Examples with TestAuthenticationChannelRequest org.keycloak.testsuite.rest.representation.TestAuthenticationChannelRequest used on opensource projects

Example 16 with TestAuthenticationChannelRequest

use of org.keycloak.testsuite.rest.representation.TestAuthenticationChannelRequest in project keycloak by keycloak.

the class CIBATest method testTokenRevocation.

@Test
public void testTokenRevocation() throws Exception {
    ClientResource clientResource = null;
    ClientRepresentation clientRep = null;
    try {
        final String username = "nutzername-rot";
        final String bindingMessage = "BASTION";
        // prepare CIBA settings
        clientResource = ApiUtil.findClientByClientId(adminClient.realm(TEST_REALM_NAME), TEST_CLIENT_NAME);
        clientRep = clientResource.toRepresentation();
        prepareCIBASettings(clientResource, clientRep);
        oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
        // user Backchannel Authentication Request
        AuthenticationRequestAcknowledgement response = doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, bindingMessage);
        // user Authentication Channel Request
        TestAuthenticationChannelRequest authenticationChannelReq = doAuthenticationChannelRequest(bindingMessage);
        assertThat(authenticationChannelReq.getRequest().getScope(), is(containsString(OAuth2Constants.OFFLINE_ACCESS)));
        // user Authentication Channel completed
        EventRepresentation loginEvent = doAuthenticationChannelCallback(authenticationChannelReq);
        String sessionId = loginEvent.getSessionId();
        String codeId = loginEvent.getDetails().get(Details.CODE_ID);
        String userId = loginEvent.getUserId();
        // user Token Request
        OAuthClient.AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequest(username, response.getAuthReqId());
        // token introspection
        String tokenResponse = doIntrospectAccessTokenWithClientCredential(tokenRes, username);
        // token refresh
        tokenRes = doRefreshTokenRequest(tokenRes.getRefreshToken(), username, sessionId, true);
        // token introspection after token refresh
        tokenResponse = doIntrospectAccessTokenWithClientCredential(tokenRes, username);
        // revoke by refresh token
        EventRepresentation logoutEvent = doTokenRevokeByRefreshToken(tokenRes.getRefreshToken(), sessionId, userId, true);
    } finally {
        revertCIBASettings(clientResource, clientRep);
    }
}

Example 17 with TestAuthenticationChannelRequest

use of org.keycloak.testsuite.rest.representation.TestAuthenticationChannelRequest in project keycloak by keycloak.

the class TestingOIDCEndpointsApplicationResource method requestAuthenticationChannel.

@POST
@Path("/request-authentication-channel")
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@NoCache
public Response requestAuthenticationChannel(@Context HttpHeaders headers, AuthenticationChannelRequest request) {
    String rawBearerToken = AppAuthManager.extractAuthorizationHeaderToken(headers);
    AccessToken bearerToken;
    try {
        bearerToken = new JWSInput(rawBearerToken).readJsonContent(AccessToken.class);
    } catch (JWSInputException e) {
        throw new RuntimeException("Failed to parse bearer token", e);
    }
    // required
    String authenticationChannelId = bearerToken.getId();
    if (authenticationChannelId == null)
        throw new BadRequestException("missing parameter : " + HttpAuthenticationChannelProvider.AUTHENTICATION_CHANNEL_ID);
    String loginHint = request.getLoginHint();
    if (loginHint == null)
        throw new BadRequestException("missing parameter : " + CibaGrantType.LOGIN_HINT);
    if (request.getConsentRequired() == null)
        throw new BadRequestException("missing parameter : " + CibaGrantType.IS_CONSENT_REQUIRED);
    String scope = request.getScope();
    if (scope == null)
        throw new BadRequestException("missing parameter : " + OAuth2Constants.SCOPE);
    // optional
    // for testing purpose
    String bindingMessage = request.getBindingMessage();
    if (bindingMessage != null && bindingMessage.equals("GODOWN"))
        throw new BadRequestException("intentional error : GODOWN");
    // only one CIBA flow without binding_message can be accepted per test method by this test mechanism.
    if (bindingMessage == null)
        bindingMessage = ChannelRequestDummyKey;
    authenticationChannelRequests.put(bindingMessage, new TestAuthenticationChannelRequest(request, rawBearerToken));
    return Response.status(Status.CREATED).build();
}

Example 18 with TestAuthenticationChannelRequest

use of org.keycloak.testsuite.rest.representation.TestAuthenticationChannelRequest in project keycloak by keycloak.

the class CIBATest method testDifferentUserAuthenticated.

@Test
@Ignore("Should never happen because the AD does not send any information about the user but only the status of the authentication")
public void testDifferentUserAuthenticated() throws Exception {
    ClientResource clientResource = null;
    ClientRepresentation clientRep = null;
    try {
        final String usernameToBeAuthenticated = "nutzername-rot";
        final String usernameAuthenticated = "nutzername-gelb";
        final String bindingMessage = "BASTION";
        // prepare CIBA settings
        clientResource = ApiUtil.findClientByClientId(adminClient.realm(TEST_REALM_NAME), TEST_CLIENT_NAME);
        clientRep = clientResource.toRepresentation();
        prepareCIBASettings(clientResource, clientRep);
        oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
        // user Backchannel Authentication Request
        AuthenticationRequestAcknowledgement response = doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, usernameToBeAuthenticated, bindingMessage);
        // user Authentication Channel Request
        TestAuthenticationChannelRequest authenticationChannelReq = doAuthenticationChannelRequest(bindingMessage);
        assertThat(authenticationChannelReq.getRequest().getScope(), is(containsString(OAuth2Constants.OFFLINE_ACCESS)));
        // different user Authentication Channel completed
        // oauth.doAuthenticationChannelCallback(SECOND_TEST_CLIENT_NAME, SECOND_TEST_CLIENT_SECRET, usernameAuthenticated, authenticationChannelReq.getBearerToken(), SUCCEEDED);
        // user Token Request
        OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, response.getAuthReqId());
        assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
        assertThat(tokenRes.getError(), is(OAuthErrorException.INVALID_GRANT));
    } finally {
        revertCIBASettings(clientResource, clientRep);
    }
}

Example 19 with TestAuthenticationChannelRequest

use of org.keycloak.testsuite.rest.representation.TestAuthenticationChannelRequest in project keycloak by keycloak.

the class CIBATest method testMultipleClientsBackchannelAuthenticationFlows.

@Test
public void testMultipleClientsBackchannelAuthenticationFlows() throws Exception {
    ClientResource firstClientResource = null;
    ClientResource secondClientResource = null;
    ClientRepresentation firstClientRep = null;
    ClientRepresentation secondClientRep = null;
    try {
        final String username = "nutzername-gelb";
        // see testrealm.json
        final String firstClientName = "test-app-scope";
        final String secondClientName = TEST_CLIENT_NAME;
        final String firstClientPassword = "password";
        final String secondClientPassword = TEST_CLIENT_PASSWORD;
        String firstClientAuthReqId = null;
        String secondClientAuthReqId = null;
        firstClientResource = ApiUtil.findClientByClientId(adminClient.realm(TEST_REALM_NAME), firstClientName);
        assertThat(firstClientResource, notNullValue());
        firstClientRep = firstClientResource.toRepresentation();
        prepareCIBASettings(firstClientResource, firstClientRep);
        secondClientResource = ApiUtil.findClientByClientId(adminClient.realm(TEST_REALM_NAME), secondClientName);
        assertThat(secondClientResource, notNullValue());
        secondClientRep = secondClientResource.toRepresentation();
        prepareCIBASettings(secondClientResource, secondClientRep);
        // first client Backchannel Authentication Request
        AuthenticationRequestAcknowledgement response = doBackchannelAuthenticationRequest(firstClientName, firstClientPassword, username, "asdfghjkl");
        firstClientAuthReqId = response.getAuthReqId();
        // first client Authentication Channel Request
        TestAuthenticationChannelRequest firstClientAuthenticationChannelReq = doAuthenticationChannelRequest("asdfghjkl");
        // first client Authentication Channel completed
        EventRepresentation firstClientloginEvent = doAuthenticationChannelCallback(firstClientAuthenticationChannelReq);
        // second client Backchannel Authentication Request
        response = doBackchannelAuthenticationRequest(secondClientName, secondClientPassword, username, "qwertyui");
        secondClientAuthReqId = response.getAuthReqId();
        // second client Authentication Channel Request
        TestAuthenticationChannelRequest secondClientAuthenticationChannelReq = doAuthenticationChannelRequest("qwertyui");
        // second client Authentication Channel completed
        EventRepresentation secondClientloginEvent = doAuthenticationChannelCallback(secondClientAuthenticationChannelReq);
        // second client Token Request
        OAuthClient.AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequest(secondClientName, secondClientPassword, username, secondClientAuthReqId);
        // first client Token Request
        tokenRes = doBackchannelAuthenticationTokenRequest(firstClientName, firstClientPassword, username, firstClientAuthReqId);
    } finally {
        revertCIBASettings(firstClientResource, firstClientRep);
        revertCIBASettings(secondClientResource, secondClientRep);
    }
}

Example 20 with TestAuthenticationChannelRequest

use of org.keycloak.testsuite.rest.representation.TestAuthenticationChannelRequest in project keycloak by keycloak.

the class CIBATest method testAuthenticationChannelErrorCase.

private void testAuthenticationChannelErrorCase(Status statusCallback, Status statusTokenEndpont, AuthenticationChannelResponse.Status authStatus, String error, String errorEvent) throws Exception {
    ClientResource clientResource = null;
    ClientRepresentation clientRep = null;
    try {
        final String username = "nutzername-rot";
        // prepare CIBA settings
        clientResource = ApiUtil.findClientByClientId(adminClient.realm(TEST_REALM_NAME), TEST_CLIENT_NAME);
        assertThat(clientResource, notNullValue());
        clientRep = clientResource.toRepresentation();
        prepareCIBASettings(clientResource, clientRep);
        // user Backchannel Authentication Request
        AuthenticationRequestAcknowledgement response = doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, "kwq26rfjs73");
        // user Authentication Channel Request
        TestAuthenticationChannelRequest authenticationChannelReq = doAuthenticationChannelRequest("kwq26rfjs73");
        // user Authentication Channel completed
        doAuthenticationChannelCallbackError(statusCallback, TEST_CLIENT_NAME, authenticationChannelReq, authStatus, username, errorEvent);
        // user Token Request
        OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(TEST_CLIENT_PASSWORD, response.getAuthReqId());
        assertThat(tokenRes.getStatusCode(), is(equalTo(statusTokenEndpont.getStatusCode())));
        assertThat(tokenRes.getError(), is(error));
    } finally {
        revertCIBASettings(clientResource, clientRep);
    }
}