Examples with ClientProfileBuilder org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfileBuilder used on opensource projects

Example 11 with ClientProfileBuilder

use of org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfileBuilder in project keycloak by keycloak.

the class CIBATest method testClientScopesCondition.

@Test
public void testClientScopesCondition() throws Exception {
    String username = "nutzername-rot";
    String bindingMessage = "ThisIsBindingMessage";
    Map<String, String> additionalParameters = new HashMap<>();
    additionalParameters.put("user_device", "mobile");
    String clientConfidentialId = generateSuffixedName("confidential-app");
    String clientConfidentialSecret = "app-secret";
    String cidConfidential = createClientByAdmin(clientConfidentialId, (ClientRepresentation clientRep) -> {
        clientRep.setSecret(clientConfidentialSecret);
        clientRep.setStandardFlowEnabled(Boolean.TRUE);
        clientRep.setImplicitFlowEnabled(Boolean.TRUE);
        clientRep.setPublicClient(Boolean.FALSE);
        clientRep.setBearerOnly(Boolean.FALSE);
        Map<String, String> attributes = Optional.ofNullable(clientRep.getAttributes()).orElse(new HashMap<>());
        attributes.put(CibaConfig.CIBA_BACKCHANNEL_TOKEN_DELIVERY_MODE_PER_CLIENT, "poll");
        attributes.put(CibaConfig.OIDC_CIBA_GRANT_ENABLED, Boolean.TRUE.toString());
        clientRep.setAttributes(attributes);
    });
    oauth.clientId(clientConfidentialId);
    oauth.scope("microprofile-jwt");
    // register profiles
    String json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Het Eerste Profiel").addExecutor(TestRaiseExeptionExecutorFactory.PROVIDER_ID, null).toRepresentation()).toString();
    updateProfiles(json);
    // register policies
    json = (new ClientPoliciesBuilder()).addPolicy((new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Het Eerste Beleid", Boolean.TRUE).addCondition(ClientScopesConditionFactory.PROVIDER_ID, createClientScopesConditionConfig(ClientScopesConditionFactory.OPTIONAL, Arrays.asList("microprofile-jwt"))).addProfile(PROFILE_NAME).toRepresentation()).toString();
    updatePolicies(json);
    // user Backchannel Authentication Request
    AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(clientConfidentialId, clientConfidentialSecret, username, bindingMessage, null, null, additionalParameters);
    assertThat(response.getStatusCode(), is(equalTo(400)));
    assertThat(response.getError(), is(ClientPolicyEvent.BACKCHANNEL_AUTHENTICATION_REQUEST.name()));
    assertThat(response.getErrorDescription(), is("Exception thrown intentionally"));
    updatePolicies("{}");
    response = oauth.doBackchannelAuthenticationRequest(clientConfidentialId, clientConfidentialSecret, username, bindingMessage, null, null, additionalParameters);
    assertThat(response.getStatusCode(), is(equalTo(200)));
    Assert.assertNotNull(response.getAuthReqId());
    json = (new ClientPoliciesBuilder()).addPolicy((new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Het Eerste Beleid", Boolean.TRUE).addCondition(ClientScopesConditionFactory.PROVIDER_ID, createClientScopesConditionConfig(ClientScopesConditionFactory.OPTIONAL, Arrays.asList("microprofile-jwt"))).addProfile(PROFILE_NAME).toRepresentation()).toString();
    updatePolicies(json);
    OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(clientConfidentialId, clientConfidentialSecret, response.getAuthReqId());
    assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
    assertThat(tokenRes.getError(), is(OAuthErrorException.INVALID_GRANT));
    assertThat(tokenRes.getErrorDescription(), is("Exception thrown intentionally"));
    updatePolicies("{}");
    // user Authentication Channel Request
    TestAuthenticationChannelRequest testRequest = doAuthenticationChannelRequest(bindingMessage);
    AuthenticationChannelRequest authenticationChannelReq = testRequest.getRequest();
    assertThat(authenticationChannelReq.getBindingMessage(), is(equalTo(bindingMessage)));
    assertThat(authenticationChannelReq.getScope(), is(containsString(OAuth2Constants.SCOPE_OPENID)));
    assertThat(authenticationChannelReq.getAdditionalParameters().get("user_device"), is(equalTo("mobile")));
    // user Authentication Channel completed
    doAuthenticationChannelCallback(testRequest);
    tokenRes = oauth.doBackchannelAuthenticationTokenRequest(clientConfidentialId, clientConfidentialSecret, response.getAuthReqId());
    assertThat(tokenRes.getStatusCode(), is(equalTo(200)));
    AccessToken accessToken = oauth.verifyToken(tokenRes.getAccessToken());
    assertThat(accessToken.getIssuedFor(), is(equalTo(clientConfidentialId)));
    RefreshToken refreshToken = oauth.parseRefreshToken(tokenRes.getRefreshToken());
    assertThat(refreshToken.getIssuedFor(), is(equalTo(clientConfidentialId)));
    assertThat(refreshToken.getAudience()[0], is(equalTo(refreshToken.getIssuer())));
    IDToken idToken = oauth.verifyIDToken(tokenRes.getIdToken());
    assertThat(idToken.getPreferredUsername(), is(equalTo(username)));
    assertThat(idToken.getIssuedFor(), is(equalTo(clientConfidentialId)));
    assertThat(idToken.getAudience()[0], is(equalTo(idToken.getIssuedFor())));
}

Example 12 with ClientProfileBuilder

use of org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfileBuilder in project keycloak by keycloak.

the class CIBATest method testExtendedClientPolicyInterfacesForBackchannelAuthenticationRequest.

@Test
public void testExtendedClientPolicyInterfacesForBackchannelAuthenticationRequest() throws Exception {
    String clientId = generateSuffixedName("confidential-app");
    String clientSecret = "app-secret";
    createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
        clientRep.setSecret(clientSecret);
        clientRep.setStandardFlowEnabled(Boolean.TRUE);
        clientRep.setImplicitFlowEnabled(Boolean.TRUE);
        clientRep.setPublicClient(Boolean.FALSE);
        clientRep.setBearerOnly(Boolean.FALSE);
        Map<String, String> attributes = Optional.ofNullable(clientRep.getAttributes()).orElse(new HashMap<>());
        attributes.put(CibaConfig.CIBA_BACKCHANNEL_TOKEN_DELIVERY_MODE_PER_CLIENT, "poll");
        attributes.put(CibaConfig.OIDC_CIBA_GRANT_ENABLED, Boolean.TRUE.toString());
        clientRep.setAttributes(attributes);
    });
    // register profiles
    String json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Den Forste Profilen").addExecutor(TestRaiseExeptionExecutorFactory.PROVIDER_ID, null).toRepresentation()).toString();
    updateProfiles(json);
    // register role policy
    String roleName = "sample-client-role-alpha";
    json = (new ClientPoliciesBuilder()).addPolicy((new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Den Forste Politikken", Boolean.TRUE).addCondition(ClientRolesConditionFactory.PROVIDER_ID, createClientRolesConditionConfig(Arrays.asList(roleName))).addProfile(PROFILE_NAME).toRepresentation()).toString();
    updatePolicies(json);
    // Add role to the client
    ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm(REALM_NAME), clientId);
    clientResource.roles().create(RoleBuilder.create().name(roleName).build());
    AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(clientId, clientSecret, TEST_USER_NAME, "Pjb9eD8w", null, null, null);
    assertEquals(400, response.getStatusCode());
    assertEquals(ClientPolicyEvent.BACKCHANNEL_AUTHENTICATION_REQUEST.toString(), response.getError());
    assertEquals("Exception thrown intentionally", response.getErrorDescription());
}

Example 13 with ClientProfileBuilder

use of org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfileBuilder in project keycloak by keycloak.

the class ClientPoliciesTest method testClientPolicyTriggeredForServiceAccountRequest.

@Test
public void testClientPolicyTriggeredForServiceAccountRequest() throws Exception {
    String clientId = "service-account-app";
    String clientSecret = "app-secret";
    createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
        clientRep.setSecret(clientSecret);
        clientRep.setStandardFlowEnabled(Boolean.FALSE);
        clientRep.setImplicitFlowEnabled(Boolean.FALSE);
        clientRep.setServiceAccountsEnabled(Boolean.TRUE);
        clientRep.setPublicClient(Boolean.FALSE);
        clientRep.setBearerOnly(Boolean.FALSE);
    });
    // register profiles
    String json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Den Forste Profilen").addExecutor(TestRaiseExeptionExecutorFactory.PROVIDER_ID, null).toRepresentation()).toString();
    updateProfiles(json);
    // register policies
    json = (new ClientPoliciesBuilder()).addPolicy((new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "La Premiere Politique", Boolean.TRUE).addCondition(AnyClientConditionFactory.PROVIDER_ID, createAnyClientConditionConfig()).addProfile(PROFILE_NAME).toRepresentation()).toString();
    updatePolicies(json);
    String origClientId = oauth.getClientId();
    oauth.clientId("service-account-app");
    try {
        OAuthClient.AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest("app-secret");
        assertEquals(400, response.getStatusCode());
        assertEquals(ClientPolicyEvent.SERVICE_ACCOUNT_TOKEN_REQUEST.toString(), response.getError());
        assertEquals("Exception thrown intentionally", response.getErrorDescription());
    } finally {
        oauth.clientId(origClientId);
    }
}

Example 14 with ClientProfileBuilder

use of org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfileBuilder in project keycloak by keycloak.

the class ClientPoliciesTest method testClientUpdateSourceGroupsCondition.

@Test
public void testClientUpdateSourceGroupsCondition() throws Exception {
    // register profiles
    String json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Den Forste Profil").addExecutor(SecureClientAuthenticatorExecutorFactory.PROVIDER_ID, createSecureClientAuthenticatorExecutorConfig(Arrays.asList(JWTClientAuthenticator.PROVIDER_ID), null)).toRepresentation()).toString();
    updateProfiles(json);
    // register policies
    json = (new ClientPoliciesBuilder()).addPolicy((new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Den Forste Politik", Boolean.TRUE).addCondition(ClientUpdaterSourceGroupsConditionFactory.PROVIDER_ID, createClientUpdateSourceGroupsConditionConfig(Arrays.asList("topGroup"))).addProfile(PROFILE_NAME).toRepresentation()).toString();
    updatePolicies(json);
    try {
        authCreateClients();
        createClientDynamically(generateSuffixedName(CLIENT_NAME), (OIDCClientRepresentation clientRep) -> {
        });
        fail();
    } catch (ClientRegistrationException e) {
        assertEquals(ERR_MSG_CLIENT_REG_FAIL, e.getMessage());
    }
    authManageClients();
    try {
        createClientDynamically(generateSuffixedName(CLIENT_NAME), (OIDCClientRepresentation clientRep) -> {
        });
    } catch (Exception e) {
        fail();
    }
}

Example 15 with ClientProfileBuilder

use of org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfileBuilder in project keycloak by keycloak.

the class ClientPoliciesTest method testMultiplePolicies.

@Test
public void testMultiplePolicies() throws Exception {
    String roleAlphaName = "sample-client-role-alpha";
    String roleBetaName = "sample-client-role-beta";
    String roleZetaName = "sample-client-role-zeta";
    String roleCommonName = "sample-client-role-common";
    // register profiles
    String profileAlphaName = "MyProfile-alpha";
    String profileBetaName = "MyProfile-beta";
    String json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(profileAlphaName, "Pierwszy Profil").addExecutor(SecureClientAuthenticatorExecutorFactory.PROVIDER_ID, createSecureClientAuthenticatorExecutorConfig(Arrays.asList(ClientIdAndSecretAuthenticator.PROVIDER_ID), ClientIdAndSecretAuthenticator.PROVIDER_ID)).toRepresentation()).addProfile((new ClientProfileBuilder()).createProfile(profileBetaName, "Drugi Profil").addExecutor(PKCEEnforcerExecutorFactory.PROVIDER_ID, createPKCEEnforceExecutorConfig(Boolean.TRUE)).toRepresentation()).toString();
    updateProfiles(json);
    // register policies
    String policyAlphaName = "MyPolicy-alpha";
    String policyBetaName = "MyPolicy-beta";
    json = (new ClientPoliciesBuilder()).addPolicy((new ClientPolicyBuilder()).createPolicy(policyAlphaName, "Pierwsza Zasada", Boolean.TRUE).addCondition(ClientRolesConditionFactory.PROVIDER_ID, createClientRolesConditionConfig(Arrays.asList(roleAlphaName, roleZetaName))).addCondition(ClientUpdaterContextConditionFactory.PROVIDER_ID, createClientUpdateContextConditionConfig(Arrays.asList(ClientUpdaterContextConditionFactory.BY_AUTHENTICATED_USER))).addProfile(profileAlphaName).toRepresentation()).addPolicy((new ClientPolicyBuilder()).createPolicy(policyBetaName, "Drugi Zasada", Boolean.TRUE).addCondition(ClientRolesConditionFactory.PROVIDER_ID, createClientRolesConditionConfig(Arrays.asList(roleBetaName, roleZetaName))).addProfile(profileBetaName).toRepresentation()).toString();
    updatePolicies(json);
    String clientAlphaId = generateSuffixedName("Alpha-App");
    String clientAlphaSecret = "secretAlpha";
    // Not allowed client authenticator should fail
    try {
        createClientByAdmin(generateSuffixedName(CLIENT_NAME), (ClientRepresentation clientRep) -> {
            clientRep.setSecret(clientAlphaSecret);
            clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID);
        });
        fail();
    } catch (ClientPolicyException e) {
        assertEquals(OAuthErrorException.INVALID_CLIENT_METADATA, e.getMessage());
    }
    String cAlphaId = createClientByAdmin(clientAlphaId, (ClientRepresentation clientRep) -> {
        clientRep.setSecret(clientAlphaSecret);
        clientRep.setClientAuthenticatorType(ClientIdAndSecretAuthenticator.PROVIDER_ID);
    });
    RolesResource rolesResourceAlpha = adminClient.realm(REALM_NAME).clients().get(cAlphaId).roles();
    rolesResourceAlpha.create(RoleBuilder.create().name(roleAlphaName).build());
    rolesResourceAlpha.create(RoleBuilder.create().name(roleCommonName).build());
    String clientBetaId = generateSuffixedName("Beta-App");
    String cBetaId = createClientByAdmin(clientBetaId, (ClientRepresentation clientRep) -> {
        clientRep.setSecret("secretBeta");
    });
    RolesResource rolesResourceBeta = adminClient.realm(REALM_NAME).clients().get(cBetaId).roles();
    rolesResourceBeta.create(RoleBuilder.create().name(roleBetaName).build());
    rolesResourceBeta.create(RoleBuilder.create().name(roleCommonName).build());
    assertEquals(ClientIdAndSecretAuthenticator.PROVIDER_ID, getClientByAdmin(cAlphaId).getClientAuthenticatorType());
    successfulLoginAndLogout(clientAlphaId, clientAlphaSecret);
    failLoginByNotFollowingPKCE(clientBetaId);
}