Examples with AuthorizationEndpointRequestObject org.keycloak.testsuite.rest.resource.TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject used on opensource projects

Example 6 with AuthorizationEndpointRequestObject

use of org.keycloak.testsuite.rest.resource.TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject in project keycloak by keycloak.

the class FAPICIBATest method testFAPICIBALoginWithMTLS.

@Test
public void testFAPICIBALoginWithMTLS() throws Exception {
    setupPolicyFAPICIBAForAllClient();
    // Register client with X509
    String clientUUID = createClientByAdmin("foo", (ClientRepresentation clientRep) -> {
        clientRep.setClientAuthenticatorType(X509ClientAuthenticator.PROVIDER_ID);
        OIDCAdvancedConfigWrapper clientConfig = OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep);
        clientConfig.setRequestUris(Collections.singletonList(TestApplicationResourceUrls.clientRequestUri()));
        clientConfig.setTlsClientAuthSubjectDn("EMAILADDRESS=contact@keycloak.org, CN=Keycloak Intermediate CA, OU=Keycloak, O=Red Hat, ST=MA, C=US");
        setClientAuthMethodNeutralSettings(clientRep);
    });
    ClientResource clientResource = adminClient.realm(REALM_NAME).clients().get(clientUUID);
    ClientRepresentation client = clientResource.toRepresentation();
    assertEquals(X509ClientAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
    // prepare valid signed authentication request
    AuthorizationEndpointRequestObject requestObject = createFAPIValidAuthorizationEndpointRequestObject(username, bindingMessage);
    String encodedRequestObject = registerSharedAuthenticationRequest(requestObject, clientId, Algorithm.PS256);
    // user Backchannel Authentication Request
    AuthenticationRequestAcknowledgement response = doBackchannelAuthenticationRequestWithMTLS(clientId, encodedRequestObject, () -> MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore());
    assertThat(response.getStatusCode(), is(equalTo(200)));
    // user Authentication Channel Request
    TestAuthenticationChannelRequest testRequest = doAuthenticationChannelRequest(bindingMessage);
    AuthenticationChannelRequest authenticationChannelReq = testRequest.getRequest();
    assertThat(authenticationChannelReq.getBindingMessage(), is(equalTo(bindingMessage)));
    assertThat(authenticationChannelReq.getScope(), is(containsString(OAuth2Constants.SCOPE_OPENID)));
    // user Authentication Channel completed
    doAuthenticationChannelCallback(testRequest);
    // user Token Request
    OAuthClient.AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequestWithMTLS(clientId, response.getAuthReqId(), () -> MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore());
    verifyBackchannelAuthenticationTokenRequest(tokenRes, clientId, username);
    // Logout and remove consent of the user for next logins
    logoutUserAndRevokeConsent(clientId, username);
}

Example 7 with AuthorizationEndpointRequestObject

use of org.keycloak.testsuite.rest.resource.TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject in project keycloak by keycloak.

the class FAPICIBATest method createFAPIValidAuthorizationEndpointRequestObject.

private AuthorizationEndpointRequestObject createFAPIValidAuthorizationEndpointRequestObject(String username, String bindingMessage) throws Exception {
    AuthorizationEndpointRequestObject requestObject = createValidAuthorizationEndpointRequestObject(username, bindingMessage);
    requestObject.exp(requestObject.getIat() + Long.valueOf(300));
    requestObject.nbf(requestObject.getIat());
    requestObject.audience(Urls.realmIssuer(new URI(suiteContext.getAuthServerInfo().getContextRoot().toString() + "/auth"), REALM_NAME));
    requestObject.issuer(clientId);
    requestObject.id(org.keycloak.models.utils.KeycloakModelUtils.generateId());
    requestObject.iat(Long.valueOf(Time.currentTime()));
    return requestObject;
}

Example 8 with AuthorizationEndpointRequestObject

use of org.keycloak.testsuite.rest.resource.TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject in project keycloak by keycloak.

the class AbstractClientPoliciesTest method createValidRequestObjectForSecureRequestObjectExecutor.

// Request Object utility
protected AuthorizationEndpointRequestObject createValidRequestObjectForSecureRequestObjectExecutor(String clientId) throws URISyntaxException {
    AuthorizationEndpointRequestObject requestObject = new AuthorizationEndpointRequestObject();
    requestObject.id(KeycloakModelUtils.generateId());
    requestObject.iat(Long.valueOf(Time.currentTime()));
    requestObject.exp(requestObject.getIat() + Long.valueOf(300));
    requestObject.nbf(requestObject.getIat());
    requestObject.setClientId(clientId);
    requestObject.setResponseType("code");
    requestObject.setRedirectUriParam(oauth.getRedirectUri());
    requestObject.setScope("openid");
    String state = KeycloakModelUtils.generateId();
    oauth.stateParamHardcoded(state);
    requestObject.setState(state);
    requestObject.setMax_age(Integer.valueOf(600));
    requestObject.setOtherClaims("custom_claim_ein", "rot");
    requestObject.audience(Urls.realmIssuer(new URI(suiteContext.getAuthServerInfo().getContextRoot().toString() + "/auth"), REALM_NAME), "https://example.com");
    requestObject.setNonce(KeycloakModelUtils.generateId());
    return requestObject;
}

Example 9 with AuthorizationEndpointRequestObject

use of org.keycloak.testsuite.rest.resource.TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject in project keycloak by keycloak.

the class ClientPoliciesTest method testParSecureRequestObjectExecutor.

@Test
public void testParSecureRequestObjectExecutor() throws Exception {
    Integer availablePeriod = Integer.valueOf(SecureRequestObjectExecutor.DEFAULT_AVAILABLE_PERIOD + 400);
    // register profiles
    String json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Prvy Profil").addExecutor(SecureRequestObjectExecutorFactory.PROVIDER_ID, createSecureRequestObjectExecutorConfig(availablePeriod, true)).toRepresentation()).toString();
    updateProfiles(json);
    // register policies
    json = (new ClientPoliciesBuilder()).addPolicy((new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Prva Politika", Boolean.TRUE).addCondition(ClientRolesConditionFactory.PROVIDER_ID, createClientRolesConditionConfig(Arrays.asList(SAMPLE_CLIENT_ROLE))).addProfile(PROFILE_NAME).toRepresentation()).toString();
    updatePolicies(json);
    String clientId = generateSuffixedName(CLIENT_NAME);
    String clientSecret = "secret";
    String cid = createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
        clientRep.setSecret(clientSecret);
        OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setRequestUris(Arrays.asList(TestApplicationResourceUrls.clientRequestUri()));
    });
    oauth.realm(REALM_NAME);
    oauth.clientId(clientId);
    adminClient.realm(REALM_NAME).clients().get(cid).roles().create(RoleBuilder.create().name(SAMPLE_CLIENT_ROLE).build());
    AuthorizationEndpointRequestObject requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
    oauth.request(signRequestObject(requestObject));
    OAuthClient.ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
    assertEquals(201, pResp.getStatusCode());
    String requestUri = pResp.getRequestUri();
    oauth.scope(null);
    oauth.responseType(null);
    oauth.request(null);
    oauth.requestUri(requestUri);
    OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
    assertNotNull(loginResponse.getCode());
    oauth.openLogout();
    requestObject.exp(null);
    oauth.requestUri(null);
    oauth.request(signRequestObject(requestObject));
    pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
    requestUri = pResp.getRequestUri();
    oauth.request(null);
    oauth.requestUri(requestUri);
    oauth.openLoginForm();
    assertEquals(OAuthErrorException.INVALID_REQUEST_URI, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
    requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
    requestObject.nbf(null);
    oauth.requestUri(null);
    oauth.request(signRequestObject(requestObject));
    pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
    requestUri = pResp.getRequestUri();
    oauth.request(null);
    oauth.requestUri(requestUri);
    oauth.openLoginForm();
    assertEquals(OAuthErrorException.INVALID_REQUEST_URI, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
    requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
    requestObject.audience("https://www.other1.example.com/");
    oauth.request(signRequestObject(requestObject));
    oauth.requestUri(null);
    pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
    requestUri = pResp.getRequestUri();
    oauth.request(null);
    oauth.requestUri(requestUri);
    oauth.openLoginForm();
    assertEquals(OAuthErrorException.INVALID_REQUEST_URI, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
    requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
    requestObject.setOtherClaims(OIDCLoginProtocol.REQUEST_URI_PARAM, "foo");
    oauth.request(signRequestObject(requestObject));
    oauth.requestUri(null);
    pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
    assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, pResp.getError());
}

Example 10 with AuthorizationEndpointRequestObject

use of org.keycloak.testsuite.rest.resource.TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject in project keycloak by keycloak.

the class ClientPoliciesTest method testSecureRequestObjectExecutor.

@Test
public void testSecureRequestObjectExecutor() throws Exception {
    Integer availablePeriod = Integer.valueOf(SecureRequestObjectExecutor.DEFAULT_AVAILABLE_PERIOD + 400);
    // register profiles
    String json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Prvy Profil").addExecutor(SecureRequestObjectExecutorFactory.PROVIDER_ID, createSecureRequestObjectExecutorConfig(availablePeriod, null)).toRepresentation()).toString();
    updateProfiles(json);
    // register policies
    json = (new ClientPoliciesBuilder()).addPolicy((new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Prva Politika", Boolean.TRUE).addCondition(ClientRolesConditionFactory.PROVIDER_ID, createClientRolesConditionConfig(Arrays.asList(SAMPLE_CLIENT_ROLE))).addProfile(PROFILE_NAME).toRepresentation()).toString();
    updatePolicies(json);
    String clientId = generateSuffixedName(CLIENT_NAME);
    String clientSecret = "secret";
    String cid = createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
        clientRep.setSecret(clientSecret);
        OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setRequestUris(Arrays.asList(TestApplicationResourceUrls.clientRequestUri()));
    });
    adminClient.realm(REALM_NAME).clients().get(cid).roles().create(RoleBuilder.create().name(SAMPLE_CLIENT_ROLE).build());
    oauth.clientId(clientId);
    AuthorizationEndpointRequestObject requestObject;
    // check whether whether request object exists
    oauth.request(null);
    oauth.requestUri(null);
    oauth.openLoginForm();
    assertEquals(OAuthErrorException.INVALID_REQUEST, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
    assertEquals("Missing parameter: 'request' or 'request_uri'", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
    // check whether request_uri is https scheme
    // cannot test because existing AuthorizationEndpoint check and return error before executing client policy
    // check whether request object can be retrieved from request_uri
    // cannot test because existing AuthorizationEndpoint check and return error before executing client policy
    // check whether request object can be parsed successfully
    // cannot test because existing AuthorizationEndpoint check and return error before executing client policy
    // check whether scope exists in both query parameter and request object
    requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
    requestObject.setScope(null);
    registerRequestObject(requestObject, clientId, Algorithm.ES256, true);
    oauth.openLoginForm();
    assertEquals(OAuthErrorException.INVALID_REQUEST, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
    assertEquals("Invalid parameter. Parameters in 'request' object not matching with request parameters", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
    registerRequestObject(requestObject, clientId, Algorithm.ES256, true);
    oauth.scope(null);
    oauth.openid(false);
    oauth.openLoginForm();
    assertEquals(OAuthErrorException.INVALID_REQUEST, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
    assertEquals("Parameter 'scope' missing in the request parameters or in 'request' object", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
    oauth.openid(true);
    // check whether "exp" claim exists
    requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
    requestObject.exp(null);
    registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
    oauth.openLoginForm();
    assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
    assertEquals("Missing parameter in the 'request' object: exp", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
    // check whether request object not expired
    requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
    requestObject.exp(Long.valueOf(0));
    registerRequestObject(requestObject, clientId, Algorithm.ES256, true);
    oauth.openLoginForm();
    assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
    assertEquals("Request Expired", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
    // check whether "nbf" claim exists
    requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
    requestObject.nbf(null);
    registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
    oauth.openLoginForm();
    assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
    assertEquals("Missing parameter in the 'request' object: nbf", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
    // check whether request object not yet being processed
    requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
    requestObject.nbf(requestObject.getNbf() + 600);
    registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
    oauth.openLoginForm();
    assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
    assertEquals("Request not yet being processed", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
    // check whether request object's available period is short
    requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
    requestObject.exp(requestObject.getNbf() + availablePeriod.intValue() + 1);
    registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
    oauth.openLoginForm();
    assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
    assertEquals("Request's available period is long", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
    // check whether "aud" claim exists
    requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
    requestObject.audience((String) null);
    registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
    oauth.openLoginForm();
    assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
    assertEquals("Missing parameter in the 'request' object: aud", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
    // check whether "aud" claim points to this keycloak as authz server
    requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
    requestObject.audience(suiteContext.getAuthServerInfo().getContextRoot().toString());
    registerRequestObject(requestObject, clientId, Algorithm.ES256, true);
    oauth.openLoginForm();
    assertEquals(OAuthErrorException.INVALID_REQUEST_URI, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
    assertEquals("Invalid parameter in the 'request' object: aud", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
    // confirm whether all parameters in query string are included in the request object, and have the same values
    // argument "request" are parameters overridden by parameters in request object
    requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
    requestObject.setState("notmatchstate");
    registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
    oauth.openLoginForm();
    assertEquals(OAuthErrorException.INVALID_REQUEST, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
    assertEquals("Invalid parameter. Parameters in 'request' object not matching with request parameters", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
    // valid request object
    requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
    registerRequestObject(requestObject, clientId, Algorithm.ES256, true);
    successfulLoginAndLogout(clientId, clientSecret);
    // update profile : no configuration - "nbf" check and available period is 3600 sec
    json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Prvy Profil").addExecutor(SecureRequestObjectExecutorFactory.PROVIDER_ID, null).toRepresentation()).toString();
    updateProfiles(json);
    // check whether "nbf" claim exists
    requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
    requestObject.nbf(null);
    registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
    oauth.openLoginForm();
    assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
    assertEquals("Missing parameter in the 'request' object: nbf", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
    // check whether request object not yet being processed
    requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
    requestObject.nbf(requestObject.getNbf() + 600);
    registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
    oauth.openLoginForm();
    assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
    assertEquals("Request not yet being processed", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
    // check whether request object's available period is short
    requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
    requestObject.exp(requestObject.getNbf() + SecureRequestObjectExecutor.DEFAULT_AVAILABLE_PERIOD + 1);
    registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
    oauth.openLoginForm();
    assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
    assertEquals("Request's available period is long", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
    // update profile : not check "nbf"
    json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Prvy Profil").addExecutor(SecureRequestObjectExecutorFactory.PROVIDER_ID, createSecureRequestObjectExecutorConfig(null, Boolean.FALSE)).toRepresentation()).toString();
    updateProfiles(json);
    // not check whether "nbf" claim exists
    requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
    requestObject.nbf(null);
    registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
    successfulLoginAndLogout(clientId, clientSecret);
    // not check whether request object not yet being processed
    requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
    requestObject.nbf(requestObject.getNbf() + 600);
    registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
    successfulLoginAndLogout(clientId, clientSecret);
    // not check whether request object's available period is short
    requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
    requestObject.exp(requestObject.getNbf() + SecureRequestObjectExecutor.DEFAULT_AVAILABLE_PERIOD + 1);
    registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
    successfulLoginAndLogout(clientId, clientSecret);
    // update profile : force request object encryption
    json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Prvy Profil").addExecutor(SecureRequestObjectExecutorFactory.PROVIDER_ID, createSecureRequestObjectExecutorConfig(null, null, true)).toRepresentation()).toString();
    updateProfiles(json);
    requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
    registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
    oauth.openLoginForm();
    assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
    assertEquals("Request object not encrypted", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
}