Search in sources :

Example 1 with IDP_SAML_ALIAS

use of org.keycloak.testsuite.broker.BrokerTestConstants.IDP_SAML_ALIAS in project keycloak by keycloak.

the class KcSamlBrokerFrontendUrlTest method testFrontendUrlInDestinationExpected.

@Test
public void testFrontendUrlInDestinationExpected() throws URISyntaxException {
    SAMLDocumentHolder samlResponse = clientBuilderTrustingAllCertificates().idpInitiatedLogin(new URI(proxy.getUrl() + "/realms/" + bc.consumerRealmName() + "/protocol/saml"), "sales-post").build().login().idp(IDP_SAML_ALIAS).build().processSamlResponse(// AuthnRequest to producer IdP
    SamlClient.Binding.POST).targetAttributeSamlRequest().build().login().user(USER_LOGIN, USER_PASSWORD).build().processSamlResponse(SamlClient.Binding.POST).transformObject(saml2Object -> {
        assertThat(saml2Object, Matchers.isSamlResponse(JBossSAMLURIConstants.STATUS_SUCCESS));
        ResponseType response = (ResponseType) saml2Object;
        assertThat(response.getDestination(), startsWith(proxy.getUrl()));
        return saml2Object;
    }).build().updateProfile().username(USER_LOGIN).email(USER_EMAIL).firstName("Firstname").lastName("Lastname").build().followOneRedirect().getSamlResponse(SamlClient.Binding.POST);
    assertThat(samlResponse.getSamlObject(), Matchers.isSamlResponse(JBossSAMLURIConstants.STATUS_SUCCESS));
}
Also used : ReverseProxy(org.keycloak.testsuite.util.ReverseProxy) USER_PASSWORD(org.keycloak.testsuite.broker.BrokerTestConstants.USER_PASSWORD) IDP_SAML_ALIAS(org.keycloak.testsuite.broker.BrokerTestConstants.IDP_SAML_ALIAS) URISyntaxException(java.net.URISyntaxException) AssertEvents(org.keycloak.testsuite.AssertEvents) HashMap(java.util.HashMap) CoreMatchers.startsWith(org.hamcrest.CoreMatchers.startsWith) ResponseType(org.keycloak.dom.saml.v2.protocol.ResponseType) KeyStoreException(java.security.KeyStoreException) USER_EMAIL(org.keycloak.testsuite.broker.BrokerTestConstants.USER_EMAIL) ArrayList(java.util.ArrayList) BrokerTestTools.getConsumerRoot(org.keycloak.testsuite.broker.BrokerTestTools.getConsumerRoot) Map(java.util.Map) SamlClient(org.keycloak.testsuite.util.SamlClient) NoopHostnameVerifier(org.apache.http.conn.ssl.NoopHostnameVerifier) URI(java.net.URI) MatcherAssert.assertThat(org.hamcrest.MatcherAssert.assertThat) SAMLDocumentHolder(org.keycloak.saml.processing.core.saml.v2.common.SAMLDocumentHolder) Errors(org.keycloak.events.Errors) CoreMatchers.containsString(org.hamcrest.CoreMatchers.containsString) Matchers(org.keycloak.testsuite.util.Matchers) JBossSAMLURIConstants(org.keycloak.saml.common.constants.JBossSAMLURIConstants) Test(org.junit.Test) EventType(org.keycloak.events.EventType) KeyManagementException(java.security.KeyManagementException) SSLContextBuilder(org.apache.http.ssl.SSLContextBuilder) RealmRepresentation(org.keycloak.representations.idm.RealmRepresentation) ClientRepresentation(org.keycloak.representations.idm.ClientRepresentation) URLEncoder(java.net.URLEncoder) List(java.util.List) Rule(org.junit.Rule) USER_LOGIN(org.keycloak.testsuite.broker.BrokerTestConstants.USER_LOGIN) Ignore(org.junit.Ignore) Response(javax.ws.rs.core.Response) REALM_CONS_NAME(org.keycloak.testsuite.broker.BrokerTestConstants.REALM_CONS_NAME) BrokerTestTools.waitForPage(org.keycloak.testsuite.broker.BrokerTestTools.waitForPage) NoSuchAlgorithmException(java.security.NoSuchAlgorithmException) HttpClientBuilder(org.apache.http.impl.client.HttpClientBuilder) UnsupportedEncodingException(java.io.UnsupportedEncodingException) TrustAllStrategy(org.apache.http.conn.ssl.TrustAllStrategy) SamlClientBuilder(org.keycloak.testsuite.util.SamlClientBuilder) SAMLDocumentHolder(org.keycloak.saml.processing.core.saml.v2.common.SAMLDocumentHolder) URI(java.net.URI) ResponseType(org.keycloak.dom.saml.v2.protocol.ResponseType) Test(org.junit.Test)

Example 2 with IDP_SAML_ALIAS

use of org.keycloak.testsuite.broker.BrokerTestConstants.IDP_SAML_ALIAS in project keycloak by keycloak.

the class KcSamlBrokerSessionNotOnOrAfterTest method testConsumerIdpInitiatedLoginContainsSessionNotOnOrAfter.

@Test
public void testConsumerIdpInitiatedLoginContainsSessionNotOnOrAfter() throws Exception {
    SAMLDocumentHolder samlResponse = new SamlClientBuilder().idpInitiatedLogin(getConsumerSamlEndpoint(REALM_CONS_NAME), "sales-post").build().login().idp(IDP_SAML_ALIAS).build().processSamlResponse(// AuthnRequest to producer IdP
    SamlClient.Binding.POST).targetAttributeSamlRequest().build().login().user(USER_LOGIN, USER_PASSWORD).build().processSamlResponse(SamlClient.Binding.POST).build().updateProfile().username(USER_LOGIN).email(USER_EMAIL).firstName("Firstname").lastName("Lastname").build().followOneRedirect().getSamlResponse(SamlClient.Binding.POST);
    assertThat(samlResponse.getSamlObject(), Matchers.isSamlResponse(JBossSAMLURIConstants.STATUS_SUCCESS));
    ResponseType resp = (ResponseType) samlResponse.getSamlObject();
    Set<StatementAbstractType> statements = resp.getAssertions().get(0).getAssertion().getStatements();
    AuthnStatementType authType = statements.stream().filter(statement -> statement instanceof AuthnStatementType).map(s -> (AuthnStatementType) s).findFirst().orElse(null);
    assertThat(authType, notNullValue());
    assertThat(authType.getSessionNotOnOrAfter(), notNullValue());
    assertThat(authType.getSessionNotOnOrAfter(), is(XMLTimeUtil.add(authType.getAuthnInstant(), adminClient.realm(REALM_CONS_NAME).toRepresentation().getSsoSessionMaxLifespan() * 1000)));
}
Also used : AuthnStatementType(org.keycloak.dom.saml.v2.assertion.AuthnStatementType) XMLTimeUtil(org.keycloak.saml.processing.core.saml.v2.util.XMLTimeUtil) USER_PASSWORD(org.keycloak.testsuite.broker.BrokerTestConstants.USER_PASSWORD) IDP_SAML_ALIAS(org.keycloak.testsuite.broker.BrokerTestConstants.IDP_SAML_ALIAS) Matchers.notNullValue(org.hamcrest.Matchers.notNullValue) Matchers(org.keycloak.testsuite.util.Matchers) JBossSAMLURIConstants(org.keycloak.saml.common.constants.JBossSAMLURIConstants) Set(java.util.Set) Test(org.junit.Test) ResponseType(org.keycloak.dom.saml.v2.protocol.ResponseType) USER_EMAIL(org.keycloak.testsuite.broker.BrokerTestConstants.USER_EMAIL) Assert.assertThat(org.junit.Assert.assertThat) USER_LOGIN(org.keycloak.testsuite.broker.BrokerTestConstants.USER_LOGIN) AuthnStatementType(org.keycloak.dom.saml.v2.assertion.AuthnStatementType) StatementAbstractType(org.keycloak.dom.saml.v2.assertion.StatementAbstractType) REALM_CONS_NAME(org.keycloak.testsuite.broker.BrokerTestConstants.REALM_CONS_NAME) SamlClient(org.keycloak.testsuite.util.SamlClient) Matchers.is(org.hamcrest.Matchers.is) SAMLDocumentHolder(org.keycloak.saml.processing.core.saml.v2.common.SAMLDocumentHolder) SamlClientBuilder(org.keycloak.testsuite.util.SamlClientBuilder) SAMLDocumentHolder(org.keycloak.saml.processing.core.saml.v2.common.SAMLDocumentHolder) SamlClientBuilder(org.keycloak.testsuite.util.SamlClientBuilder) StatementAbstractType(org.keycloak.dom.saml.v2.assertion.StatementAbstractType) ResponseType(org.keycloak.dom.saml.v2.protocol.ResponseType) Test(org.junit.Test)

Example 3 with IDP_SAML_ALIAS

use of org.keycloak.testsuite.broker.BrokerTestConstants.IDP_SAML_ALIAS in project keycloak by keycloak.

the class KcSamlLogoutTest method testProviderInitiatedLogoutCorrectlyLogsOutConsumerClients.

@Test
public void testProviderInitiatedLogoutCorrectlyLogsOutConsumerClients() throws Exception {
    try (SamlMessageReceiver logoutReceiver = new SamlMessageReceiver(8082);
        ClientAttributeUpdater cauConsumer = ClientAttributeUpdater.forClient(adminClient, bc.consumerRealmName(), AbstractSamlTest.SAML_CLIENT_ID_SALES_POST).setFrontchannelLogout(false).setAttribute(SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_POST_ATTRIBUTE, logoutReceiver.getUrl()).update();
        ClientAttributeUpdater cauProvider = ClientAttributeUpdater.forClient(adminClient, bc.providerRealmName(), bc.getIDPClientIdInProviderRealm()).setFrontchannelLogout(true).update()) {
        AuthnRequestType loginRep = SamlClient.createLoginRequestDocument(AbstractSamlTest.SAML_CLIENT_ID_SALES_POST, getConsumerRoot() + "/sales-post/saml", null);
        Document doc = SAML2Request.convert(loginRep);
        final AtomicReference<NameIDType> nameIdRef = new AtomicReference<>();
        final AtomicReference<String> sessionIndexRef = new AtomicReference<>();
        new SamlClientBuilder().authnRequest(getConsumerSamlEndpoint(bc.consumerRealmName()), doc, SamlClient.Binding.POST).build().login().idp(bc.getIDPAlias()).build().processSamlResponse(// AuthnRequest to producer IdP
        SamlClient.Binding.POST).targetAttributeSamlRequest().build().login().user(bc.getUserLogin(), bc.getUserPassword()).build().processSamlResponse(// Response from producer IdP
        SamlClient.Binding.POST).build().updateProfile().firstName("a").lastName("b").email(bc.getUserEmail()).username(bc.getUserLogin()).build().followOneRedirect().processSamlResponse(SamlClient.Binding.POST).transformObject(saml2Object -> {
            assertThat(saml2Object, Matchers.notNullValue());
            assertThat(saml2Object, isSamlResponse(JBossSAMLURIConstants.STATUS_SUCCESS));
            return null;
        }).build().authnRequest(getProviderSamlEndpoint(bc.providerRealmName()), PROVIDER_SAML_CLIENT_ID, PROVIDER_SAML_CLIENT_ID + "saml", POST).build().followOneRedirect().processSamlResponse(POST).transformObject(saml2Object -> {
            assertThat(saml2Object, isSamlResponse(JBossSAMLURIConstants.STATUS_SUCCESS));
            ResponseType loginResp1 = (ResponseType) saml2Object;
            final AssertionType firstAssertion = loginResp1.getAssertions().get(0).getAssertion();
            assertThat(firstAssertion, Matchers.notNullValue());
            assertThat(firstAssertion.getSubject().getSubType().getBaseID(), instanceOf(NameIDType.class));
            NameIDType nameId = (NameIDType) firstAssertion.getSubject().getSubType().getBaseID();
            AuthnStatementType firstAssertionStatement = (AuthnStatementType) firstAssertion.getStatements().iterator().next();
            nameIdRef.set(nameId);
            sessionIndexRef.set(firstAssertionStatement.getSessionIndex());
            return null;
        }).build().logoutRequest(getProviderSamlEndpoint(bc.providerRealmName()), PROVIDER_SAML_CLIENT_ID, POST).nameId(nameIdRef::get).sessionIndex(sessionIndexRef::get).build().processSamlResponse(POST).transformObject(saml2Object -> {
            assertThat(saml2Object, isSamlLogoutRequest(getConsumerRoot() + "/auth/realms/" + REALM_CONS_NAME + "/broker/" + IDP_SAML_ALIAS + "/endpoint"));
            return saml2Object;
        }).build().executeAndTransform(response -> {
            SAMLDocumentHolder saml2ObjectHolder = POST.extractResponse(response);
            assertThat(saml2ObjectHolder.getSamlObject(), isSamlStatusResponse(JBossSAMLURIConstants.STATUS_SUCCESS));
            return null;
        });
        // Check whether logoutReceiver contains correct LogoutRequest
        assertThat(logoutReceiver.isMessageReceived(), is(true));
        SAMLDocumentHolder message = logoutReceiver.getSamlDocumentHolder();
        assertThat(message.getSamlObject(), isSamlLogoutRequest(logoutReceiver.getUrl()));
    }
}
Also used : CoreMatchers.is(org.hamcrest.CoreMatchers.is) AbstractSamlTest(org.keycloak.testsuite.saml.AbstractSamlTest) ClientAttributeUpdater(org.keycloak.testsuite.updaters.ClientAttributeUpdater) IDP_SAML_ALIAS(org.keycloak.testsuite.broker.BrokerTestConstants.IDP_SAML_ALIAS) SAML2Request(org.keycloak.saml.processing.api.saml.v2.request.SAML2Request) IdentityProviderAttributeUpdater(org.keycloak.testsuite.updaters.IdentityProviderAttributeUpdater) ResponseType(org.keycloak.dom.saml.v2.protocol.ResponseType) SamlConfigAttributes(org.keycloak.protocol.saml.SamlConfigAttributes) POST(org.keycloak.testsuite.util.SamlClient.Binding.POST) Matchers.isSamlLogoutRequest(org.keycloak.testsuite.util.Matchers.isSamlLogoutRequest) AtomicReference(java.util.concurrent.atomic.AtomicReference) CoreMatchers.instanceOf(org.hamcrest.CoreMatchers.instanceOf) BrokerTestTools.getConsumerRoot(org.keycloak.testsuite.broker.BrokerTestTools.getConsumerRoot) SAMLIdentityProviderConfig(org.keycloak.broker.saml.SAMLIdentityProviderConfig) AuthnStatementType(org.keycloak.dom.saml.v2.assertion.AuthnStatementType) Document(org.w3c.dom.Document) SamlClient(org.keycloak.testsuite.util.SamlClient) MatcherAssert.assertThat(org.hamcrest.MatcherAssert.assertThat) SAMLDocumentHolder(org.keycloak.saml.processing.core.saml.v2.common.SAMLDocumentHolder) Matchers.isSamlResponse(org.keycloak.testsuite.util.Matchers.isSamlResponse) AuthnRequestType(org.keycloak.dom.saml.v2.protocol.AuthnRequestType) JBossSAMLURIConstants(org.keycloak.saml.common.constants.JBossSAMLURIConstants) Matchers(org.hamcrest.Matchers) Test(org.junit.Test) SamlProtocol(org.keycloak.protocol.saml.SamlProtocol) AssertionType(org.keycloak.dom.saml.v2.assertion.AssertionType) NameIDType(org.keycloak.dom.saml.v2.assertion.NameIDType) ClientRepresentation(org.keycloak.representations.idm.ClientRepresentation) List(java.util.List) UserAttributeUpdater(org.keycloak.testsuite.updaters.UserAttributeUpdater) REALM_CONS_NAME(org.keycloak.testsuite.broker.BrokerTestConstants.REALM_CONS_NAME) Closeable(java.io.Closeable) ATTRIBUTE_TO_MAP_NAME(org.keycloak.testsuite.broker.KcOidcBrokerConfiguration.ATTRIBUTE_TO_MAP_NAME) ClientBuilder(org.keycloak.testsuite.util.ClientBuilder) Matchers.isSamlStatusResponse(org.keycloak.testsuite.util.Matchers.isSamlStatusResponse) SamlMessageReceiver(org.keycloak.testsuite.util.saml.SamlMessageReceiver) BrokerTestTools.getProviderRoot(org.keycloak.testsuite.broker.BrokerTestTools.getProviderRoot) SamlPrincipalType(org.keycloak.protocol.saml.SamlPrincipalType) SamlClientBuilder(org.keycloak.testsuite.util.SamlClientBuilder) SamlClientBuilder(org.keycloak.testsuite.util.SamlClientBuilder) AtomicReference(java.util.concurrent.atomic.AtomicReference) AssertionType(org.keycloak.dom.saml.v2.assertion.AssertionType) Document(org.w3c.dom.Document) SamlMessageReceiver(org.keycloak.testsuite.util.saml.SamlMessageReceiver) ResponseType(org.keycloak.dom.saml.v2.protocol.ResponseType) ClientAttributeUpdater(org.keycloak.testsuite.updaters.ClientAttributeUpdater) AuthnStatementType(org.keycloak.dom.saml.v2.assertion.AuthnStatementType) SAMLDocumentHolder(org.keycloak.saml.processing.core.saml.v2.common.SAMLDocumentHolder) AuthnRequestType(org.keycloak.dom.saml.v2.protocol.AuthnRequestType) NameIDType(org.keycloak.dom.saml.v2.assertion.NameIDType) AbstractSamlTest(org.keycloak.testsuite.saml.AbstractSamlTest) Test(org.junit.Test)

Aggregations

Test (org.junit.Test)3 ResponseType (org.keycloak.dom.saml.v2.protocol.ResponseType)3 JBossSAMLURIConstants (org.keycloak.saml.common.constants.JBossSAMLURIConstants)3 SAMLDocumentHolder (org.keycloak.saml.processing.core.saml.v2.common.SAMLDocumentHolder)3 IDP_SAML_ALIAS (org.keycloak.testsuite.broker.BrokerTestConstants.IDP_SAML_ALIAS)3 REALM_CONS_NAME (org.keycloak.testsuite.broker.BrokerTestConstants.REALM_CONS_NAME)3 SamlClient (org.keycloak.testsuite.util.SamlClient)3 SamlClientBuilder (org.keycloak.testsuite.util.SamlClientBuilder)3 List (java.util.List)2 MatcherAssert.assertThat (org.hamcrest.MatcherAssert.assertThat)2 AuthnStatementType (org.keycloak.dom.saml.v2.assertion.AuthnStatementType)2 ClientRepresentation (org.keycloak.representations.idm.ClientRepresentation)2 USER_EMAIL (org.keycloak.testsuite.broker.BrokerTestConstants.USER_EMAIL)2 USER_LOGIN (org.keycloak.testsuite.broker.BrokerTestConstants.USER_LOGIN)2 USER_PASSWORD (org.keycloak.testsuite.broker.BrokerTestConstants.USER_PASSWORD)2 BrokerTestTools.getConsumerRoot (org.keycloak.testsuite.broker.BrokerTestTools.getConsumerRoot)2 Matchers (org.keycloak.testsuite.util.Matchers)2 Closeable (java.io.Closeable)1 UnsupportedEncodingException (java.io.UnsupportedEncodingException)1 URI (java.net.URI)1