Examples with ResourceServerRepresentation org.keycloak.representations.idm.authorization.ResourceServerRepresentation used on opensource projects

Example 21 with ResourceServerRepresentation

use of org.keycloak.representations.idm.authorization.ResourceServerRepresentation in project keycloak by keycloak.

the class PermissionsTest method clientAuthorization.

@Test
public void clientAuthorization() {
    ProfileAssume.assumeFeatureEnabled(Profile.Feature.AUTHORIZATION);
    ClientRepresentation newClient = new ClientRepresentation();
    newClient.setClientId("foo-authz");
    adminClient.realms().realm(REALM_NAME).clients().create(newClient);
    ClientRepresentation foo = adminClient.realms().realm(REALM_NAME).clients().findByClientId("foo-authz").get(0);
    invoke(new InvocationWithResponse() {

        public void invoke(RealmResource realm, AtomicReference<Response> response) {
            foo.setServiceAccountsEnabled(true);
            foo.setAuthorizationServicesEnabled(true);
            realm.clients().get(foo.getId()).update(foo);
        }
    }, CLIENT, true);
    invoke(new Invocation() {

        public void invoke(RealmResource realm) {
            realm.clients().get(foo.getId()).authorization().getSettings();
        }
    }, AUTHORIZATION, false);
    invoke(new Invocation() {

        public void invoke(RealmResource realm) {
            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
            ResourceServerRepresentation settings = authorization.getSettings();
            authorization.update(settings);
        }
    }, AUTHORIZATION, true);
    invoke(new Invocation() {

        public void invoke(RealmResource realm) {
            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
            authorization.resources().resources();
        }
    }, AUTHORIZATION, false);
    invoke(new Invocation() {

        public void invoke(RealmResource realm) {
            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
            authorization.scopes().scopes();
        }
    }, AUTHORIZATION, false);
    invoke(new Invocation() {

        public void invoke(RealmResource realm) {
            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
            authorization.policies().policies();
        }
    }, AUTHORIZATION, false);
    invoke(new InvocationWithResponse() {

        public void invoke(RealmResource realm, AtomicReference<Response> response) {
            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
            response.set(authorization.resources().create(new ResourceRepresentation("Test", Collections.emptySet())));
        }
    }, AUTHORIZATION, true);
    invoke(new InvocationWithResponse() {

        public void invoke(RealmResource realm, AtomicReference<Response> response) {
            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
            response.set(authorization.scopes().create(new ScopeRepresentation("Test")));
        }
    }, AUTHORIZATION, true);
    invoke(new InvocationWithResponse() {

        public void invoke(RealmResource realm, AtomicReference<Response> response) {
            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
            ResourcePermissionRepresentation representation = new ResourcePermissionRepresentation();
            representation.setName("Test PermissionsTest");
            representation.addResource("Default Resource");
            response.set(authorization.permissions().resource().create(representation));
        }
    }, AUTHORIZATION, true);
    invoke(new Invocation() {

        public void invoke(RealmResource realm) {
            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
            authorization.resources().resource("nosuch").update(new ResourceRepresentation());
        }
    }, AUTHORIZATION, true);
    invoke(new Invocation() {

        public void invoke(RealmResource realm) {
            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
            authorization.scopes().scope("nosuch").update(new ScopeRepresentation());
        }
    }, AUTHORIZATION, true);
    invoke(new Invocation() {

        public void invoke(RealmResource realm) {
            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
            authorization.policies().policy("nosuch").update(new PolicyRepresentation());
        }
    }, AUTHORIZATION, true);
    invoke(new Invocation() {

        public void invoke(RealmResource realm) {
            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
            authorization.resources().resource("nosuch").remove();
        }
    }, AUTHORIZATION, true);
    invoke(new Invocation() {

        public void invoke(RealmResource realm) {
            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
            authorization.scopes().scope("nosuch").remove();
        }
    }, AUTHORIZATION, true);
    invoke(new Invocation() {

        public void invoke(RealmResource realm) {
            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
            authorization.policies().policy("nosuch").remove();
        }
    }, AUTHORIZATION, true);
}

Example 22 with ResourceServerRepresentation

use of org.keycloak.representations.idm.authorization.ResourceServerRepresentation in project keycloak by keycloak.

the class RepresentationToModel method importAuthorizationSettings.

public static void importAuthorizationSettings(ClientRepresentation clientRepresentation, ClientModel client, KeycloakSession session) {
    if (Profile.isFeatureEnabled(Profile.Feature.AUTHORIZATION) && Boolean.TRUE.equals(clientRepresentation.getAuthorizationServicesEnabled())) {
        AuthorizationProviderFactory authorizationFactory = (AuthorizationProviderFactory) session.getKeycloakSessionFactory().getProviderFactory(AuthorizationProvider.class);
        AuthorizationProvider authorization = authorizationFactory.create(session, client.getRealm());
        client.setServiceAccountsEnabled(true);
        client.setBearerOnly(false);
        client.setPublicClient(false);
        ResourceServerRepresentation rep = clientRepresentation.getAuthorizationSettings();
        if (rep == null) {
            rep = new ResourceServerRepresentation();
        }
        rep.setClientId(client.getId());
        toModel(rep, authorization, client);
    }
}

Example 23 with ResourceServerRepresentation

use of org.keycloak.representations.idm.authorization.ResourceServerRepresentation in project keycloak by keycloak.

the class ImportAuthorizationSettingsTest method testImportUnorderedSettings.

@Test
public void testImportUnorderedSettings() throws Exception {
    ClientResource clientResource = getClientResource();
    ResourceServerRepresentation toImport = JsonSerialization.readValue(getClass().getResourceAsStream("/authorization-test/import-authorization-unordered-settings.json"), ResourceServerRepresentation.class);
    realmsResouce().realm(getRealmId()).roles().create(new RoleRepresentation("user", null, false));
    clientResource.roles().create(new RoleRepresentation("manage-albums", null, false));
    AuthorizationResource authorizationResource = clientResource.authorization();
    authorizationResource.importSettings(toImport);
    assertEquals(13, authorizationResource.policies().policies().size());
}

Example 24 with ResourceServerRepresentation

use of org.keycloak.representations.idm.authorization.ResourceServerRepresentation in project keycloak by keycloak.

the class EntitlementAPITest method testServerDecisionStrategy.

@Test
public void testServerDecisionStrategy() throws Exception {
    ClientResource client = getClient(getRealm(), RESOURCE_SERVER_TEST);
    AuthorizationResource authorization = client.authorization();
    ResourceRepresentation resource = new ResourceRepresentation();
    resource.setName(KeycloakModelUtils.generateId());
    resource.addScope("read", "write", "delete");
    try (Response response = authorization.resources().create(resource)) {
        resource = response.readEntity(ResourceRepresentation.class);
    }
    JSPolicyRepresentation grantPolicy = new JSPolicyRepresentation();
    grantPolicy.setName(KeycloakModelUtils.generateId());
    grantPolicy.setCode("$evaluation.grant();");
    authorization.policies().js().create(grantPolicy).close();
    JSPolicyRepresentation denyPolicy = new JSPolicyRepresentation();
    denyPolicy.setName(KeycloakModelUtils.generateId());
    denyPolicy.setCode("$evaluation.deny();");
    authorization.policies().js().create(denyPolicy).close();
    ResourcePermissionRepresentation resourcePermission = new ResourcePermissionRepresentation();
    resourcePermission.setName(KeycloakModelUtils.generateId());
    resourcePermission.addResource(resource.getId());
    resourcePermission.addPolicy(denyPolicy.getName());
    authorization.permissions().resource().create(resourcePermission).close();
    ScopePermissionRepresentation scopePermission1 = new ScopePermissionRepresentation();
    scopePermission1.setName(KeycloakModelUtils.generateId());
    scopePermission1.addScope("read");
    scopePermission1.addPolicy(grantPolicy.getName());
    ScopePermissionsResource scopePermissions = authorization.permissions().scope();
    scopePermissions.create(scopePermission1).close();
    String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken();
    AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
    AuthorizationRequest request = new AuthorizationRequest();
    request.addPermission(resource.getName());
    try {
        authzClient.authorization(accessToken).authorize(request);
        fail("kolo can not access the resource");
    } catch (RuntimeException expected) {
        assertEquals(403, HttpResponseException.class.cast(expected.getCause()).getStatusCode());
        assertTrue(HttpResponseException.class.cast(expected.getCause()).toString().contains("access_denied"));
    }
    ResourceServerRepresentation settings = authorization.getSettings();
    settings.setDecisionStrategy(DecisionStrategy.AFFIRMATIVE);
    authorization.update(settings);
    assertPermissions(authzClient, accessToken, request, resource, "read");
    scopePermission1 = scopePermissions.findByName(scopePermission1.getName());
    scopePermission1.addScope("read", "delete");
    scopePermissions.findById(scopePermission1.getId()).update(scopePermission1);
    assertPermissions(authzClient, accessToken, request, resource, "read", "delete");
    ScopePermissionRepresentation scopePermission2 = new ScopePermissionRepresentation();
    scopePermission2.setName(KeycloakModelUtils.generateId());
    scopePermission2.addScope("write");
    scopePermission2.addPolicy(grantPolicy.getName());
    scopePermissions.create(scopePermission2).close();
    assertPermissions(authzClient, accessToken, request, resource, "read", "delete", "write");
    ScopePermissionRepresentation scopePermission3 = new ScopePermissionRepresentation();
    scopePermission3.setName(KeycloakModelUtils.generateId());
    scopePermission3.addResource(resource.getId());
    scopePermission3.addScope("write", "read", "delete");
    scopePermission3.addPolicy(grantPolicy.getName());
    scopePermissions.create(scopePermission3).close();
    assertPermissions(authzClient, accessToken, request, resource, "read", "delete", "write");
    scopePermission2 = scopePermissions.findByName(scopePermission2.getName());
    scopePermissions.findById(scopePermission2.getId()).remove();
    assertPermissions(authzClient, accessToken, request, resource, "read", "delete", "write");
    scopePermission1 = scopePermissions.findByName(scopePermission1.getName());
    scopePermissions.findById(scopePermission1.getId()).remove();
    assertPermissions(authzClient, accessToken, request, resource, "read", "delete", "write");
    scopePermission3 = scopePermissions.findByName(scopePermission3.getName());
    scopePermission3.addScope("write", "delete");
    scopePermissions.findById(scopePermission3.getId()).update(scopePermission3);
    assertPermissions(authzClient, accessToken, request, resource, "delete", "write");
    scopePermissions.findById(scopePermission3.getId()).remove();
    try {
        authzClient.authorization(accessToken).authorize(request);
        fail("kolo can not access the resource");
    } catch (RuntimeException expected) {
        assertEquals(403, HttpResponseException.class.cast(expected.getCause()).getStatusCode());
        assertTrue(HttpResponseException.class.cast(expected.getCause()).toString().contains("access_denied"));
    }
    ResourcePermissionRepresentation grantResourcePermission = new ResourcePermissionRepresentation();
    grantResourcePermission.setName(KeycloakModelUtils.generateId());
    grantResourcePermission.addResource(resource.getId());
    grantResourcePermission.addPolicy(grantPolicy.getName());
    authorization.permissions().resource().create(grantResourcePermission).close();
    assertPermissions(authzClient, accessToken, request, resource, "read", "delete", "write");
    settings.setDecisionStrategy(DecisionStrategy.UNANIMOUS);
    authorization.update(settings);
    try {
        authzClient.authorization(accessToken).authorize(request);
        fail("kolo can not access the resource");
    } catch (RuntimeException expected) {
        assertEquals(403, HttpResponseException.class.cast(expected.getCause()).getStatusCode());
        assertTrue(HttpResponseException.class.cast(expected.getCause()).toString().contains("access_denied"));
    }
}

Example 25 with ResourceServerRepresentation

use of org.keycloak.representations.idm.authorization.ResourceServerRepresentation in project keycloak by keycloak.

the class AuthzClientCredentialsTest method beforeAbstractKeycloakTest.

@Before
@Override
public void beforeAbstractKeycloakTest() throws Exception {
    super.beforeAbstractKeycloakTest();
    testContext.getTestRealmReps().forEach(realmRepresentation -> {
        Keycloak adminClient = getAdminClient();
        ClientsResource clients = adminClient.realm(realmRepresentation.getRealm()).clients();
        ClientRepresentation client = clients.findByClientId("resource-server-test").get(0);
        client.setAuthorizationServicesEnabled(false);
        clients.get(client.getId()).update(client);
        client.setAuthorizationServicesEnabled(true);
        clients.get(client.getId()).update(client);
        AuthorizationResource authorization = clients.get(client.getId()).authorization();
        ResourceServerRepresentation settings = authorization.getSettings();
        settings.setAllowRemoteResourceManagement(true);
        authorization.update(settings);
    });
}