Examples with RealmAttributeUpdater org.keycloak.testsuite.updaters.RealmAttributeUpdater used on opensource projects

Example 16 with RealmAttributeUpdater

use of org.keycloak.testsuite.updaters.RealmAttributeUpdater in project keycloak by keycloak.

the class WebAuthnPolicySettingsTest method policySettingsWithExternalProperties.

@Test
public void policySettingsWithExternalProperties() throws IOException {
    try (RealmAttributeUpdater rau = updateWebAuthnPolicy("rpName", Collections.singletonList("ES256"), INDIRECT.getValue(), CROSS_PLATFORM.getValue(), "No", null, PREFERRED.getValue(), Collections.singletonList(ALL_ZERO_AAGUID))) {
        WebAuthnRealmData realm = new WebAuthnRealmData(testRealmResource().toRepresentation(), isPasswordless());
        assertThat(realm, notNullValue());
        assertThat(realm.getSignatureAlgorithms(), hasItems("ES256"));
        assertThat(realm.getAttestationConveyancePreference(), is(INDIRECT.getValue()));
        assertThat(realm.getAuthenticatorAttachment(), is(CROSS_PLATFORM.getValue()));
        assertThat(realm.getRequireResidentKey(), is("No"));
        assertThat(realm.getRpId(), is(""));
        assertThat(realm.getUserVerificationRequirement(), is(PREFERRED.getValue()));
        assertThat(realm.getAcceptableAaguids(), hasItems(ALL_ZERO_AAGUID));
    }
}

Example 17 with RealmAttributeUpdater

use of org.keycloak.testsuite.updaters.RealmAttributeUpdater in project keycloak by keycloak.

the class RefreshTokenTest method testRefreshTokenWhenClientSessionTimeoutPassedButRealmDidNot.

// KEYCLOAK-17323
@Test
public void testRefreshTokenWhenClientSessionTimeoutPassedButRealmDidNot() {
    getCleanup().addCleanup(new RealmAttributeUpdater(adminClient.realm("test")).setSsoSessionIdleTimeout(// 30 Days
    2592000).setSsoSessionMaxLifespan(// 999 Days
    86313600).update()).addCleanup(ClientAttributeUpdater.forClient(adminClient, "test", "test-app").setAttribute(CLIENT_SESSION_IDLE_TIMEOUT, // 1 minute
    "60").setAttribute(CLIENT_SESSION_MAX_LIFESPAN, // 1 minute 5 seconds
    "65").update());
    oauth.doLogin("test-user@localhost", "password");
    String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
    OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
    assertEquals(200, response.getStatusCode());
    assertExpiration(response.getExpiresIn(), 65);
    setTimeOffset(70);
    oauth.openLoginForm();
    code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
    OAuthClient.AccessTokenResponse response2 = oauth.doAccessTokenRequest(code, "password");
    assertExpiration(response2.getExpiresIn(), 65);
}

Example 18 with RealmAttributeUpdater

use of org.keycloak.testsuite.updaters.RealmAttributeUpdater in project keycloak by keycloak.

the class SessionsPreloadCrossDCTest method loginFailuresPreloadTest.

@Test
public void loginFailuresPreloadTest() throws Exception {
    // Enable brute force protector
    try (RealmAttributeUpdater rau = new RealmAttributeUpdater(getAdminClientForStartedNodeInDc(0).realms().realm("test")).updateWith(r -> r.setBruteForceProtected(true)).updateWith(// This is necessary so user is not locked out for too fast consecutive login attempts; when user is locked out failure count stops increasing
    r -> r.setQuickLoginCheckMilliSeconds(20L)).update()) {
        String userId = ApiUtil.findUserByUsername(getAdminClientForStartedNodeInDc(0).realms().realm("test"), "test-user@localhost").getId();
        int loginFailuresBefore = (Integer) getAdminClientForStartedNodeInDc(0).realm("test").attackDetection().bruteForceUserStatus(userId).get("numFailures");
        log.infof("loginFailuresBefore: %d", loginFailuresBefore);
        // Create initial brute force records
        for (int i = 0; i < SESSIONS_COUNT; i++) {
            OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "bad-password");
            Assert.assertNull(response.getAccessToken());
            Assert.assertNotNull(response.getError());
        }
        // Start 2nd DC.
        CrossDCTestEnricher.startAuthServerBackendNode(DC.SECOND, 0);
        enableLoadBalancerNode(DC.SECOND, 0);
        Retry.execute(() -> {
            // Ensure loginFailures are loaded in both 1st DC and 2nd DC
            Set<String> keys1 = getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.LOGIN_FAILURE_CACHE_NAME).enumerateKeys();
            Set<String> keys2 = getTestingClientForStartedNodeInDc(1).testing().cache(InfinispanConnectionProvider.LOGIN_FAILURE_CACHE_NAME).enumerateKeys();
            int loginFailures1 = (Integer) getAdminClientForStartedNodeInDc(0).realm("test").attackDetection().bruteForceUserStatus(userId).get("numFailures");
            int loginFailures2 = (Integer) getAdminClientForStartedNodeInDc(1).realm("test").attackDetection().bruteForceUserStatus(userId).get("numFailures");
            log.infof("keys1: %d, keys2: %d, loginFailures1: %d, loginFailures2: %d", keys1, keys2, loginFailures1, loginFailures2);
            Assert.assertThat(keys1, Matchers.equalTo(keys2));
            Assert.assertEquals(loginFailuresBefore + SESSIONS_COUNT, loginFailures1);
            Assert.assertEquals(loginFailuresBefore + SESSIONS_COUNT, loginFailures2);
        }, 3, 400);
        // On DC2 sessions were preloaded from remoteCache
        Assert.assertTrue(getTestingClientForStartedNodeInDc(1).testing().cache(InfinispanConnectionProvider.WORK_CACHE_NAME).contains("distributed::remoteCacheLoad::loginFailures"));
    }
}

Example 19 with RealmAttributeUpdater

use of org.keycloak.testsuite.updaters.RealmAttributeUpdater in project keycloak by keycloak.

the class IdentityProviderTest method failCreateInvalidUrl.

@Test
@AuthServerContainerExclude(REMOTE)
public void failCreateInvalidUrl() throws Exception {
    try (AutoCloseable c = new RealmAttributeUpdater(realmsResouce().realm("test")).updateWith(r -> r.setSslRequired(SslRequired.ALL.name())).update()) {
        IdentityProviderRepresentation newIdentityProvider = createRep("new-identity-provider", "oidc");
        newIdentityProvider.getConfig().put("clientId", "clientId");
        newIdentityProvider.getConfig().put("clientSecret", "some secret value");
        OIDCIdentityProviderConfigRep oidcConfig = new OIDCIdentityProviderConfigRep(newIdentityProvider);
        oidcConfig.setAuthorizationUrl("invalid://test");
        try (Response response = this.realm.identityProviders().create(newIdentityProvider)) {
            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
            ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
            assertEquals("The url [authorization_url] is malformed", error.getErrorMessage());
        }
        oidcConfig.setAuthorizationUrl(null);
        oidcConfig.setTokenUrl("http://test");
        try (Response response = this.realm.identityProviders().create(newIdentityProvider)) {
            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
            ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
            assertEquals("The url [token_url] requires secure connections", error.getErrorMessage());
        }
        oidcConfig.setAuthorizationUrl(null);
        oidcConfig.setTokenUrl(null);
        oidcConfig.setJwksUrl("http://test");
        try (Response response = this.realm.identityProviders().create(newIdentityProvider)) {
            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
            ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
            assertEquals("The url [jwks_url] requires secure connections", error.getErrorMessage());
        }
        oidcConfig.setAuthorizationUrl(null);
        oidcConfig.setTokenUrl(null);
        oidcConfig.setJwksUrl(null);
        oidcConfig.setLogoutUrl("http://test");
        try (Response response = this.realm.identityProviders().create(newIdentityProvider)) {
            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
            ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
            assertEquals("The url [logout_url] requires secure connections", error.getErrorMessage());
        }
        oidcConfig.setAuthorizationUrl(null);
        oidcConfig.setTokenUrl(null);
        oidcConfig.setJwksUrl(null);
        oidcConfig.setLogoutUrl(null);
        oidcConfig.setUserInfoUrl("http://test");
        try (Response response = this.realm.identityProviders().create(newIdentityProvider)) {
            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
            ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
            assertEquals("The url [userinfo_url] requires secure connections", error.getErrorMessage());
        }
    }
}

Example 20 with RealmAttributeUpdater

use of org.keycloak.testsuite.updaters.RealmAttributeUpdater in project keycloak by keycloak.

the class LoginTest method loginRememberMeExpiredMaxLifespan.

@Test
// TODO remove this (KEYCLOAK-16228)
@DisableFeature(value = Profile.Feature.ACCOUNT2, skipRestart = true)
public void loginRememberMeExpiredMaxLifespan() throws Exception {
    try (Closeable c = new RealmAttributeUpdater(adminClient.realm("test")).setSsoSessionMaxLifespanRememberMe(1).setRememberMe(true).update()) {
        // login form shown after redirect from app
        oauth.clientId("test-app");
        oauth.redirectUri(OAuthClient.APP_ROOT + "/auth");
        oauth.openLoginForm();
        assertTrue(loginPage.isCurrent());
        loginPage.setRememberMe(true);
        loginPage.login("test-user@localhost", "password");
        // sucessful login - app page should be on display.
        events.expectLogin().detail(Details.USERNAME, "test-user@localhost").assertEvent();
        appPage.assertCurrent();
        // expire the max lifespan.
        setTimeOffset(2);
        // trying to open the account page with an expired lifespan should redirect back to the login page.
        appPage.openAccount();
        loginPage.assertCurrent();
    }
}