Examples with AuthServerContainerExclude org.keycloak.testsuite.arquillian.annotation.AuthServerContainerExclude used on opensource projects

Example 1 with AuthServerContainerExclude

use of org.keycloak.testsuite.arquillian.annotation.AuthServerContainerExclude in project keycloak by keycloak.

the class FineGrainAdminUnitTest method testClientsSearchAfterFirstPage.

@Test
@AuthServerContainerExclude(AuthServer.REMOTE)
public void testClientsSearchAfterFirstPage() {
    testingClient.server().run(session -> {
        RealmModel realm = session.realms().getRealmByName("test");
        session.getContext().setRealm(realm);
        ClientModel realmAdminClient = realm.getClientByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID);
        UserModel regularAdminUser = session.users().addUser(realm, "regular-admin-user");
        session.userCredentialManager().updateCredential(realm, regularAdminUser, UserCredentialModel.password("password"));
        regularAdminUser.grantRole(realmAdminClient.getRole(AdminRoles.QUERY_CLIENTS));
        regularAdminUser.setEnabled(true);
        UserPolicyRepresentation userPolicyRepresentation = new UserPolicyRepresentation();
        userPolicyRepresentation.setName("Only " + regularAdminUser.getUsername());
        userPolicyRepresentation.addUser(regularAdminUser.getId());
        AdminPermissionManagement management = AdminPermissions.management(session, realm);
        ClientPermissionManagement clientPermission = management.clients();
        for (int i = 15; i < 30; i++) {
            ClientModel clientModel = realm.addClient("client-search-" + (i < 10 ? "0" + i : i));
            clientPermission.setPermissionsEnabled(clientModel, true);
            Policy policy = clientPermission.viewPermission(clientModel);
            AuthorizationProvider provider = session.getProvider(AuthorizationProvider.class);
            if (i == 15) {
                provider.getStoreFactory().getPolicyStore().create(userPolicyRepresentation, management.realmResourceServer());
            }
            policy.addAssociatedPolicy(provider.getStoreFactory().getPolicyStore().findByName("Only regular-admin-user", realmAdminClient.getId()));
        }
    });
    try (Keycloak client = Keycloak.getInstance(getAuthServerContextRoot() + "/auth", "test", "regular-admin-user", "password", Constants.ADMIN_CLI_CLIENT_ID, TLSUtils.initializeTLS())) {
        List<ClientRepresentation> clients = new ArrayList<>();
        List<ClientRepresentation> result = client.realm("test").clients().findAll("client-search-", true, true, 0, 10);
        clients.addAll(result);
        Assert.assertEquals(10, result.size());
        Assert.assertThat(result.stream().map(rep -> rep.getClientId()).collect(Collectors.toList()), Matchers.is(Arrays.asList("client-search-15", "client-search-16", "client-search-17", "client-search-18", "client-search-19", "client-search-20", "client-search-21", "client-search-22", "client-search-23", "client-search-24")));
        result = client.realm("test").clients().findAll("client-search-", true, true, 10, 10);
        clients.addAll(result);
        Assert.assertEquals(5, result.size());
        Assert.assertThat(result.stream().map(rep -> rep.getClientId()).collect(Collectors.toList()), Matchers.is(Arrays.asList("client-search-25", "client-search-26", "client-search-27", "client-search-28", "client-search-29")));
        result = client.realm("test").clients().findAll("client-search-", true, true, 20, 10);
        clients.addAll(result);
        Assert.assertTrue(result.isEmpty());
    }
}

Example 2 with AuthServerContainerExclude

use of org.keycloak.testsuite.arquillian.annotation.AuthServerContainerExclude in project keycloak by keycloak.

the class FineGrainAdminUnitTest method testRestEvaluation.

@Test
@AuthServerContainerExclude(AuthServer.REMOTE)
public void testRestEvaluation() throws Exception {
    testingClient.server().run(FineGrainAdminUnitTest::setupPolices);
    testingClient.server().run(FineGrainAdminUnitTest::setupUsers);
    UserRepresentation user1 = adminClient.realm(TEST).users().search("user1").get(0);
    UserRepresentation anotherAdmin = adminClient.realm(TEST).users().search("anotherAdmin").get(0);
    UserRepresentation groupMember = adminClient.realm(TEST).users().search("groupMember").get(0);
    RoleRepresentation realmRole = adminClient.realm(TEST).roles().get("realm-role").toRepresentation();
    List<RoleRepresentation> realmRoleSet = new LinkedList<>();
    realmRoleSet.add(realmRole);
    RoleRepresentation realmRole2 = adminClient.realm(TEST).roles().get("realm-role2").toRepresentation();
    List<RoleRepresentation> realmRole2Set = new LinkedList<>();
    realmRole2Set.add(realmRole2);
    ClientRepresentation client = adminClient.realm(TEST).clients().findByClientId(CLIENT_NAME).get(0);
    ClientScopeRepresentation scope = adminClient.realm(TEST).clientScopes().findAll().get(0);
    RoleRepresentation clientRole = adminClient.realm(TEST).clients().get(client.getId()).roles().get("client-role").toRepresentation();
    List<RoleRepresentation> clientRoleSet = new LinkedList<>();
    clientRoleSet.add(clientRole);
    // test configure client
    {
        try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(), TEST, "clientConfigurer", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
            client.setAdminUrl("http://nowhere");
            realmClient.realm(TEST).clients().get(client.getId()).update(client);
            client.setFullScopeAllowed(true);
            try {
                realmClient.realm(TEST).clients().get(client.getId()).update(client);
                Assert.fail("should fail with forbidden exception");
            } catch (ClientErrorException e) {
                Assert.assertEquals(403, e.getResponse().getStatus());
            }
            client.setFullScopeAllowed(false);
            realmClient.realm(TEST).clients().get(client.getId()).update(client);
            try {
                realmClient.realm(TEST).clients().get(client.getId()).addDefaultClientScope(scope.getId());
                Assert.fail("should fail with forbidden exception");
            } catch (ClientErrorException e) {
                Assert.assertEquals(403, e.getResponse().getStatus());
            }
            try {
                realmClient.realm(TEST).clients().get(client.getId()).getScopeMappings().realmLevel().add(realmRoleSet);
                Assert.fail("should fail with forbidden exception");
            } catch (ClientErrorException e) {
                Assert.assertEquals(403, e.getResponse().getStatus());
            }
        }
    }
    // test illegal impersonation
    if (!IMPERSONATION_DISABLED) {
        Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(), TEST, "nomap-admin", "password", Constants.ADMIN_CLI_CLIENT_ID, null);
        try {
            realmClient.realm(TEST).users().get(user1.getId()).impersonate();
            // just in case of cookie settings
            realmClient.close();
            realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(), TEST, "nomap-admin", "password", Constants.ADMIN_CLI_CLIENT_ID, null);
            try {
                realmClient.realm(TEST).users().get(anotherAdmin.getId()).impersonate();
                Assert.fail("should fail with forbidden exception");
            } catch (ClientErrorException e) {
                Assert.assertEquals(403, e.getResponse().getStatus());
            }
        } finally {
            realmClient.close();
        }
    }
    {
        try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(), TEST, "authorized", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
            realmClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().add(realmRoleSet);
            List<RoleRepresentation> roles = adminClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().listAll();
            Assert.assertTrue(roles.stream().anyMatch((r) -> {
                return r.getName().equals("realm-role");
            }));
            realmClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().remove(realmRoleSet);
            roles = adminClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().listAll();
            Assert.assertTrue(roles.stream().noneMatch((r) -> {
                return r.getName().equals("realm-role");
            }));
            realmClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).add(clientRoleSet);
            roles = adminClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).listAll();
            Assert.assertTrue(roles.stream().anyMatch((r) -> {
                return r.getName().equals("client-role");
            }));
            realmClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).remove(clientRoleSet);
            roles = adminClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).listAll();
            Assert.assertTrue(roles.stream().noneMatch((r) -> {
                return r.getName().equals("client-role");
            }));
        }
    }
    {
        try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(), TEST, "authorizedComposite", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
            realmClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().add(realmRoleSet);
            List<RoleRepresentation> roles = adminClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().listAll();
            Assert.assertTrue(roles.stream().anyMatch((r) -> {
                return r.getName().equals("realm-role");
            }));
            realmClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().remove(realmRoleSet);
            roles = adminClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().listAll();
            Assert.assertTrue(roles.stream().noneMatch((r) -> {
                return r.getName().equals("realm-role");
            }));
            realmClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).add(clientRoleSet);
            roles = adminClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).listAll();
            Assert.assertTrue(roles.stream().anyMatch((r) -> {
                return r.getName().equals("client-role");
            }));
            realmClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).remove(clientRoleSet);
            roles = adminClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).listAll();
            Assert.assertTrue(roles.stream().noneMatch((r) -> {
                return r.getName().equals("client-role");
            }));
        }
    }
    {
        try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(), TEST, "unauthorized", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
            realmClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().add(realmRoleSet);
            Assert.fail("should fail with forbidden exception");
        } catch (ClientErrorException e) {
            Assert.assertEquals(403, e.getResponse().getStatus());
        }
    }
    {
        try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(), TEST, "unauthorizedMapper", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
            realmClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().add(realmRoleSet);
            Assert.fail("should fail with forbidden exception");
        } catch (ClientErrorException e) {
            Assert.assertEquals(403, e.getResponse().getStatus());
        }
    }
    {
        try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(), TEST, "groupManager", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
            realmClient.realm(TEST).users().get(groupMember.getId()).roles().clientLevel(client.getId()).add(clientRoleSet);
            List<RoleRepresentation> roles = realmClient.realm(TEST).users().get(groupMember.getId()).roles().clientLevel(client.getId()).listAll();
            Assert.assertTrue(roles.stream().anyMatch((r) -> {
                return r.getName().equals("client-role");
            }));
            realmClient.realm(TEST).users().get(groupMember.getId()).roles().clientLevel(client.getId()).remove(clientRoleSet);
            roles = realmClient.realm(TEST).users().get(groupMember.getId()).roles().realmLevel().listAvailable();
            Assert.assertEquals(1, roles.size());
            realmClient.realm(TEST).users().get(groupMember.getId()).roles().realmLevel().add(realmRoleSet);
            realmClient.realm(TEST).users().get(groupMember.getId()).roles().realmLevel().remove(realmRoleSet);
            try {
                realmClient.realm(TEST).users().get(groupMember.getId()).roles().realmLevel().add(realmRole2Set);
                Assert.fail("should fail with forbidden exception");
            } catch (ClientErrorException e) {
                Assert.assertEquals(403, e.getResponse().getStatus());
            }
            try {
                realmClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().add(realmRoleSet);
                Assert.fail("should fail with forbidden exception");
            } catch (ClientErrorException e) {
                Assert.assertEquals(403, e.getResponse().getStatus());
            }
        }
    }
    // test client.mapRoles
    {
        try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(), TEST, "clientMapper", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
            List<RoleRepresentation> roles = realmClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).listAll();
            Assert.assertTrue(roles.isEmpty());
            realmClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).add(clientRoleSet);
            roles = realmClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).listAll();
            Assert.assertTrue(roles.stream().anyMatch((r) -> {
                return r.getName().equals("client-role");
            }));
            roles = realmClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().listAvailable();
            Assert.assertTrue(roles.isEmpty());
            try {
                realmClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().add(realmRoleSet);
                Assert.fail("should fail with forbidden exception");
            } catch (ClientErrorException e) {
                Assert.assertEquals(403, e.getResponse().getStatus());
            }
        }
    }
    // KEYCLOAK-5878
    {
        try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(), TEST, "groupViewer", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
            // Should only return the list of users that belong to "top" group
            List<UserRepresentation> queryUsers = realmClient.realm(TEST).users().list();
            Assert.assertEquals(queryUsers.size(), 1);
            Assert.assertEquals("groupmember", queryUsers.get(0).getUsername());
            for (UserRepresentation user : queryUsers) {
                System.out.println(user.getUsername());
            }
        }
    }
    // KEYCLOAK-11261 : user creation via fine grain admin
    {
        try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(), TEST, "noMapperGroupManager", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
            // Should only return the list of users that belong to "top" group
            List<UserRepresentation> queryUsers = realmClient.realm(TEST).users().list();
            Assert.assertEquals(1, queryUsers.size());
            UserRepresentation newGroupMemberWithoutGroup = createUserRepresentation("new-group-member", "new-group-member@keycloak.org", "New", "Member", true);
            try {
                ApiUtil.createUserWithAdminClient(realmClient.realm(TEST), newGroupMemberWithoutGroup);
                Assert.fail("should fail with HTTP response code 403 Forbidden");
            } catch (WebApplicationException e) {
                Assert.assertEquals(403, e.getResponse().getStatus());
            }
            UserRepresentation newEmptyGroupList = createUserRepresentation("new-group-member", "new-group-member@keycloak.org", "New", "Member", true);
            newEmptyGroupList.setGroups(Collections.emptyList());
            try {
                ApiUtil.createUserWithAdminClient(realmClient.realm(TEST), newEmptyGroupList);
                Assert.fail("should fail with HTTP response code 403 Forbidden");
            } catch (WebApplicationException e) {
                Assert.assertEquals(403, e.getResponse().getStatus());
            }
            UserRepresentation newGroupMemberWithNonExistentGroup = createUserRepresentation("new-group-member", "new-group-member@keycloak.org", "New", "Member", Arrays.asList("wrong-group"), true);
            try {
                ApiUtil.createUserWithAdminClient(realmClient.realm(TEST), newGroupMemberWithNonExistentGroup);
                Assert.fail("should fail with HTTP response code 403 Forbidden");
            } catch (WebApplicationException e) {
                Assert.assertEquals(403, e.getResponse().getStatus());
            }
            UserRepresentation newGroupMemberOfNotManagedGroup = createUserRepresentation("new-group-member", "new-group-member@keycloak.org", "New", "Member", Arrays.asList("restricted-group"), true);
            try {
                ApiUtil.createUserWithAdminClient(realmClient.realm(TEST), newGroupMemberOfNotManagedGroup);
                Assert.fail("should fail with HTTP response code 403 Forbidden");
            } catch (WebApplicationException e) {
                Assert.assertEquals(403, e.getResponse().getStatus());
            }
            UserRepresentation newGroupMember = createUserRepresentation("new-group-member", "new-group-member@keycloak.org", "New", "Member", Arrays.asList("top"), true);
            ApiUtil.createUserWithAdminClient(realmClient.realm(TEST), newGroupMember);
            // Should only return the list of users that belong to "top" group + the new one
            queryUsers = realmClient.realm(TEST).users().list();
            Assert.assertEquals(2, queryUsers.size());
        }
    }
}

Example 3 with AuthServerContainerExclude

use of org.keycloak.testsuite.arquillian.annotation.AuthServerContainerExclude in project keycloak by keycloak.

the class ClientTest method updateClientWithProtocolMapper.

@Test
@AuthServerContainerExclude(AuthServer.REMOTE)
public void updateClientWithProtocolMapper() {
    ClientRepresentation rep = new ClientRepresentation();
    rep.setClientId("my-app");
    ProtocolMapperRepresentation fooMapper = new ProtocolMapperRepresentation();
    fooMapper.setName("foo");
    fooMapper.setProtocol("openid-connect");
    fooMapper.setProtocolMapper("oidc-hardcoded-claim-mapper");
    rep.setProtocolMappers(Collections.singletonList(fooMapper));
    Response response = realm.clients().create(rep);
    response.close();
    String id = ApiUtil.getCreatedId(response);
    getCleanup().addClientUuid(id);
    ClientResource clientResource = realm.clients().get(id);
    assertNotNull(clientResource);
    ClientRepresentation client = clientResource.toRepresentation();
    List<ProtocolMapperRepresentation> protocolMappers = client.getProtocolMappers();
    assertEquals(1, protocolMappers.size());
    ProtocolMapperRepresentation mapper = protocolMappers.get(0);
    assertEquals("foo", mapper.getName());
    ClientRepresentation newClient = new ClientRepresentation();
    newClient.setId(client.getId());
    newClient.setClientId(client.getClientId());
    ProtocolMapperRepresentation barMapper = new ProtocolMapperRepresentation();
    barMapper.setName("bar");
    barMapper.setProtocol("openid-connect");
    barMapper.setProtocolMapper("oidc-hardcoded-role-mapper");
    protocolMappers.add(barMapper);
    newClient.setProtocolMappers(protocolMappers);
    realm.clients().get(client.getId()).update(newClient);
    ClientRepresentation storedClient = realm.clients().get(client.getId()).toRepresentation();
    assertClient(client, storedClient);
}

Example 4 with AuthServerContainerExclude

use of org.keycloak.testsuite.arquillian.annotation.AuthServerContainerExclude in project keycloak by keycloak.

the class ClientTest method createClientVerify.

@Test
@AuthServerContainerExclude(AuthServer.REMOTE)
public void createClientVerify() {
    String id = createClient().getId();
    ClientResource client = realm.clients().get(id);
    assertNotNull(client);
    assertNull(client.toRepresentation().getSecret());
    Assert.assertNames(realm.clients().findAll(), "account", "account-console", "realm-management", "security-admin-console", "broker", "my-app", Constants.ADMIN_CLI_CLIENT_ID);
}

Example 5 with AuthServerContainerExclude

use of org.keycloak.testsuite.arquillian.annotation.AuthServerContainerExclude in project keycloak by keycloak.

the class ClientTest method serviceAccount.

@Test
@AuthServerContainerExclude(AuthServer.REMOTE)
public void serviceAccount() {
    Response response = realm.clients().create(ClientBuilder.create().clientId("serviceClient").serviceAccount().build());
    String id = ApiUtil.getCreatedId(response);
    getCleanup().addClientUuid(id);
    response.close();
    UserRepresentation userRep = realm.clients().get(id).getServiceAccountUser();
    assertEquals("service-account-serviceclient", userRep.getUsername());
    // KEYCLOAK-11197 service accounts are no longer created with a placeholder e-mail.
    assertNull(userRep.getEmail());
}