Examples with OIDCClientRepresentation org.keycloak.representations.oidc.OIDCClientRepresentation used on opensource projects

Example 16 with OIDCClientRepresentation

use of org.keycloak.representations.oidc.OIDCClientRepresentation in project keycloak by keycloak.

the class ClientRegistrationPoliciesTest method testMaxClientsPolicy.

@Test
// We would need to do domain name -> ip address to set trusted host
@AuthServerContainerExclude(AuthServer.REMOTE)
public void testMaxClientsPolicy() throws Exception {
    setTrustedHost("localhost");
    int clientsCount = realmResource().clients().findAll().size();
    int newClientsLimit = clientsCount + 1;
    // Allow to create one more client to current limit
    ComponentRepresentation maxClientsPolicyRep = findPolicyByProviderAndAuth(MaxClientsClientRegistrationPolicyFactory.PROVIDER_ID, getPolicyAnon());
    maxClientsPolicyRep.getConfig().putSingle(MaxClientsClientRegistrationPolicyFactory.MAX_CLIENTS, String.valueOf(newClientsLimit));
    realmResource().components().component(maxClientsPolicyRep.getId()).update(maxClientsPolicyRep);
    // I can register one new client
    OIDCClientRepresentation client = create();
    // I can't register more clients
    assertOidcFail(ClientRegOp.CREATE, createRepOidc(), 403, "It's allowed to have max " + newClientsLimit + " clients per realm");
    // Revert
    maxClientsPolicyRep.getConfig().putSingle(MaxClientsClientRegistrationPolicyFactory.MAX_CLIENTS, String.valueOf(10000));
    realmResource().components().component(maxClientsPolicyRep.getId()).update(maxClientsPolicyRep);
}

Example 17 with OIDCClientRepresentation

use of org.keycloak.representations.oidc.OIDCClientRepresentation in project keycloak by keycloak.

the class JsonParserTest method testReadOIDCClientRep.

@Test
public void testReadOIDCClientRep() throws IOException {
    String stringRep = "{\"subject_type\": \"public\", \"jwks_uri\": \"https://op.certification.openid.net:60720/export/jwk_60720.json\", \"contacts\": [\"roland.hedberg@umu.se\"], \"application_type\": \"web\", \"grant_types\": [\"authorization_code\"], \"post_logout_redirect_uris\": [\"https://op.certification.openid.net:60720/logout\"], \"redirect_uris\": [\"https://op.certification.openid.net:60720/authz_cb\"], \"response_types\": [\"code\"], \"require_auth_time\": true, \"default_max_age\": 3600}";
    OIDCClientRepresentation clientRep = JsonSerialization.readValue(stringRep, OIDCClientRepresentation.class);
    Assert.assertEquals("public", clientRep.getSubjectType());
    Assert.assertTrue(clientRep.getRequireAuthTime());
    Assert.assertEquals(3600, clientRep.getDefaultMaxAge().intValue());
    Assert.assertEquals(1, clientRep.getRedirectUris().size());
    Assert.assertEquals("https://op.certification.openid.net:60720/authz_cb", clientRep.getRedirectUris().get(0));
    Assert.assertNull(clientRep.getJwks());
}

Example 18 with OIDCClientRepresentation

use of org.keycloak.representations.oidc.OIDCClientRepresentation in project keycloak by keycloak.

the class JsonParserTest method testReadOIDCClientRepWithJWKS.

@Test
public void testReadOIDCClientRepWithJWKS() throws IOException {
    String stringRep = "{\"token_endpoint_auth_method\": \"private_key_jwt\", \"subject_type\": \"public\", \"jwks_uri\": null, \"jwks\": {\"keys\": [{\"use\": \"enc\", \"e\": \"AQAB\", \"d\": \"lZQv0_81euRLeUYU84Aodh0ar7ymDlzWP5NMra4Jklkb-lTBWkI-u4RMsPqGYyW3KHRoL_pgzZXSzQx8RLQfER6timRWb--NxMMKllZubByU3RqH2ooNuocJurspYiXkznPW1Mg9DaNXL0C2hwWPQHTeUVISpjgi5TCOV1ccWVyksFruya_VNL1CIByB-L0GL1rqbKv32cDwi2A3_jJa61cpzfLSIBe-lvCO6tuiDsR4qgJnUwnndQFwEI_4mLmD3iNWXrc8N-poleV8mBfMqBB5fWwy_ZTFCpmQ5AywGmctaik_wNhMoWuA4tUfY6_1LdKld-5Cjq55eLtuJjtvuQ\", \"n\": \"tx3Hjdbc19lkTiohbJrNj4jf2_90MEE122CRrwtFu6saDywKcG7Bi7w2FMAK2oTkuWfqhWRb5BEGmnSXdiCEPO5d-ytqP3nwlZXHaCDYscpP8bB4YLhvCn7R8Efw6gwQle24QPRP3lYoFeuUbDUq7GKA5SfaZUvWoeWjqyLIaBspKQsC26_Umx1E4IXLrMSL6nkRnrYcVZBAXrYCeTP1XtsV38_lZVJfHSaJaUy4PKaj3yvgm93EV2CXybPti7CCMXZ34VqqWiF64pQjZsPu3ZTr7ha_TTQq499-zYRQNDvIVsBDLQQIgrbctuGqj6lrXb31Jj3JIEYqH_4h5X9d0Q\", \"q\": \"1q-r-bmMFbIzrLK2U3elksZq8CqUqZxlSfkGMZuVkxgYMS-e4FPzEp2iirG-eO11aa0cpMMoBdTnVdGJ_ZUR93w0lGf9XnQAJqxP7eOsrUoiW4VWlWH4WfOiLgpO-pFtyTz_JksYYaotc_Z3Zy-Szw6a39IDbuYGy1qL-15oQuc\", \"p\": \"2lrYPppRbcQWu4LtWN6tOVUrtCOPv1eLTKTc7q8vCMcem1Ox5QFB7KnUtNZ5Ni7wnZUeVDfimNebtjNsGvDSrpgIlo9dEnFBQsQIkzZ2SkoYfgmF8hNdi6P-BfRjdgYouy4c6xAnGDgSMTip1YnPRyvbMaoYT9E_tEcBW5wOeoc\", \"kid\": \"a0\", \"kty\": \"RSA\"}, {\"use\": \"sig\", \"e\": \"AQAB\", \"d\": \"DodXDEtkovWWGsMEXYy_nEEMCWyROMOebCnCv0ey3i4M4bh2dmwqgz0e-IKQAFlGiMkidGL1lNbq0uFS04FbuRAR06dYw1cbrNbDdhrWFxKTd1L5D9p-x-gW-YDWhpI8rUGRa76JXkOSxZUbg09_QyUd99CXAHh-FXi_ZkIKD8hK6FrAs68qhLf8MNkUv63DTduw7QgeFfQivdopePxyGuMk5n8veqwsUZsklQkhNlTYQqeM1xb2698ZQcNYkl0OssEsSJKRjXt-LRPowKrdvTuTo2p--HMI0pIEeFs7H_u5OW3jihjvoFClGPynHQhgWmQzlQRvWRXh6FhDVqFeGQ\", \"n\": \"zfZzttF7HmnTYwSMPdxKs5AoczbNS2mOPz-tN1g4ljqI_F1DG8cgQDcN_VDufxoFGRERo2FK6WEN41LhbGEyP6uL6wW6Cy29qE9QZcvY5mXrncndRSOkNcMizvuEJes_fMYrmP_lPiC6kWiqItTk9QBWqJfiYKhCx9cSDXsBmJXn3KWQCVHvj1ANFWW0CWLMKlWN-_NMNLIWJN_pEAocTZMzxSFBK1b5_5J8ZS7hfWRF6MQmjsJcz2jzA21SQZNpre3kwnTGRSwo05sAS-TyeadDqQPWgbqX69UzcGq5irhzN8cpZ_JaTk3Y_uV6owanTZLVvCgdjaAnMYeZhb0KFw\", \"q\": \"5E5XKK5njT-zzRqqTeY2tgP9PJBACeaH_xQRHZ_1ydE7tVd7HdgdaEHfQ1jvKIHFkknWWOBAY1mlBc4YDirLShB_voShD8C-Hx3nF5sne5fleVfU-sZy6Za4B2U75PcE62oZgCPauOTAEm9Xuvrt5aMMovyzR8ecJZhm9bw7naU\", \"p\": \"5vJHCSM3H3q4RltYzENC9RyZZV8EUmpkv9moyguT5t-BUGA-T4W_FGIxzOPXRWOckIplKkoDKhavUeNmTZMCUcue0nkICSJpvNE4Nb2p5PZk_QqSdQNvCasQtdojEG0AmfVD85SU551CYxJdLdDFOqyK2entpMr8lhokem189As\", \"kid\": \"a1\", \"kty\": \"RSA\"}, {\"d\": \"S4_OufhLBgXFMgIDMI1zlVe2uCExpcEAQ80J_lXfS8I\", \"use\": \"sig\", \"crv\": \"P-256\", \"kty\": \"EC\", \"y\": \"DBdNyq30mXmUs_BIvKMqaTTNO7HDhCi0YiC8GciwNYk\", \"x\": \"cYwzBoyjRjxj334bRTqanONf7DUYK-6TgiuN0DixJAk\", \"kid\": \"a2\"}, {\"d\": \"33TnYgdJtWAiVosKqUnz0zSmvWTbsx5-6pceynW6Xck\", \"use\": \"enc\", \"crv\": \"P-256\", \"kty\": \"EC\", \"y\": \"Cula95Eix1Ia77St3OULe6-UKWs5I06nmdfUzhXUQTs\", \"x\": \"wk8HBVxNNzj1gJBxPmmx9XYW1L61ObBGzxpRa6_OqWU\", \"kid\": \"a3\"}]}, \"application_type\": \"web\", \"contacts\": [\"roland.hedberg@umu.se\"], \"post_logout_redirect_uris\": [\"https://op.certification.openid.net:60784/logout\"], \"redirect_uris\": [\"https://op.certification.openid.net:60784/authz_cb\"], \"response_types\": [\"code\"], \"require_auth_time\": true, \"grant_types\": [\"authorization_code\"], \"default_max_age\": 3600}";
    OIDCClientRepresentation clientRep = JsonSerialization.readValue(stringRep, OIDCClientRepresentation.class);
    Assert.assertNotNull(clientRep.getJwks());
}

Example 19 with OIDCClientRepresentation

use of org.keycloak.representations.oidc.OIDCClientRepresentation in project keycloak by keycloak.

the class JsonParserTest method testReadOIDCClientRepWithPairwise.

@Test
public void testReadOIDCClientRepWithPairwise() throws IOException {
    String stringRep = "{\"subject_type\": \"pairwise\", \"jwks_uri\": \"https://op.certification.openid.net:60720/export/jwk_60720.json\", \"contacts\": [\"roland.hedberg@umu.se\"], \"application_type\": \"web\", \"grant_types\": [\"authorization_code\"], \"post_logout_redirect_uris\": [\"https://op.certification.openid.net:60720/logout\"], \"redirect_uris\": [\"https://op.certification.openid.net:60720/authz_cb\"], \"response_types\": [\"code\"], \"require_auth_time\": true, \"default_max_age\": 3600}";
    OIDCClientRepresentation clientRep = JsonSerialization.readValue(stringRep, OIDCClientRepresentation.class);
    Assert.assertEquals("pairwise", clientRep.getSubjectType());
    Assert.assertTrue(clientRep.getRequireAuthTime());
    Assert.assertEquals(3600, clientRep.getDefaultMaxAge().intValue());
    Assert.assertEquals(1, clientRep.getRedirectUris().size());
    Assert.assertEquals("https://op.certification.openid.net:60720/authz_cb", clientRep.getRedirectUris().get(0));
    Assert.assertNull(clientRep.getJwks());
}

Example 20 with OIDCClientRepresentation

use of org.keycloak.representations.oidc.OIDCClientRepresentation in project keycloak by keycloak.

the class DescriptionConverter method toExternalResponse.

public static OIDCClientRepresentation toExternalResponse(KeycloakSession session, ClientRepresentation client, URI uri) {
    OIDCClientRepresentation response = new OIDCClientRepresentation();
    response.setClientId(client.getClientId());
    if ("none".equals(client.getClientAuthenticatorType())) {
        response.setTokenEndpointAuthMethod("none");
    } else {
        ClientAuthenticatorFactory clientAuth = (ClientAuthenticatorFactory) session.getKeycloakSessionFactory().getProviderFactory(ClientAuthenticator.class, client.getClientAuthenticatorType());
        Set<String> oidcClientAuthMethods = clientAuth.getProtocolAuthenticatorMethods(OIDCLoginProtocol.LOGIN_PROTOCOL);
        if (oidcClientAuthMethods != null && !oidcClientAuthMethods.isEmpty()) {
            response.setTokenEndpointAuthMethod(oidcClientAuthMethods.iterator().next());
        }
    }
    if (client.getClientAuthenticatorType().equals(ClientIdAndSecretAuthenticator.PROVIDER_ID)) {
        response.setClientSecret(client.getSecret());
        response.setClientSecretExpiresAt(0);
    }
    response.setClientName(client.getName());
    response.setClientUri(client.getBaseUrl());
    response.setRedirectUris(client.getRedirectUris());
    response.setRegistrationAccessToken(client.getRegistrationAccessToken());
    response.setRegistrationClientUri(uri.toString());
    response.setResponseTypes(getOIDCResponseTypes(client));
    response.setGrantTypes(getOIDCGrantTypes(client));
    List<String> scopes = client.getOptionalClientScopes();
    if (scopes != null)
        response.setScope(scopes.stream().collect(Collectors.joining(" ")));
    OIDCAdvancedConfigWrapper config = OIDCAdvancedConfigWrapper.fromClientRepresentation(client);
    if (config.isUserInfoSignatureRequired()) {
        response.setUserinfoSignedResponseAlg(config.getUserInfoSignedResponseAlg().toString());
    }
    if (config.getRequestObjectSignatureAlg() != null) {
        response.setRequestObjectSigningAlg(config.getRequestObjectSignatureAlg().toString());
    }
    if (config.getRequestObjectEncryptionAlg() != null) {
        response.setRequestObjectEncryptionAlg(config.getRequestObjectEncryptionAlg());
    }
    if (config.getRequestObjectEncryptionEnc() != null) {
        response.setRequestObjectEncryptionEnc(config.getRequestObjectEncryptionEnc());
    }
    if (config.isUseJwksUrl()) {
        response.setJwksUri(config.getJwksUrl());
    }
    if (config.isUseJwksString()) {
        try {
            response.setJwks(JsonSerialization.readValue(config.getJwksString(), JSONWebKeySet.class));
        } catch (IOException e) {
            throw new ClientRegistrationException("Illegal jwks format");
        }
    }
    // https://tools.ietf.org/html/draft-ietf-oauth-mtls-08#section-6.5
    if (config.isUseMtlsHokToken()) {
        response.setTlsClientCertificateBoundAccessTokens(Boolean.TRUE);
    } else {
        response.setTlsClientCertificateBoundAccessTokens(Boolean.FALSE);
    }
    if (config.getTlsClientAuthSubjectDn() != null) {
        response.setTlsClientAuthSubjectDn(config.getTlsClientAuthSubjectDn());
    }
    if (config.getIdTokenSignedResponseAlg() != null) {
        response.setIdTokenSignedResponseAlg(config.getIdTokenSignedResponseAlg());
    }
    if (config.getIdTokenEncryptedResponseAlg() != null) {
        response.setIdTokenEncryptedResponseAlg(config.getIdTokenEncryptedResponseAlg());
    }
    if (config.getIdTokenEncryptedResponseEnc() != null) {
        response.setIdTokenEncryptedResponseEnc(config.getIdTokenEncryptedResponseEnc());
    }
    if (config.getAuthorizationSignedResponseAlg() != null) {
        response.setAuthorizationSignedResponseAlg(config.getAuthorizationSignedResponseAlg());
    }
    if (config.getAuthorizationEncryptedResponseAlg() != null) {
        response.setAuthorizationEncryptedResponseAlg(config.getAuthorizationEncryptedResponseAlg());
    }
    if (config.getAuthorizationEncryptedResponseEnc() != null) {
        response.setAuthorizationEncryptedResponseEnc(config.getAuthorizationEncryptedResponseEnc());
    }
    if (config.getRequestUris() != null) {
        response.setRequestUris(config.getRequestUris());
    }
    if (config.getTokenEndpointAuthSigningAlg() != null) {
        response.setTokenEndpointAuthSigningAlg(config.getTokenEndpointAuthSigningAlg());
    }
    response.setBackchannelLogoutUri(config.getBackchannelLogoutUrl());
    response.setBackchannelLogoutSessionRequired(config.isBackchannelLogoutSessionRequired());
    response.setBackchannelLogoutSessionRequired(config.getBackchannelLogoutRevokeOfflineTokens());
    if (client.getAttributes() != null) {
        String mode = client.getAttributes().get(CibaConfig.CIBA_BACKCHANNEL_TOKEN_DELIVERY_MODE_PER_CLIENT);
        if (StringUtil.isNotBlank(mode)) {
            response.setBackchannelTokenDeliveryMode(mode);
        }
        String clientNotificationEndpoint = client.getAttributes().get(CibaConfig.CIBA_BACKCHANNEL_CLIENT_NOTIFICATION_ENDPOINT);
        if (StringUtil.isNotBlank(clientNotificationEndpoint)) {
            response.setBackchannelClientNotificationEndpoint(clientNotificationEndpoint);
        }
        String alg = client.getAttributes().get(CibaConfig.CIBA_BACKCHANNEL_AUTH_REQUEST_SIGNING_ALG);
        if (StringUtil.isNotBlank(alg)) {
            response.setBackchannelAuthenticationRequestSigningAlg(alg);
        }
        Boolean requirePushedAuthorizationRequests = Boolean.valueOf(client.getAttributes().get(ParConfig.REQUIRE_PUSHED_AUTHORIZATION_REQUESTS));
        response.setRequirePushedAuthorizationRequests(requirePushedAuthorizationRequests.booleanValue());
    }
    List<ProtocolMapperRepresentation> foundPairwiseMappers = PairwiseSubMapperUtils.getPairwiseSubMappers(client);
    SubjectType subjectType = foundPairwiseMappers.isEmpty() ? SubjectType.PUBLIC : SubjectType.PAIRWISE;
    response.setSubjectType(subjectType.toString().toLowerCase());
    if (subjectType.equals(SubjectType.PAIRWISE)) {
        // Get sectorIdentifier from 1st found
        String sectorIdentifierUri = PairwiseSubMapperHelper.getSectorIdentifierUri(foundPairwiseMappers.get(0));
        response.setSectorIdentifierUri(sectorIdentifierUri);
    }
    response.setFrontChannelLogoutUri(config.getFrontChannelLogoutUrl());
    List<String> defaultAcrValues = config.getAttributeMultivalued(Constants.DEFAULT_ACR_VALUES);
    if (!defaultAcrValues.isEmpty()) {
        response.setDefaultAcrValues(defaultAcrValues);
    }
    return response;
}