Examples with ClientPolicyBuilder org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder used on opensource projects

Example 31 with ClientPolicyBuilder

use of org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder in project keycloak by keycloak.

the class ClientPoliciesTest method testSecureSigningAlgorithmForSignedJwtEnforceExecutorWithNotSecureAlg.

@Test
public void testSecureSigningAlgorithmForSignedJwtEnforceExecutorWithNotSecureAlg() throws Exception {
    // register profiles
    String json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Ensimmainen Profiili").addExecutor(SecureSigningAlgorithmForSignedJwtExecutorFactory.PROVIDER_ID, createSecureSigningAlgorithmForSignedJwtEnforceExecutorConfig(Boolean.FALSE)).toRepresentation()).toString();
    updateProfiles(json);
    // register policies
    String roleAlphaName = "sample-client-role-alpha";
    String roleZetaName = "sample-client-role-zeta";
    String roleCommonName = "sample-client-role-common";
    json = (new ClientPoliciesBuilder()).addPolicy((new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Den Forste Politikken", Boolean.TRUE).addCondition(ClientRolesConditionFactory.PROVIDER_ID, createClientRolesConditionConfig(Arrays.asList(roleAlphaName, roleZetaName))).addProfile(PROFILE_NAME).toRepresentation()).toString();
    updatePolicies(json);
    // create a client with client role
    String clientId = generateSuffixedName(CLIENT_NAME);
    String cid = createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
        clientRep.setSecret("secret");
        clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID);
        clientRep.setAttributes(new HashMap<>());
        clientRep.getAttributes().put(OIDCConfigAttributes.TOKEN_ENDPOINT_AUTH_SIGNING_ALG, org.keycloak.crypto.Algorithm.RS256);
    });
    adminClient.realm(REALM_NAME).clients().get(cid).roles().create(RoleBuilder.create().name(roleAlphaName).build());
    adminClient.realm(REALM_NAME).clients().get(cid).roles().create(RoleBuilder.create().name(roleCommonName).build());
    ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm(REALM_NAME), clientId);
    ClientRepresentation clientRep = clientResource.toRepresentation();
    KeyPair keyPair = setupJwksUrl(org.keycloak.crypto.Algorithm.RS256, clientRep, clientResource);
    PublicKey publicKey = keyPair.getPublic();
    PrivateKey privateKey = keyPair.getPrivate();
    String signedJwt = createSignedRequestToken(clientId, privateKey, publicKey, org.keycloak.crypto.Algorithm.RS256);
    oauth.clientId(clientId);
    oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
    EventRepresentation loginEvent = events.expectLogin().client(clientId).assertEvent();
    String sessionId = loginEvent.getSessionId();
    String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
    // obtain access token
    OAuthClient.AccessTokenResponse response = doAccessTokenRequestWithSignedJWT(code, signedJwt);
    assertEquals(400, response.getStatusCode());
    assertEquals(OAuthErrorException.INVALID_GRANT, response.getError());
    assertEquals("not allowed signature algorithm.", response.getErrorDescription());
}

Example 32 with ClientPolicyBuilder

use of org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder in project keycloak by keycloak.

the class ClientPoliciesTest method setupPolicyAuthzCodeFlowUnderMultiPhasePolicy.

private void setupPolicyAuthzCodeFlowUnderMultiPhasePolicy(String policyName) throws Exception {
    // register profiles
    String profileName = "MyProfile";
    String json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(profileName, "Primul Profil").addExecutor(SecureClientAuthenticatorExecutorFactory.PROVIDER_ID, createSecureClientAuthenticatorExecutorConfig(Arrays.asList(ClientIdAndSecretAuthenticator.PROVIDER_ID, JWTClientAuthenticator.PROVIDER_ID), ClientIdAndSecretAuthenticator.PROVIDER_ID)).addExecutor(PKCEEnforcerExecutorFactory.PROVIDER_ID, createPKCEEnforceExecutorConfig(Boolean.TRUE)).toRepresentation()).toString();
    updateProfiles(json);
    // register policies
    json = (new ClientPoliciesBuilder()).addPolicy((new ClientPolicyBuilder()).createPolicy(policyName, "Prima Politica", Boolean.TRUE).addCondition(ClientRolesConditionFactory.PROVIDER_ID, createClientRolesConditionConfig(Arrays.asList(SAMPLE_CLIENT_ROLE))).addCondition(ClientUpdaterContextConditionFactory.PROVIDER_ID, createClientUpdateContextConditionConfig(Arrays.asList(ClientUpdaterContextConditionFactory.BY_INITIAL_ACCESS_TOKEN))).addProfile(profileName).toRepresentation()).toString();
    updatePolicies(json);
}

Example 33 with ClientPolicyBuilder

use of org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder in project keycloak by keycloak.

the class ClientPoliciesTest method testRejectResourceOwnerCredentialsGrantExecutor.

@Test
public void testRejectResourceOwnerCredentialsGrantExecutor() throws Exception {
    String clientId = generateSuffixedName(CLIENT_NAME);
    String clientSecret = "secret";
    createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
        clientRep.setSecret(clientSecret);
        clientRep.setStandardFlowEnabled(Boolean.TRUE);
        clientRep.setDirectAccessGrantsEnabled(Boolean.TRUE);
        clientRep.setPublicClient(Boolean.FALSE);
    });
    // register profiles
    String json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Purofairu desu").addExecutor(RejectResourceOwnerPasswordCredentialsGrantExecutorFactory.PROVIDER_ID, createRejectisResourceOwnerPasswordCredentialsGrantExecutorConfig(Boolean.TRUE)).toRepresentation()).toString();
    updateProfiles(json);
    // register policies
    json = (new ClientPoliciesBuilder()).addPolicy((new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Porisii desu", Boolean.TRUE).addCondition(AnyClientConditionFactory.PROVIDER_ID, createAnyClientConditionConfig()).addProfile(PROFILE_NAME).toRepresentation()).toString();
    updatePolicies(json);
    oauth.clientId(clientId);
    OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest(clientSecret, TEST_USER_NAME, TEST_USER_PASSWORD, null);
    assertEquals(400, response.getStatusCode());
    assertEquals(OAuthErrorException.INVALID_GRANT, response.getError());
    assertEquals("resource owner password credentials grant is prohibited.", response.getErrorDescription());
}

Example 34 with ClientPolicyBuilder

use of org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder in project keycloak by keycloak.

the class ClientPoliciesTest method testConfidentialClientAcceptExecutorExecutor.

@Test
public void testConfidentialClientAcceptExecutorExecutor() throws Exception {
    // register profiles
    String json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Erstes Profil").addExecutor(ConfidentialClientAcceptExecutorFactory.PROVIDER_ID, null).toRepresentation()).toString();
    updateProfiles(json);
    // register policies
    json = (new ClientPoliciesBuilder()).addPolicy((new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Erstes Politik", Boolean.TRUE).addCondition(ClientRolesConditionFactory.PROVIDER_ID, createClientRolesConditionConfig(Arrays.asList(SAMPLE_CLIENT_ROLE))).addProfile(PROFILE_NAME).toRepresentation()).toString();
    updatePolicies(json);
    String clientConfidentialId = generateSuffixedName("confidential-app");
    String clientConfidentialSecret = "app-secret";
    String cidConfidential = createClientByAdmin(clientConfidentialId, (ClientRepresentation clientRep) -> {
        clientRep.setSecret(clientConfidentialSecret);
        clientRep.setStandardFlowEnabled(Boolean.TRUE);
        clientRep.setImplicitFlowEnabled(Boolean.TRUE);
        clientRep.setPublicClient(Boolean.FALSE);
        clientRep.setBearerOnly(Boolean.FALSE);
    });
    adminClient.realm(REALM_NAME).clients().get(cidConfidential).roles().create(RoleBuilder.create().name(SAMPLE_CLIENT_ROLE).build());
    successfulLoginAndLogout(clientConfidentialId, clientConfidentialSecret);
    String clientPublicId = generateSuffixedName("public-app");
    String cidPublic = createClientByAdmin(clientPublicId, (ClientRepresentation clientRep) -> {
        clientRep.setSecret(clientConfidentialSecret);
        clientRep.setStandardFlowEnabled(Boolean.TRUE);
        clientRep.setImplicitFlowEnabled(Boolean.TRUE);
        clientRep.setPublicClient(Boolean.TRUE);
        clientRep.setBearerOnly(Boolean.FALSE);
    });
    adminClient.realm(REALM_NAME).clients().get(cidPublic).roles().create(RoleBuilder.create().name(SAMPLE_CLIENT_ROLE).build());
    oauth.clientId(clientPublicId);
    oauth.openLoginForm();
    assertEquals(OAuthErrorException.INVALID_CLIENT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
    assertEquals("invalid client access type", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
}

Example 35 with ClientPolicyBuilder

use of org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder in project keycloak by keycloak.

the class ClientPoliciesTest method testSecureSessionEnforceExecutor.

@Test
public void testSecureSessionEnforceExecutor() throws Exception {
    // register profiles
    String json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Den Forste Profilen").addExecutor(SecureSessionEnforceExecutorFactory.PROVIDER_ID, null).toRepresentation()).toString();
    updateProfiles(json);
    // register policies
    String roleAlphaName = "sample-client-role-alpha";
    String roleBetaName = "sample-client-role-beta";
    json = (new ClientPoliciesBuilder()).addPolicy((new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Den Forste Politikken", Boolean.TRUE).addCondition(ClientRolesConditionFactory.PROVIDER_ID, createClientRolesConditionConfig(Arrays.asList(roleBetaName))).addProfile(PROFILE_NAME).toRepresentation()).toString();
    updatePolicies(json);
    String clientAlphaId = generateSuffixedName("Alpha-App");
    String clientAlphaSecret = "secretAlpha";
    String cAlphaId = createClientByAdmin(clientAlphaId, (ClientRepresentation clientRep) -> {
        clientRep.setSecret(clientAlphaSecret);
    });
    adminClient.realm(REALM_NAME).clients().get(cAlphaId).roles().create(RoleBuilder.create().name(roleAlphaName).build());
    String clientBetaId = generateSuffixedName("Beta-App");
    String clientBetaSecret = "secretBeta";
    String cBetaId = createClientByAdmin(clientBetaId, (ClientRepresentation clientRep) -> {
        clientRep.setSecret(clientBetaSecret);
    });
    adminClient.realm(REALM_NAME).clients().get(cBetaId).roles().create(RoleBuilder.create().name(roleBetaName).build());
    successfulLoginAndLogout(clientAlphaId, clientAlphaSecret);
    oauth.openid(false);
    successfulLoginAndLogout(clientAlphaId, clientAlphaSecret);
    oauth.openid(true);
    failLoginWithoutSecureSessionParameter(clientBetaId, ERR_MSG_MISSING_NONCE);
    oauth.nonce("yesitisnonce");
    successfulLoginAndLogout(clientBetaId, clientBetaSecret);
    oauth.openid(false);
    oauth.stateParamHardcoded(null);
    failLoginWithoutSecureSessionParameter(clientBetaId, ERR_MSG_MISSING_STATE);
    oauth.stateParamRandom();
    successfulLoginAndLogout(clientBetaId, clientBetaSecret);
}