Examples with TestOIDCEndpointsApplicationResource org.keycloak.testsuite.client.resources.TestOIDCEndpointsApplicationResource used on opensource projects

Example 41 with TestOIDCEndpointsApplicationResource

use of org.keycloak.testsuite.client.resources.TestOIDCEndpointsApplicationResource in project keycloak by keycloak.

the class FAPICIBATest method doAuthenticationChannelRequest.

private TestAuthenticationChannelRequest doAuthenticationChannelRequest(String bindingMessage) {
    // get Authentication Channel Request keycloak has done on Backchannel Authentication Endpoint from the FIFO queue of testing Authentication Channel Request API
    TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
    TestAuthenticationChannelRequest authenticationChannelReq = oidcClientEndpointsResource.getAuthenticationChannel(bindingMessage);
    return authenticationChannelReq;
}

Example 42 with TestOIDCEndpointsApplicationResource

use of org.keycloak.testsuite.client.resources.TestOIDCEndpointsApplicationResource in project keycloak by keycloak.

the class FAPICIBATest method registerSharedAuthenticationRequest.

private String registerSharedAuthenticationRequest(AuthorizationEndpointRequestObject requestObject, String clientId, String sigAlg) throws URISyntaxException, IOException {
    TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
    // register request object
    byte[] contentBytes = JsonSerialization.writeValueAsBytes(requestObject);
    String encodedRequestObject = Base64Url.encode(contentBytes);
    oidcClientEndpointsResource.generateKeys(sigAlg);
    oidcClientEndpointsResource.registerOIDCRequest(encodedRequestObject, sigAlg);
    return oidcClientEndpointsResource.getOIDCRequest();
}

Example 43 with TestOIDCEndpointsApplicationResource

use of org.keycloak.testsuite.client.resources.TestOIDCEndpointsApplicationResource in project keycloak by keycloak.

the class FAPICIBATest method testFAPICIBAUserAuthenticationCancelled.

@Test
public void testFAPICIBAUserAuthenticationCancelled() throws Exception {
    // this test is the same as conformance suite's "fapi-ciba-id1-user-rejects-authentication" test that can only be checked manually
    // by kc-sig-fapi's automated conformance testing environment.
    setupPolicyFAPICIBAForAllClient();
    // Register client with private-key-jwt
    String clientUUID = createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
        clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID);
        setClientAuthMethodNeutralSettings(clientRep);
    });
    ClientResource clientResource = adminClient.realm(REALM_NAME).clients().get(clientUUID);
    ClientRepresentation client = clientResource.toRepresentation();
    assertEquals(JWTClientAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
    // prepare valid signed authentication request
    AuthorizationEndpointRequestObject requestObject = createFAPIValidAuthorizationEndpointRequestObject(username, bindingMessage);
    String encodedRequestObject = registerSharedAuthenticationRequest(requestObject, clientId, Algorithm.PS256);
    // Get keys of client. Will be used for client authentication and signing of authentication request
    TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
    Map<String, String> generatedKeys = oidcClientEndpointsResource.getKeysAsBase64();
    KeyPair keyPair = getKeyPairFromGeneratedBase64(generatedKeys, Algorithm.PS256);
    PrivateKey privateKey = keyPair.getPrivate();
    PublicKey publicKey = keyPair.getPublic();
    String signedJwt = createSignedRequestToken(clientId, privateKey, publicKey, org.keycloak.crypto.Algorithm.PS256);
    // user Backchannel Authentication Request
    AuthenticationRequestAcknowledgement response = doBackchannelAuthenticationRequestWithClientSignedJWT(signedJwt, encodedRequestObject, () -> MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore());
    assertThat(response.getStatusCode(), is(equalTo(200)));
    // user Authentication Channel Request
    TestAuthenticationChannelRequest testRequest = doAuthenticationChannelRequest(bindingMessage);
    AuthenticationChannelRequest authenticationChannelReq = testRequest.getRequest();
    assertThat(authenticationChannelReq.getBindingMessage(), is(equalTo(bindingMessage)));
    assertThat(authenticationChannelReq.getScope(), is(containsString(OAuth2Constants.SCOPE_OPENID)));
    // user Authentication Channel completed
    doAuthenticationChannelCallbackCancelled(testRequest);
    String signedJwt2 = createSignedRequestToken(clientId, privateKey, publicKey, org.keycloak.crypto.Algorithm.PS256);
    // user Token Request
    OAuthClient.AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequestWithClientSignedJWT(signedJwt2, response.getAuthReqId(), () -> MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore());
    assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
    assertThat(tokenRes.getError(), is(equalTo(OAuthErrorException.ACCESS_DENIED)));
    assertThat(tokenRes.getErrorDescription(), is(equalTo("not authorized")));
}

Example 44 with TestOIDCEndpointsApplicationResource

use of org.keycloak.testsuite.client.resources.TestOIDCEndpointsApplicationResource in project keycloak by keycloak.

the class ClientAuthSignedJWTTest method setupJwks.

private KeyPair setupJwks(String algorithm, ClientRepresentation clientRepresentation, ClientResource clientResource) throws Exception {
    // generate and register client keypair
    TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
    oidcClientEndpointsResource.generateKeys(algorithm);
    Map<String, String> generatedKeys = oidcClientEndpointsResource.getKeysAsBase64();
    KeyPair keyPair = getKeyPairFromGeneratedBase64(generatedKeys, algorithm);
    // use and set JWKS
    OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRepresentation).setUseJwksString(true);
    JSONWebKeySet keySet = oidcClientEndpointsResource.getJwks();
    OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRepresentation).setJwksString(JsonSerialization.writeValueAsString(keySet));
    clientResource.update(clientRepresentation);
    // set time offset, so that new keys are downloaded
    setTimeOffset(20);
    return keyPair;
}

Example 45 with TestOIDCEndpointsApplicationResource

use of org.keycloak.testsuite.client.resources.TestOIDCEndpointsApplicationResource in project keycloak by keycloak.

the class ParTest method testIgnoreParameterIfNotSetinRequestObject.

@Test
public void testIgnoreParameterIfNotSetinRequestObject() throws Exception {
    try {
        // setup PAR realm settings
        int requestUriLifespan = 45;
        setParRealmSettings(requestUriLifespan);
        // create client dynamically
        String clientId = createClientDynamically(generateSuffixedName(CLIENT_NAME), (OIDCClientRepresentation clientRep) -> {
            clientRep.setRequirePushedAuthorizationRequests(Boolean.TRUE);
            clientRep.setRedirectUris(new ArrayList<>(Arrays.asList(CLIENT_REDIRECT_URI)));
        });
        oauth.clientId(clientId);
        OIDCClientRepresentation oidcCRep = getClientDynamically(clientId);
        String clientSecret = oidcCRep.getClientSecret();
        assertEquals(Boolean.TRUE, oidcCRep.getRequirePushedAuthorizationRequests());
        assertTrue(oidcCRep.getRedirectUris().contains(CLIENT_REDIRECT_URI));
        assertEquals(OIDCLoginProtocol.CLIENT_SECRET_BASIC, oidcCRep.getTokenEndpointAuthMethod());
        TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject requestObject = new TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject();
        requestObject.id(KeycloakModelUtils.generateId());
        requestObject.iat(Long.valueOf(Time.currentTime()));
        requestObject.exp(requestObject.getIat() + Long.valueOf(300));
        requestObject.nbf(requestObject.getIat());
        requestObject.setClientId(oauth.getClientId());
        requestObject.setResponseType("code");
        requestObject.setRedirectUriParam(CLIENT_REDIRECT_URI);
        requestObject.setScope("openid");
        requestObject.setNonce(KeycloakModelUtils.generateId());
        byte[] contentBytes = JsonSerialization.writeValueAsBytes(requestObject);
        String encodedRequestObject = Base64Url.encode(contentBytes);
        TestOIDCEndpointsApplicationResource client = testingClient.testApp().oidcClientEndpoints();
        // use and set jwks_url
        ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm(oauth.getRealm()), oauth.getClientId());
        ClientRepresentation clientRep = clientResource.toRepresentation();
        OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setUseJwksUrl(true);
        OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setJwksUrl(TestApplicationResourceUrls.clientJwksUri());
        clientResource.update(clientRep);
        client.generateKeys(org.keycloak.crypto.Algorithm.RS256);
        client.registerOIDCRequest(encodedRequestObject, org.keycloak.crypto.Algorithm.RS256);
        // do not send any other parameter but the request request parameter
        oauth.request(client.getOIDCRequest());
        oauth.responseType("code id_token");
        oauth.redirectUri("http://invalid");
        oauth.scope(null);
        oauth.nonce("12345");
        ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
        assertEquals(201, pResp.getStatusCode());
        String requestUri = pResp.getRequestUri();
        assertEquals(requestUriLifespan, pResp.getExpiresIn());
        oauth.scope("invalid");
        oauth.redirectUri("http://invalid");
        oauth.responseType("invalid");
        oauth.redirectUri(null);
        oauth.nonce("12345");
        oauth.request(null);
        oauth.requestUri(requestUri);
        String wrongState = oauth.stateParamRandom().getState();
        oauth.stateParamHardcoded(wrongState);
        OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
        assertNull(loginResponse.getState());
        assertNotEquals(requestObject.getState(), wrongState);
        // Token Request
        // get tokens, it needed. https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
        oauth.redirectUri(CLIENT_REDIRECT_URI);
        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(loginResponse.getCode(), clientSecret);
        assertEquals(200, res.getStatusCode());
        oauth.verifyToken(res.getAccessToken());
        IDToken idToken = oauth.verifyIDToken(res.getIdToken());
        assertEquals(requestObject.getNonce(), idToken.getNonce());
    } finally {
        restoreParRealmSettings();
    }
}