Examples with ClientPolicyBuilder org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder used on opensource projects

Example 21 with ClientPolicyBuilder

use of org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder in project keycloak by keycloak.

the class ClientPoliciesTest method testSecureLogoutExecutor.

@Test
public void testSecureLogoutExecutor() throws Exception {
    // register profiles
    String json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Logout Test").addExecutor(SecureLogoutExecutorFactory.PROVIDER_ID, null).toRepresentation()).toString();
    updateProfiles(json);
    // register policies
    json = (new ClientPoliciesBuilder()).addPolicy((new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Logout Policy", Boolean.TRUE).addCondition(AnyClientConditionFactory.PROVIDER_ID, createAnyClientConditionConfig()).addProfile(PROFILE_NAME).toRepresentation()).toString();
    updatePolicies(json);
    String clientId = generateSuffixedName(CLIENT_NAME);
    String clientSecret = "secret";
    try {
        createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
            clientRep.setSecret(clientSecret);
            clientRep.setStandardFlowEnabled(Boolean.TRUE);
            clientRep.setImplicitFlowEnabled(Boolean.TRUE);
            clientRep.setPublicClient(Boolean.FALSE);
            clientRep.setFrontchannelLogout(true);
        });
    } catch (ClientPolicyException cpe) {
        assertEquals("Front-channel logout is not allowed for this client", cpe.getErrorDetail());
    }
    String cid = createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
        clientRep.setSecret(clientSecret);
        clientRep.setStandardFlowEnabled(Boolean.TRUE);
        clientRep.setImplicitFlowEnabled(Boolean.TRUE);
        clientRep.setPublicClient(Boolean.FALSE);
    });
    ClientResource clientResource = adminClient.realm(REALM_NAME).clients().get(cid);
    ClientRepresentation clientRep = clientResource.toRepresentation();
    clientRep.setFrontchannelLogout(true);
    try {
        clientResource.update(clientRep);
    } catch (BadRequestException bre) {
        assertEquals("Front-channel logout is not allowed for this client", bre.getResponse().readEntity(OAuth2ErrorRepresentation.class).getErrorDescription());
    }
    ClientPolicyExecutorConfigurationRepresentation config = new ClientPolicyExecutorConfigurationRepresentation();
    config.setConfigAsMap(SecureLogoutExecutorFactory.ALLOW_FRONT_CHANNEL_LOGOUT, Boolean.TRUE.booleanValue());
    json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Logout Test").addExecutor(SecureLogoutExecutorFactory.PROVIDER_ID, config).toRepresentation()).toString();
    updateProfiles(json);
    OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setFrontChannelLogoutUrl(oauth.getRedirectUri());
    clientResource.update(clientRep);
    config.setConfigAsMap(SecureLogoutExecutorFactory.ALLOW_FRONT_CHANNEL_LOGOUT, Boolean.FALSE.toString());
    json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Logout Test").addExecutor(SecureLogoutExecutorFactory.PROVIDER_ID, config).toRepresentation()).toString();
    updateProfiles(json);
    successfulLogin(clientId, clientSecret);
    oauth.openLogout();
    assertTrue(driver.getPageSource().contains("Front-channel logout is not allowed for this client"));
}

Example 22 with ClientPolicyBuilder

use of org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder in project keycloak by keycloak.

the class FAPI1Test method setupPolicyFAPIAdvancedForAllClient.

private void setupPolicyFAPIAdvancedForAllClient() throws Exception {
    String json = (new ClientPoliciesBuilder()).addPolicy((new ClientPolicyBuilder()).createPolicy("MyPolicy", "Policy for enable FAPI Advanced for all clients", Boolean.TRUE).addCondition(AnyClientConditionFactory.PROVIDER_ID, createAnyClientConditionConfig()).addProfile(FAPI1_ADVANCED_PROFILE_NAME).toRepresentation()).toString();
    updatePolicies(json);
}

Example 23 with ClientPolicyBuilder

use of org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder in project keycloak by keycloak.

the class ClientPoliciesTest method testSecureSigningAlgorithmForSignedJwtEnforceExecutorWithSecureAlg.

@Test
public void testSecureSigningAlgorithmForSignedJwtEnforceExecutorWithSecureAlg() throws Exception {
    // register profiles
    String json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Ensimmainen Profiili").addExecutor(SecureSigningAlgorithmForSignedJwtExecutorFactory.PROVIDER_ID, createSecureSigningAlgorithmForSignedJwtEnforceExecutorConfig(Boolean.TRUE)).toRepresentation()).toString();
    updateProfiles(json);
    // register policies
    String roleAlphaName = "sample-client-role-alpha";
    String roleZetaName = "sample-client-role-zeta";
    String roleCommonName = "sample-client-role-common";
    json = (new ClientPoliciesBuilder()).addPolicy((new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Den Forste Politikken", Boolean.TRUE).addCondition(ClientRolesConditionFactory.PROVIDER_ID, createClientRolesConditionConfig(Arrays.asList(roleAlphaName, roleZetaName))).addProfile(PROFILE_NAME).toRepresentation()).toString();
    updatePolicies(json);
    // create a client with client role
    String clientId = generateSuffixedName(CLIENT_NAME);
    String cid = createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
        clientRep.setSecret("secret");
        clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID);
        clientRep.setAttributes(new HashMap<>());
        clientRep.getAttributes().put(OIDCConfigAttributes.TOKEN_ENDPOINT_AUTH_SIGNING_ALG, org.keycloak.crypto.Algorithm.ES256);
    });
    adminClient.realm(REALM_NAME).clients().get(cid).roles().create(RoleBuilder.create().name(roleAlphaName).build());
    adminClient.realm(REALM_NAME).clients().get(cid).roles().create(RoleBuilder.create().name(roleCommonName).build());
    ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm(REALM_NAME), clientId);
    ClientRepresentation clientRep = clientResource.toRepresentation();
    KeyPair keyPair = setupJwksUrl(org.keycloak.crypto.Algorithm.ES256, clientRep, clientResource);
    PublicKey publicKey = keyPair.getPublic();
    PrivateKey privateKey = keyPair.getPrivate();
    String signedJwt = createSignedRequestToken(clientId, privateKey, publicKey, org.keycloak.crypto.Algorithm.ES256);
    oauth.clientId(clientId);
    oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
    EventRepresentation loginEvent = events.expectLogin().client(clientId).assertEvent();
    String sessionId = loginEvent.getSessionId();
    String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
    // obtain access token
    OAuthClient.AccessTokenResponse response = doAccessTokenRequestWithSignedJWT(code, signedJwt);
    assertEquals(200, response.getStatusCode());
    oauth.verifyToken(response.getAccessToken());
    RefreshToken refreshToken = oauth.parseRefreshToken(response.getRefreshToken());
    assertEquals(sessionId, refreshToken.getSessionState());
    assertEquals(sessionId, refreshToken.getSessionState());
    events.expectCodeToToken(loginEvent.getDetails().get(Details.CODE_ID), loginEvent.getSessionId()).client(clientId).detail(Details.CLIENT_AUTH_METHOD, JWTClientAuthenticator.PROVIDER_ID).assertEvent();
    // refresh token
    signedJwt = createSignedRequestToken(clientId, privateKey, publicKey, org.keycloak.crypto.Algorithm.ES256);
    OAuthClient.AccessTokenResponse refreshedResponse = doRefreshTokenRequestWithSignedJWT(response.getRefreshToken(), signedJwt);
    assertEquals(200, refreshedResponse.getStatusCode());
    // introspect token
    signedJwt = createSignedRequestToken(clientId, privateKey, publicKey, org.keycloak.crypto.Algorithm.ES256);
    HttpResponse tokenIntrospectionResponse = doTokenIntrospectionWithSignedJWT("access_token", refreshedResponse.getAccessToken(), signedJwt);
    assertEquals(200, tokenIntrospectionResponse.getStatusLine().getStatusCode());
    // revoke token
    signedJwt = createSignedRequestToken(clientId, privateKey, publicKey, org.keycloak.crypto.Algorithm.ES256);
    HttpResponse revokeTokenResponse = doTokenRevokeWithSignedJWT("refresh_toke", refreshedResponse.getRefreshToken(), signedJwt);
    assertEquals(200, revokeTokenResponse.getStatusLine().getStatusCode());
    signedJwt = createSignedRequestToken(clientId, privateKey, publicKey, org.keycloak.crypto.Algorithm.ES256);
    OAuthClient.AccessTokenResponse tokenRes = doRefreshTokenRequestWithSignedJWT(refreshedResponse.getRefreshToken(), signedJwt);
    assertEquals(400, tokenRes.getStatusCode());
    assertEquals(OAuthErrorException.INVALID_GRANT, tokenRes.getError());
    // logout
    signedJwt = createSignedRequestToken(clientId, privateKey, publicKey, org.keycloak.crypto.Algorithm.ES256);
    HttpResponse logoutResponse = doLogoutWithSignedJWT(refreshedResponse.getRefreshToken(), signedJwt);
    assertEquals(204, logoutResponse.getStatusLine().getStatusCode());
}

Example 24 with ClientPolicyBuilder

use of org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder in project keycloak by keycloak.

the class ClientPoliciesTest method testExtendedClientPolicyIntefacesForClientRegistrationPolicyMigration.

@Test
public void testExtendedClientPolicyIntefacesForClientRegistrationPolicyMigration() throws Exception {
    // register profiles
    String json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Den Forste Profilen").addExecutor(TestRaiseExeptionExecutorFactory.PROVIDER_ID, null).toRepresentation()).toString();
    updateProfiles(json);
    // register policies
    json = (new ClientPoliciesBuilder()).addPolicy((new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "La Premiere Politique", Boolean.TRUE).addCondition(AnyClientConditionFactory.PROVIDER_ID, createAnyClientConditionConfig()).addProfile(PROFILE_NAME).toRepresentation()).toString();
    updatePolicies(json);
    String clientName = "ByAdmin-App" + KeycloakModelUtils.generateId().substring(0, 7);
    String clientId = null;
    try {
        createClientByAdmin(clientName, (ClientRepresentation clientRep) -> {
        });
        fail();
    } catch (ClientPolicyException cpe) {
        assertEquals(ClientPolicyEvent.REGISTERED.toString(), cpe.getError());
    }
    clientId = getClientByAdminWithName(clientName).getId();
    assertEquals(true, getClientByAdmin(clientId).isEnabled());
    try {
        updateClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
            clientRep.setEnabled(false);
        });
        fail();
    } catch (ClientPolicyException cpe) {
        assertEquals(ClientPolicyEvent.UPDATED.toString(), cpe.getError());
    }
    assertEquals(false, getClientByAdmin(clientId).isEnabled());
    try {
        deleteClientByAdmin(clientId);
        fail();
    } catch (ClientPolicyException cpe) {
        assertEquals(ClientPolicyEvent.UNREGISTER.toString(), cpe.getError());
    }
// TODO : For dynamic client registration, the existing test scheme can not distinguish when the exception happens on which event so that the migrated client policy executors test them afterwards.
}

Example 25 with ClientPolicyBuilder

use of org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder in project keycloak by keycloak.

the class ClientPoliciesTest method testIntentionalExceptionOnCondition.

@Test
public void testIntentionalExceptionOnCondition() throws Exception {
    // register policies
    String json = (new ClientPoliciesBuilder()).addPolicy((new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Fyrsta Stefnan", Boolean.TRUE).addCondition(TestRaiseExeptionConditionFactory.PROVIDER_ID, createTestRaiseExeptionConditionConfig()).toRepresentation()).toString();
    updatePolicies(json);
    try {
        createClientByAdmin(generateSuffixedName(CLIENT_NAME), (ClientRepresentation clientRep) -> {
        });
        fail();
    } catch (ClientPolicyException e) {
        assertEquals(OAuthErrorException.SERVER_ERROR, e.getMessage());
    }
}