Examples with UserPolicyRepresentation org.keycloak.representations.idm.authorization.UserPolicyRepresentation used on opensource projects

Example 6 with UserPolicyRepresentation

use of org.keycloak.representations.idm.authorization.UserPolicyRepresentation in project keycloak by keycloak.

the class AbstractBaseServletAuthzAdapterTest method createUserPolicy.

protected void createUserPolicy(String name, String... userNames) {
    UserPolicyRepresentation policy = new UserPolicyRepresentation();
    policy.setName(name);
    for (String userName : userNames) {
        policy.addUser(userName);
    }
    assertFalse(policy.getUsers().isEmpty());
    Response response = getAuthorizationResource().policies().user().create(policy);
    response.close();
}

Example 7 with UserPolicyRepresentation

use of org.keycloak.representations.idm.authorization.UserPolicyRepresentation in project keycloak by keycloak.

the class EntitlementAPITest method testOverrideParentScopePermission.

@Test
public void testOverrideParentScopePermission() throws Exception {
    ClientResource client = getClient(getRealm(), RESOURCE_SERVER_TEST);
    AuthorizationResource authorization = client.authorization();
    JSPolicyRepresentation onlyOwnerPolicy = createOnlyOwnerPolicy();
    authorization.policies().js().create(onlyOwnerPolicy).close();
    ResourceRepresentation typedResource = new ResourceRepresentation();
    typedResource.setType("resource");
    typedResource.setName(KeycloakModelUtils.generateId());
    typedResource.addScope("read", "update");
    try (Response response = authorization.resources().create(typedResource)) {
        typedResource = response.readEntity(ResourceRepresentation.class);
    }
    ScopePermissionRepresentation typedResourcePermission = new ScopePermissionRepresentation();
    typedResourcePermission.setName(KeycloakModelUtils.generateId());
    typedResourcePermission.addResource(typedResource.getName());
    typedResourcePermission.addPolicy(onlyOwnerPolicy.getName());
    typedResourcePermission.addScope("read", "update");
    authorization.permissions().scope().create(typedResourcePermission).close();
    ResourceRepresentation martaResource = new ResourceRepresentation();
    martaResource.setType("resource");
    martaResource.setName(KeycloakModelUtils.generateId());
    martaResource.addScope("read");
    martaResource.setOwner("marta");
    try (Response response = authorization.resources().create(martaResource)) {
        martaResource = response.readEntity(ResourceRepresentation.class);
    }
    String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "marta", "password").getAccessToken();
    AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
    AuthorizationRequest request = new AuthorizationRequest();
    request.addPermission(martaResource.getName());
    // marta can access her resource
    AuthorizationResponse response = authzClient.authorization(accessToken).authorize(request);
    assertNotNull(response.getToken());
    Collection<Permission> permissions = toAccessToken(response.getToken()).getAuthorization().getPermissions();
    assertEquals(1, permissions.size());
    for (Permission grantedPermission : permissions) {
        assertEquals(martaResource.getName(), grantedPermission.getResourceName());
        Set<String> scopes = grantedPermission.getScopes();
        assertEquals(2, scopes.size());
        assertThat(scopes, Matchers.containsInAnyOrder("read", "update"));
    }
    accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken();
    authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
    request = new AuthorizationRequest();
    request.addPermission(martaResource.getId());
    try {
        authzClient.authorization(accessToken).authorize(request);
        fail("kolo can not access marta resource");
    } catch (RuntimeException expected) {
        assertEquals(403, HttpResponseException.class.cast(expected.getCause()).getStatusCode());
        assertTrue(HttpResponseException.class.cast(expected.getCause()).toString().contains("access_denied"));
    }
    UserPolicyRepresentation onlyKoloPolicy = new UserPolicyRepresentation();
    onlyKoloPolicy.setName(KeycloakModelUtils.generateId());
    onlyKoloPolicy.addUser("kolo");
    authorization.policies().user().create(onlyKoloPolicy).close();
    ResourcePermissionRepresentation martaResourcePermission = new ResourcePermissionRepresentation();
    martaResourcePermission.setName(KeycloakModelUtils.generateId());
    martaResourcePermission.addResource(martaResource.getId());
    martaResourcePermission.addPolicy(onlyKoloPolicy.getName());
    try (Response response1 = authorization.permissions().resource().create(martaResourcePermission)) {
        martaResourcePermission = response1.readEntity(ResourcePermissionRepresentation.class);
    }
    response = authzClient.authorization(accessToken).authorize(request);
    assertNotNull(response.getToken());
    permissions = toAccessToken(response.getToken()).getAuthorization().getPermissions();
    assertEquals(1, permissions.size());
    for (Permission grantedPermission : permissions) {
        assertEquals(martaResource.getName(), grantedPermission.getResourceName());
        Set<String> scopes = grantedPermission.getScopes();
        assertEquals(2, scopes.size());
        assertThat(scopes, Matchers.containsInAnyOrder("read", "update"));
    }
    ScopePermissionRepresentation martaResourceUpdatePermission = new ScopePermissionRepresentation();
    martaResourceUpdatePermission.setName(KeycloakModelUtils.generateId());
    martaResourceUpdatePermission.addResource(martaResource.getId());
    martaResourceUpdatePermission.addScope("update");
    martaResourceUpdatePermission.addPolicy(onlyOwnerPolicy.getName());
    try (Response response1 = authorization.permissions().scope().create(martaResourceUpdatePermission)) {
        martaResourceUpdatePermission = response1.readEntity(ScopePermissionRepresentation.class);
    }
    // now kolo can only read, but not update
    response = authzClient.authorization(accessToken).authorize(request);
    assertNotNull(response.getToken());
    permissions = toAccessToken(response.getToken()).getAuthorization().getPermissions();
    assertEquals(1, permissions.size());
    for (Permission grantedPermission : permissions) {
        assertEquals(martaResource.getName(), grantedPermission.getResourceName());
        Set<String> scopes = grantedPermission.getScopes();
        assertEquals(1, scopes.size());
        assertThat(scopes, Matchers.containsInAnyOrder("read"));
    }
    authorization.permissions().resource().findById(martaResourcePermission.getId()).remove();
    try {
        // after removing permission to marta resource, kolo can not access any scope in the resource
        authzClient.authorization(accessToken).authorize(request);
        fail("kolo can not access marta resource");
    } catch (RuntimeException expected) {
        assertEquals(403, HttpResponseException.class.cast(expected.getCause()).getStatusCode());
        assertTrue(HttpResponseException.class.cast(expected.getCause()).toString().contains("access_denied"));
    }
    martaResourceUpdatePermission.addPolicy(onlyKoloPolicy.getName());
    martaResourceUpdatePermission.setDecisionStrategy(DecisionStrategy.AFFIRMATIVE);
    authorization.permissions().scope().findById(martaResourceUpdatePermission.getId()).update(martaResourceUpdatePermission);
    // now kolo can access because update permission changed to allow him to access the resource using an affirmative strategy
    response = authzClient.authorization(accessToken).authorize(request);
    assertNotNull(response.getToken());
    permissions = toAccessToken(response.getToken()).getAuthorization().getPermissions();
    assertEquals(1, permissions.size());
    for (Permission grantedPermission : permissions) {
        assertEquals(martaResource.getName(), grantedPermission.getResourceName());
        Set<String> scopes = grantedPermission.getScopes();
        assertEquals(1, scopes.size());
        assertThat(scopes, Matchers.containsInAnyOrder("update"));
    }
    accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "marta", "password").getAccessToken();
    // marta can still access her resource
    response = authzClient.authorization(accessToken).authorize(request);
    assertNotNull(response.getToken());
    permissions = toAccessToken(response.getToken()).getAuthorization().getPermissions();
    assertEquals(1, permissions.size());
    for (Permission grantedPermission : permissions) {
        assertEquals(martaResource.getName(), grantedPermission.getResourceName());
        Set<String> scopes = grantedPermission.getScopes();
        assertEquals(2, scopes.size());
        assertThat(scopes, Matchers.containsInAnyOrder("update", "read"));
    }
    authorization.permissions().scope().findById(martaResourceUpdatePermission.getId()).remove();
    accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken();
    try {
        // back to original setup, permissions not granted by the type resource
        authzClient.authorization(accessToken).authorize(request);
        fail("kolo can not access marta resource");
    } catch (RuntimeException expected) {
        assertEquals(403, HttpResponseException.class.cast(expected.getCause()).getStatusCode());
        assertTrue(HttpResponseException.class.cast(expected.getCause()).toString().contains("access_denied"));
    }
}

Example 8 with UserPolicyRepresentation

use of org.keycloak.representations.idm.authorization.UserPolicyRepresentation in project keycloak by keycloak.

the class UserPolicyManagementTest method testCreate.

@Test
public void testCreate() {
    AuthorizationResource authorization = getClient().authorization();
    UserPolicyRepresentation representation = new UserPolicyRepresentation();
    representation.setName("Realm User Policy");
    representation.setDescription("description");
    representation.setDecisionStrategy(DecisionStrategy.CONSENSUS);
    representation.setLogic(Logic.NEGATIVE);
    representation.addUser("User A");
    representation.addUser("User B");
    assertCreated(authorization, representation);
}

Example 9 with UserPolicyRepresentation

use of org.keycloak.representations.idm.authorization.UserPolicyRepresentation in project keycloak by keycloak.

the class FineGrainAdminUnitTest method setupUsers.

public static void setupUsers(KeycloakSession session) {
    RealmModel realm = session.realms().getRealmByName(TEST);
    ClientModel client = realm.getClientByClientId(CLIENT_NAME);
    RoleModel realmRole = realm.getRole("realm-role");
    RoleModel realmRole2 = realm.getRole("realm-role2");
    RoleModel clientRole = client.getRole("client-role");
    RoleModel mapperRole = realm.getRole("mapper");
    RoleModel managerRole = realm.getRole("manager");
    RoleModel compositeRole = realm.getRole("composite-role");
    ClientModel realmManagementClient = realm.getClientByClientId("realm-management");
    RoleModel adminRole = realmManagementClient.getRole(AdminRoles.REALM_ADMIN);
    RoleModel queryGroupsRole = realmManagementClient.getRole(AdminRoles.QUERY_GROUPS);
    RoleModel queryUsersRole = realmManagementClient.getRole(AdminRoles.QUERY_USERS);
    RoleModel queryClientsRole = realmManagementClient.getRole(AdminRoles.QUERY_CLIENTS);
    UserModel nomapAdmin = session.users().addUser(realm, "nomap-admin");
    nomapAdmin.setEnabled(true);
    session.userCredentialManager().updateCredential(realm, nomapAdmin, UserCredentialModel.password("password"));
    nomapAdmin.grantRole(adminRole);
    UserModel anotherAdmin = session.users().addUser(realm, "anotherAdmin");
    anotherAdmin.setEnabled(true);
    session.userCredentialManager().updateCredential(realm, anotherAdmin, UserCredentialModel.password("password"));
    anotherAdmin.grantRole(adminRole);
    UserModel authorizedUser = session.users().addUser(realm, "authorized");
    authorizedUser.setEnabled(true);
    session.userCredentialManager().updateCredential(realm, authorizedUser, UserCredentialModel.password("password"));
    authorizedUser.grantRole(mapperRole);
    authorizedUser.grantRole(managerRole);
    UserModel authorizedComposite = session.users().addUser(realm, "authorizedComposite");
    authorizedComposite.setEnabled(true);
    session.userCredentialManager().updateCredential(realm, authorizedComposite, UserCredentialModel.password("password"));
    authorizedComposite.grantRole(compositeRole);
    UserModel unauthorizedUser = session.users().addUser(realm, "unauthorized");
    unauthorizedUser.setEnabled(true);
    session.userCredentialManager().updateCredential(realm, unauthorizedUser, UserCredentialModel.password("password"));
    UserModel unauthorizedMapper = session.users().addUser(realm, "unauthorizedMapper");
    unauthorizedMapper.setEnabled(true);
    session.userCredentialManager().updateCredential(realm, unauthorizedMapper, UserCredentialModel.password("password"));
    unauthorizedMapper.grantRole(managerRole);
    UserModel user1 = session.users().addUser(realm, "user1");
    user1.setEnabled(true);
    // group management
    AdminPermissionManagement permissions = AdminPermissions.management(session, realm);
    GroupModel group = KeycloakModelUtils.findGroupByPath(realm, "top");
    UserModel groupMember = session.users().addUser(realm, "groupMember");
    groupMember.joinGroup(group);
    groupMember.setEnabled(true);
    UserModel groupManager = session.users().addUser(realm, "groupManager");
    groupManager.grantRole(queryGroupsRole);
    groupManager.grantRole(queryUsersRole);
    groupManager.setEnabled(true);
    groupManager.grantRole(mapperRole);
    session.userCredentialManager().updateCredential(realm, groupManager, UserCredentialModel.password("password"));
    UserModel groupManagerNoMapper = session.users().addUser(realm, "noMapperGroupManager");
    groupManagerNoMapper.setEnabled(true);
    session.userCredentialManager().updateCredential(realm, groupManagerNoMapper, UserCredentialModel.password("password"));
    groupManagerNoMapper.grantRole(queryGroupsRole);
    groupManagerNoMapper.grantRole(queryUsersRole);
    UserPolicyRepresentation groupManagerRep = new UserPolicyRepresentation();
    groupManagerRep.setName("groupManagers");
    groupManagerRep.addUser("groupManager");
    groupManagerRep.addUser("noMapperGroupManager");
    ResourceServer server = permissions.realmResourceServer();
    Policy groupManagerPolicy = permissions.authz().getStoreFactory().getPolicyStore().create(groupManagerRep, server);
    permissions.groups().manageMembersPermission(group).addAssociatedPolicy(groupManagerPolicy);
    permissions.groups().manageMembershipPermission(group).addAssociatedPolicy(groupManagerPolicy);
    permissions.groups().viewPermission(group).addAssociatedPolicy(groupManagerPolicy);
    UserModel clientMapper = session.users().addUser(realm, "clientMapper");
    clientMapper.setEnabled(true);
    clientMapper.grantRole(managerRole);
    clientMapper.grantRole(queryUsersRole);
    session.userCredentialManager().updateCredential(realm, clientMapper, UserCredentialModel.password("password"));
    Policy clientMapperPolicy = permissions.clients().mapRolesPermission(client);
    UserPolicyRepresentation userRep = new UserPolicyRepresentation();
    userRep.setName("userClientMapper");
    userRep.addUser("clientMapper");
    Policy userPolicy = permissions.authz().getStoreFactory().getPolicyStore().create(userRep, permissions.clients().resourceServer(client));
    clientMapperPolicy.addAssociatedPolicy(userPolicy);
    UserModel clientManager = session.users().addUser(realm, "clientManager");
    clientManager.setEnabled(true);
    clientManager.grantRole(queryClientsRole);
    session.userCredentialManager().updateCredential(realm, clientManager, UserCredentialModel.password("password"));
    Policy clientManagerPolicy = permissions.clients().managePermission(client);
    userRep = new UserPolicyRepresentation();
    userRep.setName("clientManager");
    userRep.addUser("clientManager");
    userPolicy = permissions.authz().getStoreFactory().getPolicyStore().create(userRep, permissions.clients().resourceServer(client));
    clientManagerPolicy.addAssociatedPolicy(userPolicy);
    UserModel clientConfigurer = session.users().addUser(realm, "clientConfigurer");
    clientConfigurer.setEnabled(true);
    clientConfigurer.grantRole(queryClientsRole);
    session.userCredentialManager().updateCredential(realm, clientConfigurer, UserCredentialModel.password("password"));
    Policy clientConfigurePolicy = permissions.clients().configurePermission(client);
    userRep = new UserPolicyRepresentation();
    userRep.setName("clientConfigure");
    userRep.addUser("clientConfigurer");
    userPolicy = permissions.authz().getStoreFactory().getPolicyStore().create(userRep, permissions.clients().resourceServer(client));
    clientConfigurePolicy.addAssociatedPolicy(userPolicy);
    UserModel groupViewer = session.users().addUser(realm, "groupViewer");
    groupViewer.grantRole(queryGroupsRole);
    groupViewer.grantRole(queryUsersRole);
    groupViewer.setEnabled(true);
    session.userCredentialManager().updateCredential(realm, groupViewer, UserCredentialModel.password("password"));
    UserPolicyRepresentation groupViewMembersRep = new UserPolicyRepresentation();
    groupViewMembersRep.setName("groupMemberViewers");
    groupViewMembersRep.addUser("groupViewer");
    Policy groupViewMembersPolicy = permissions.authz().getStoreFactory().getPolicyStore().create(groupViewMembersRep, server);
    Policy groupViewMembersPermission = permissions.groups().viewMembersPermission(group);
    groupViewMembersPermission.addAssociatedPolicy(groupViewMembersPolicy);
}

Example 10 with UserPolicyRepresentation

use of org.keycloak.representations.idm.authorization.UserPolicyRepresentation in project keycloak by keycloak.

the class FineGrainAdminUnitTest method testClientsSearchAfterFirstPage.

@Test
@AuthServerContainerExclude(AuthServer.REMOTE)
public void testClientsSearchAfterFirstPage() {
    testingClient.server().run(session -> {
        RealmModel realm = session.realms().getRealmByName("test");
        session.getContext().setRealm(realm);
        ClientModel realmAdminClient = realm.getClientByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID);
        UserModel regularAdminUser = session.users().addUser(realm, "regular-admin-user");
        session.userCredentialManager().updateCredential(realm, regularAdminUser, UserCredentialModel.password("password"));
        regularAdminUser.grantRole(realmAdminClient.getRole(AdminRoles.QUERY_CLIENTS));
        regularAdminUser.setEnabled(true);
        UserPolicyRepresentation userPolicyRepresentation = new UserPolicyRepresentation();
        userPolicyRepresentation.setName("Only " + regularAdminUser.getUsername());
        userPolicyRepresentation.addUser(regularAdminUser.getId());
        AdminPermissionManagement management = AdminPermissions.management(session, realm);
        ClientPermissionManagement clientPermission = management.clients();
        for (int i = 15; i < 30; i++) {
            ClientModel clientModel = realm.addClient("client-search-" + (i < 10 ? "0" + i : i));
            clientPermission.setPermissionsEnabled(clientModel, true);
            Policy policy = clientPermission.viewPermission(clientModel);
            AuthorizationProvider provider = session.getProvider(AuthorizationProvider.class);
            if (i == 15) {
                provider.getStoreFactory().getPolicyStore().create(userPolicyRepresentation, management.realmResourceServer());
            }
            policy.addAssociatedPolicy(provider.getStoreFactory().getPolicyStore().findByName("Only regular-admin-user", realmAdminClient.getId()));
        }
    });
    try (Keycloak client = Keycloak.getInstance(getAuthServerContextRoot() + "/auth", "test", "regular-admin-user", "password", Constants.ADMIN_CLI_CLIENT_ID, TLSUtils.initializeTLS())) {
        List<ClientRepresentation> clients = new ArrayList<>();
        List<ClientRepresentation> result = client.realm("test").clients().findAll("client-search-", true, true, 0, 10);
        clients.addAll(result);
        Assert.assertEquals(10, result.size());
        Assert.assertThat(result.stream().map(rep -> rep.getClientId()).collect(Collectors.toList()), Matchers.is(Arrays.asList("client-search-15", "client-search-16", "client-search-17", "client-search-18", "client-search-19", "client-search-20", "client-search-21", "client-search-22", "client-search-23", "client-search-24")));
        result = client.realm("test").clients().findAll("client-search-", true, true, 10, 10);
        clients.addAll(result);
        Assert.assertEquals(5, result.size());
        Assert.assertThat(result.stream().map(rep -> rep.getClientId()).collect(Collectors.toList()), Matchers.is(Arrays.asList("client-search-25", "client-search-26", "client-search-27", "client-search-28", "client-search-29")));
        result = client.realm("test").clients().findAll("client-search-", true, true, 20, 10);
        clients.addAll(result);
        Assert.assertTrue(result.isEmpty());
    }
}