Examples with TokenMetadataRepresentation org.keycloak.representations.oidc.TokenMetadataRepresentation used on opensource projects

Example 16 with TokenMetadataRepresentation

use of org.keycloak.representations.oidc.TokenMetadataRepresentation in project keycloak by keycloak.

the class TokenIntrospectionTest method testIntrospectAccessTokenUserDisabled.

@Test
public void testIntrospectAccessTokenUserDisabled() throws Exception {
    oauth.doLogin("test-user@localhost", "password");
    String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
    AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code, "password");
    EventRepresentation loginEvent = events.expectLogin().assertEvent();
    UserRepresentation userRep = new UserRepresentation();
    try {
        userRep.setEnabled(false);
        adminClient.realm(oauth.getRealm()).users().get(loginEvent.getUserId()).update(userRep);
        String tokenResponse = oauth.introspectAccessTokenWithClientCredential("confidential-cli", "secret1", accessTokenResponse.getAccessToken());
        TokenMetadataRepresentation rep = JsonSerialization.readValue(tokenResponse, TokenMetadataRepresentation.class);
        assertFalse(rep.isActive());
        assertNull(rep.getUserName());
        assertNull(rep.getClientId());
        assertNull(rep.getSubject());
    } finally {
        userRep.setEnabled(true);
        adminClient.realm(oauth.getRealm()).users().get(loginEvent.getUserId()).update(userRep);
    }
}

Example 17 with TokenMetadataRepresentation

use of org.keycloak.representations.oidc.TokenMetadataRepresentation in project keycloak by keycloak.

the class TokenIntrospectionTest method testConfidentialClientCredentialsBasicAuthentication.

@Test
public void testConfidentialClientCredentialsBasicAuthentication() throws Exception {
    oauth.doLogin("test-user@localhost", "password");
    String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
    AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code, "password");
    String tokenResponse = oauth.introspectAccessTokenWithClientCredential("confidential-cli", "secret1", accessTokenResponse.getAccessToken());
    ObjectMapper objectMapper = new ObjectMapper();
    JsonNode jsonNode = objectMapper.readTree(tokenResponse);
    assertTrue(jsonNode.get("active").asBoolean());
    assertEquals("test-user@localhost", jsonNode.get("username").asText());
    assertEquals("test-app", jsonNode.get("client_id").asText());
    assertTrue(jsonNode.has("exp"));
    assertTrue(jsonNode.has("iat"));
    assertFalse(jsonNode.has("nbf"));
    assertTrue(jsonNode.has("sub"));
    assertTrue(jsonNode.has("aud"));
    assertTrue(jsonNode.has("iss"));
    assertTrue(jsonNode.has("jti"));
    TokenMetadataRepresentation rep = objectMapper.readValue(tokenResponse, TokenMetadataRepresentation.class);
    assertTrue(rep.isActive());
    assertEquals("test-user@localhost", rep.getUserName());
    assertEquals("test-app", rep.getClientId());
    assertEquals(jsonNode.get("exp").asInt(), rep.getExpiration());
    assertEquals(jsonNode.get("iat").asInt(), rep.getIssuedAt());
    assertEquals(jsonNode.get("nbf"), rep.getNbf());
    assertEquals(jsonNode.get("sub").asText(), rep.getSubject());
    List<String> audiences = new ArrayList<>();
    // We have single audience in the token - hence it is simple string
    assertTrue(jsonNode.get("aud") instanceof TextNode);
    audiences.add(jsonNode.get("aud").asText());
    Assert.assertNames(audiences, rep.getAudience());
    assertEquals(jsonNode.get("iss").asText(), rep.getIssuer());
    assertEquals(jsonNode.get("jti").asText(), rep.getId());
}

Example 18 with TokenMetadataRepresentation

use of org.keycloak.representations.oidc.TokenMetadataRepresentation in project keycloak by keycloak.

the class TokenRevocationCorsTest method isTokenDisabled.

private void isTokenDisabled(AccessTokenResponse tokenResponse, String clientId) throws IOException {
    String introspectionResponse = oauth.introspectAccessTokenWithClientCredential(clientId, "password", tokenResponse.getAccessToken());
    TokenMetadataRepresentation rep = JsonSerialization.readValue(introspectionResponse, TokenMetadataRepresentation.class);
    assertFalse(rep.isActive());
    oauth.clientId(clientId);
    OAuthClient.AccessTokenResponse tokenRefreshResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
    assertEquals(Status.BAD_REQUEST.getStatusCode(), tokenRefreshResponse.getStatusCode());
}

Example 19 with TokenMetadataRepresentation

use of org.keycloak.representations.oidc.TokenMetadataRepresentation in project keycloak by keycloak.

the class HoKTest method testIntrospectHoKAccessToken.

@Test
public void testIntrospectHoKAccessToken() throws Exception {
    // get an access token with client certificate in mutual authenticate TLS
    // mimic Client
    oauth.doLogin("test-user@localhost", "password");
    String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
    EventRepresentation loginEvent = events.expectLogin().assertEvent();
    AccessTokenResponse accessTokenResponse = null;
    try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
        accessTokenResponse = oauth.doAccessTokenRequest(code, "password", client);
    } catch (IOException ioe) {
        throw new RuntimeException(ioe);
    }
    // Do token introspection
    // mimic Resource Server
    String tokenResponse;
    try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithoutKeyStoreAndTrustStore()) {
        tokenResponse = oauth.introspectTokenWithClientCredential("confidential-cli", "secret1", "access_token", accessTokenResponse.getAccessToken(), client);
    } catch (IOException ioe) {
        throw new RuntimeException(ioe);
    }
    TokenMetadataRepresentation rep = JsonSerialization.readValue(tokenResponse, TokenMetadataRepresentation.class);
    JWSInput jws = new JWSInput(accessTokenResponse.getAccessToken());
    AccessToken at = jws.readJsonContent(AccessToken.class);
    jws = new JWSInput(accessTokenResponse.getRefreshToken());
    RefreshToken rt = jws.readJsonContent(RefreshToken.class);
    String certThumprintFromAccessToken = at.getCertConf().getCertThumbprint();
    String certThumprintFromRefreshToken = rt.getCertConf().getCertThumbprint();
    String certThumprintFromTokenIntrospection = rep.getCertConf().getCertThumbprint();
    String certThumprintFromBoundClientCertificate = MutualTLSUtils.getThumbprintFromDefaultClientCert();
    assertTrue(rep.isActive());
    assertEquals("test-user@localhost", rep.getUserName());
    assertEquals("test-app", rep.getClientId());
    assertEquals(loginEvent.getUserId(), rep.getSubject());
    assertEquals(certThumprintFromTokenIntrospection, certThumprintFromBoundClientCertificate);
    assertEquals(certThumprintFromBoundClientCertificate, certThumprintFromAccessToken);
    assertEquals(certThumprintFromAccessToken, certThumprintFromRefreshToken);
}

Example 20 with TokenMetadataRepresentation

use of org.keycloak.representations.oidc.TokenMetadataRepresentation in project keycloak by keycloak.

the class TokenRevocationTest method isTokenEnabled.

private void isTokenEnabled(AccessTokenResponse tokenResponse, String clientId) throws IOException {
    String introspectionResponse = oauth.introspectAccessTokenWithClientCredential(clientId, "password", tokenResponse.getAccessToken());
    TokenMetadataRepresentation rep = JsonSerialization.readValue(introspectionResponse, TokenMetadataRepresentation.class);
    assertTrue(rep.isActive());
    oauth.clientId(clientId);
    OAuthClient.AccessTokenResponse tokenRefreshResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
    assertEquals(Status.OK.getStatusCode(), tokenRefreshResponse.getStatusCode());
}