isEmpty());
    assertEquals(2, permissionTickets.size());
    for (PermissionTicketRepresentation ticket : permissionTickets) {
        assertFalse(ticket.isGranted());
        ticket.setGranted(true);
        permissionResource.update(ticket);
    }
    permissionTickets = permissionResource.findByResource(resource.getId());
    assertFalse(permissionTickets.isEmpty());
    assertEquals(2, permissionTickets.size());
    for (PermissionTicketRepresentation ticket : permissionTickets) {
        assertTrue(ticket.isGranted());
    }
    getTestContext().getTestingClient().testing().clearEventQueue();
    response = authorize("kolo", "password", resource.getId(), new String[] { "ScopeA", "ScopeB" });
    rpt = response.getToken();
    assertNotNull(rpt);
    assertFalse(response.isUpgraded());
    accessToken = toAccessToken(rpt);
    authorization = accessToken.getAuthorization();
    assertNotNull(authorization);
    permissions = authorization.getPermissions();
    assertNotNull(permissions);
    assertPermissions(permissions, resource.getName(), "ScopeA", "ScopeB");
    assertTrue(permissions.isEmpty());
    events.expectLogin().realm(realmId).client(clientId).user(isUUID()).clearDetails().assertEvent();
    events.expectLogin().realm(realmId).client(clientId).user(isUUID()).clearDetails().assertEvent();
    events.expect(EventType.PERMISSION_TOKEN).realm(realmId).client(clientId).user(isUUID()).session((String) null).clearDetails().assertEvent();
}

Example 42 with ResourcePermissionRepresentation

use of org.keycloak.representations.idm.authorization.ResourcePermissionRepresentation in project keycloak by keycloak.

the class ServletAuthzCacheDisabledAdapterTest method testCreateNewResource.

@Test
public void testCreateNewResource() {
    performTests(() -> {
        login("alice", "alice");
        assertWasNotDenied();
        this.driver.navigate().to(getResourceServerUrl() + "/new-resource");
        assertWasNotDenied();
        ResourceRepresentation resource = new ResourceRepresentation();
        resource.setName("New Resource");
        resource.setUri("/new-resource");
        getAuthorizationResource().resources().create(resource);
        ResourcePermissionRepresentation permission = new ResourcePermissionRepresentation();
        permission.setName(resource.getName() + " Permission");
        permission.addResource(resource.getName());
        permission.addPolicy("Deny Policy");
        permission = getAuthorizationResource().permissions().resource().create(permission).readEntity(ResourcePermissionRepresentation.class);
        login("alice", "alice");
        assertWasNotDenied();
        this.driver.navigate().to(getResourceServerUrl() + "/new-resource");
        assertWasDenied();
        permission = getAuthorizationResource().permissions().resource().findById(permission.getId()).toRepresentation();
        permission.removePolicy("Deny Policy");
        permission.addPolicy("Any User Policy");
        getAuthorizationResource().permissions().resource().findById(permission.getId()).update(permission);
        login("alice", "alice");
        assertWasNotDenied();
        this.driver.navigate().to(getResourceServerUrl() + "/new-resource");
        assertWasNotDenied();
    });
}

Example 43 with ResourcePermissionRepresentation

use of org.keycloak.representations.idm.authorization.ResourcePermissionRepresentation in project keycloak by keycloak.

the class AbstractServletPolicyEnforcerTest method createResourcePermission.

private void createResourcePermission(String name, String resourceName, String... policyNames) {
    ResourcePermissionRepresentation permission = new ResourcePermissionRepresentation();
    permission.setName(name);
    permission.addResource(resourceName);
    permission.addPolicy(policyNames);
    getAuthorizationResource().permissions().resource().create(permission);
}

Example 44 with ResourcePermissionRepresentation

use of org.keycloak.representations.idm.authorization.ResourcePermissionRepresentation in project keycloak by keycloak.

the class AbstractServletPolicyEnforcerTest method updatePermissionPolicies.

private void updatePermissionPolicies(String permissionName, String... policyNames) {
    ResourcePermissionsResource permissions = getAuthorizationResource().permissions().resource();
    ResourcePermissionRepresentation permission = permissions.findByName(permissionName);
    permission.addPolicy(policyNames);
    permissions.findById(permission.getId()).update(permission);
}

Example 45 with ResourcePermissionRepresentation

use of org.keycloak.representations.idm.authorization.ResourcePermissionRepresentation in project keycloak by keycloak.

the class ResourceServerService method createDefaultPermission.

private void createDefaultPermission(ResourceRepresentation resource, PolicyRepresentation policy) {
    ResourcePermissionRepresentation defaultPermission = new ResourcePermissionRepresentation();
    defaultPermission.setName("Default Permission");
    defaultPermission.setDescription("A permission that applies to the default resource type");
    defaultPermission.setDecisionStrategy(DecisionStrategy.UNANIMOUS);
    defaultPermission.setLogic(Logic.POSITIVE);
    defaultPermission.setResourceType(resource.getType());
    defaultPermission.addPolicy(policy.getName());
    getPolicyResource().create(defaultPermission);
}