Examples with ClientProfilesBuilder org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfilesBuilder used on opensource projects

Example 21 with ClientProfilesBuilder

use of org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfilesBuilder in project keycloak by keycloak.

the class ClientPoliciesLoadUpdateTest method testOverwriteBuiltinProfileNotAllowed.

@Test
public void testOverwriteBuiltinProfileNotAllowed() throws Exception {
    // register profiles
    String json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(FAPI1_BASELINE_PROFILE_NAME, "Pershyy Profil").addExecutor(SecureClientAuthenticatorExecutorFactory.PROVIDER_ID, createSecureClientAuthenticatorExecutorConfig(Arrays.asList(JWTClientAuthenticator.PROVIDER_ID, JWTClientSecretAuthenticator.PROVIDER_ID, X509ClientAuthenticator.PROVIDER_ID), X509ClientAuthenticator.PROVIDER_ID)).toRepresentation()).toRepresentation().toString();
    try {
        updateProfiles(json);
        fail();
    } catch (ClientPolicyException cpe) {
        assertEquals("update profiles failed", cpe.getError());
    }
}

Example 22 with ClientProfilesBuilder

use of org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfilesBuilder in project keycloak by keycloak.

the class ClientPoliciesTest method testProfilesFormView.

@Test
public void testProfilesFormView() throws Exception {
    final String profileName = "mega-profile";
    final String profileName2 = "mega-profile^2";
    final String profileDesc = "mega-desc";
    clientProfilesPage.navigateTo();
    clientProfilesPage.assertCurrent();
    clientProfilesPage.profilesTable().clickCreateProfile();
    createClientProfilePage.assertCurrent();
    // create profile
    createClientProfilePage.form().setProfileName(profileName);
    createClientProfilePage.form().setDescription(profileDesc);
    createClientProfilePage.form().save();
    assertAlertSuccess();
    clientProfilePage.setProfileName(profileName);
    clientProfilePage.assertCurrent();
    assertEquals(profileName, clientProfilePage.form().getProfileName());
    clientProfilePage.executorsTable().clickCreateExecutor();
    // create executors
    createExecutorPage.setProfileName(profileName);
    createExecutorPage.assertCurrent();
    createExecutorPage.form().setExecutorType(SecureClientAuthenticatorExecutorFactory.PROVIDER_ID);
    assertTrue(createExecutorPage.form().getSelect2SelectedItems().isEmpty());
    createExecutorPage.form().selectSelect2Item(JWTClientAuthenticator.PROVIDER_ID);
    createExecutorPage.form().selectSelect2Item(ClientIdAndSecretAuthenticator.PROVIDER_ID);
    createExecutorPage.form().save();
    assertAlertSuccess();
    clientProfilePage.assertCurrent();
    clientProfilePage.executorsTable().clickEditExecutor(SecureClientAuthenticatorExecutorFactory.PROVIDER_ID);
    executorPage.setUriParameters(profileName, 0);
    executorPage.assertCurrent();
    assertEquals(Stream.of(JWTClientAuthenticator.PROVIDER_ID, ClientIdAndSecretAuthenticator.PROVIDER_ID).collect(Collectors.toSet()), executorPage.form().getSelect2SelectedItems());
    createExecutorPage.navigateTo();
    createExecutorPage.form().setExecutorType(HolderOfKeyEnforcerExecutorFactory.PROVIDER_ID);
    assertFalse(createExecutorPage.form().isAutoConfigure());
    createExecutorPage.form().setAutoConfigure(true);
    createExecutorPage.form().save();
    clientProfilePage.executorsTable().clickEditExecutor(HolderOfKeyEnforcerExecutorFactory.PROVIDER_ID);
    executorPage.setUriParameters(profileName, 1);
    executorPage.assertCurrent();
    assertTrue(executorPage.form().isAutoConfigure());
    // assert JSON
    ClientProfilesRepresentation expected = new ClientProfilesBuilder().addProfile(new ClientProfileBuilder().createProfile(profileName, profileDesc).addExecutor(SecureClientAuthenticatorExecutorFactory.PROVIDER_ID, createSecureClientAuthenticatorExecutorConfig(Arrays.asList(JWTClientAuthenticator.PROVIDER_ID, ClientIdAndSecretAuthenticator.PROVIDER_ID), JWTClientAuthenticator.PROVIDER_ID)).addExecutor(HolderOfKeyEnforcerExecutorFactory.PROVIDER_ID, createHolderOfKeyEnforceExecutorConfig(true)).toRepresentation()).toRepresentation();
    assertClientProfile(expected, false);
    // remove executor
    clientProfilePage.navigateTo();
    clientProfilePage.executorsTable().clickDeleteExecutor(SecureClientAuthenticatorExecutorFactory.PROVIDER_ID);
    modalDialog.confirmDeletion();
    assertAlertSuccess();
    expected.getProfiles().get(0).getExecutors().remove(0);
    assertClientProfile(expected, false);
    assertFalse(clientProfilePage.executorsTable().isRowPresent(SecureClientAuthenticatorExecutorFactory.PROVIDER_ID));
    // edit executor
    clientProfilePage.executorsTable().clickEditExecutor(HolderOfKeyEnforcerExecutorFactory.PROVIDER_ID);
    executorPage.form().setAutoConfigure(false);
    executorPage.form().save();
    expected.getProfiles().get(0).getExecutors().get(0).setConfiguration(JsonSerialization.mapper.readValue(JsonSerialization.mapper.writeValueAsBytes(createHolderOfKeyEnforceExecutorConfig(false)), JsonNode.class));
    assertClientProfile(expected, false);
    // edit profile
    clientProfilePage.form().setProfileName(profileName2);
    clientProfilePage.form().save();
    assertAlertSuccess();
    clientProfilesPage.navigateTo();
    assertEquals(profileDesc, clientProfilesPage.profilesTable().getDescription(profileName2));
    // remove profile
    clientProfilesPage.profilesTable().clickDeleteProfile(profileName2);
    modalDialog.confirmDeletion();
    assertAlertSuccess();
    assertClientProfile(new ClientProfilesRepresentation(), false);
    assertFalse(clientProfilesPage.profilesTable().isRowPresent(profileName2));
}

Example 23 with ClientProfilesBuilder

use of org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfilesBuilder in project keycloak by keycloak.

the class ClientPoliciesTest method testSecureSigningAlgorithmForSignedJwtEnforceExecutorWithSecureAlg.

@Test
public void testSecureSigningAlgorithmForSignedJwtEnforceExecutorWithSecureAlg() throws Exception {
    // register profiles
    String json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Ensimmainen Profiili").addExecutor(SecureSigningAlgorithmForSignedJwtExecutorFactory.PROVIDER_ID, createSecureSigningAlgorithmForSignedJwtEnforceExecutorConfig(Boolean.TRUE)).toRepresentation()).toString();
    updateProfiles(json);
    // register policies
    String roleAlphaName = "sample-client-role-alpha";
    String roleZetaName = "sample-client-role-zeta";
    String roleCommonName = "sample-client-role-common";
    json = (new ClientPoliciesBuilder()).addPolicy((new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Den Forste Politikken", Boolean.TRUE).addCondition(ClientRolesConditionFactory.PROVIDER_ID, createClientRolesConditionConfig(Arrays.asList(roleAlphaName, roleZetaName))).addProfile(PROFILE_NAME).toRepresentation()).toString();
    updatePolicies(json);
    // create a client with client role
    String clientId = generateSuffixedName(CLIENT_NAME);
    String cid = createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
        clientRep.setSecret("secret");
        clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID);
        clientRep.setAttributes(new HashMap<>());
        clientRep.getAttributes().put(OIDCConfigAttributes.TOKEN_ENDPOINT_AUTH_SIGNING_ALG, org.keycloak.crypto.Algorithm.ES256);
    });
    adminClient.realm(REALM_NAME).clients().get(cid).roles().create(RoleBuilder.create().name(roleAlphaName).build());
    adminClient.realm(REALM_NAME).clients().get(cid).roles().create(RoleBuilder.create().name(roleCommonName).build());
    ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm(REALM_NAME), clientId);
    ClientRepresentation clientRep = clientResource.toRepresentation();
    KeyPair keyPair = setupJwksUrl(org.keycloak.crypto.Algorithm.ES256, clientRep, clientResource);
    PublicKey publicKey = keyPair.getPublic();
    PrivateKey privateKey = keyPair.getPrivate();
    String signedJwt = createSignedRequestToken(clientId, privateKey, publicKey, org.keycloak.crypto.Algorithm.ES256);
    oauth.clientId(clientId);
    oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
    EventRepresentation loginEvent = events.expectLogin().client(clientId).assertEvent();
    String sessionId = loginEvent.getSessionId();
    String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
    // obtain access token
    OAuthClient.AccessTokenResponse response = doAccessTokenRequestWithSignedJWT(code, signedJwt);
    assertEquals(200, response.getStatusCode());
    oauth.verifyToken(response.getAccessToken());
    RefreshToken refreshToken = oauth.parseRefreshToken(response.getRefreshToken());
    assertEquals(sessionId, refreshToken.getSessionState());
    assertEquals(sessionId, refreshToken.getSessionState());
    events.expectCodeToToken(loginEvent.getDetails().get(Details.CODE_ID), loginEvent.getSessionId()).client(clientId).detail(Details.CLIENT_AUTH_METHOD, JWTClientAuthenticator.PROVIDER_ID).assertEvent();
    // refresh token
    signedJwt = createSignedRequestToken(clientId, privateKey, publicKey, org.keycloak.crypto.Algorithm.ES256);
    OAuthClient.AccessTokenResponse refreshedResponse = doRefreshTokenRequestWithSignedJWT(response.getRefreshToken(), signedJwt);
    assertEquals(200, refreshedResponse.getStatusCode());
    // introspect token
    signedJwt = createSignedRequestToken(clientId, privateKey, publicKey, org.keycloak.crypto.Algorithm.ES256);
    HttpResponse tokenIntrospectionResponse = doTokenIntrospectionWithSignedJWT("access_token", refreshedResponse.getAccessToken(), signedJwt);
    assertEquals(200, tokenIntrospectionResponse.getStatusLine().getStatusCode());
    // revoke token
    signedJwt = createSignedRequestToken(clientId, privateKey, publicKey, org.keycloak.crypto.Algorithm.ES256);
    HttpResponse revokeTokenResponse = doTokenRevokeWithSignedJWT("refresh_toke", refreshedResponse.getRefreshToken(), signedJwt);
    assertEquals(200, revokeTokenResponse.getStatusLine().getStatusCode());
    signedJwt = createSignedRequestToken(clientId, privateKey, publicKey, org.keycloak.crypto.Algorithm.ES256);
    OAuthClient.AccessTokenResponse tokenRes = doRefreshTokenRequestWithSignedJWT(refreshedResponse.getRefreshToken(), signedJwt);
    assertEquals(400, tokenRes.getStatusCode());
    assertEquals(OAuthErrorException.INVALID_GRANT, tokenRes.getError());
    // logout
    signedJwt = createSignedRequestToken(clientId, privateKey, publicKey, org.keycloak.crypto.Algorithm.ES256);
    HttpResponse logoutResponse = doLogoutWithSignedJWT(refreshedResponse.getRefreshToken(), signedJwt);
    assertEquals(204, logoutResponse.getStatusLine().getStatusCode());
}

Example 24 with ClientProfilesBuilder

use of org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfilesBuilder in project keycloak by keycloak.

the class ClientPoliciesTest method testExtendedClientPolicyIntefacesForClientRegistrationPolicyMigration.

@Test
public void testExtendedClientPolicyIntefacesForClientRegistrationPolicyMigration() throws Exception {
    // register profiles
    String json = (new ClientProfilesBuilder()).addProfile((new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Den Forste Profilen").addExecutor(TestRaiseExeptionExecutorFactory.PROVIDER_ID, null).toRepresentation()).toString();
    updateProfiles(json);
    // register policies
    json = (new ClientPoliciesBuilder()).addPolicy((new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "La Premiere Politique", Boolean.TRUE).addCondition(AnyClientConditionFactory.PROVIDER_ID, createAnyClientConditionConfig()).addProfile(PROFILE_NAME).toRepresentation()).toString();
    updatePolicies(json);
    String clientName = "ByAdmin-App" + KeycloakModelUtils.generateId().substring(0, 7);
    String clientId = null;
    try {
        createClientByAdmin(clientName, (ClientRepresentation clientRep) -> {
        });
        fail();
    } catch (ClientPolicyException cpe) {
        assertEquals(ClientPolicyEvent.REGISTERED.toString(), cpe.getError());
    }
    clientId = getClientByAdminWithName(clientName).getId();
    assertEquals(true, getClientByAdmin(clientId).isEnabled());
    try {
        updateClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
            clientRep.setEnabled(false);
        });
        fail();
    } catch (ClientPolicyException cpe) {
        assertEquals(ClientPolicyEvent.UPDATED.toString(), cpe.getError());
    }
    assertEquals(false, getClientByAdmin(clientId).isEnabled());
    try {
        deleteClientByAdmin(clientId);
        fail();
    } catch (ClientPolicyException cpe) {
        assertEquals(ClientPolicyEvent.UNREGISTER.toString(), cpe.getError());
    }
// TODO : For dynamic client registration, the existing test scheme can not distinguish when the exception happens on which event so that the migrated client policy executors test them afterwards.
}

Example 25 with ClientProfilesBuilder

use of org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfilesBuilder in project keycloak by keycloak.

the class ClientPoliciesTest method testTwoProfilesWithDifferentConfigurationOfSameExecutorType.

// KEYCLOAK-18108
@Test
public void testTwoProfilesWithDifferentConfigurationOfSameExecutorType() throws Exception {
    setupPolicyClientIdAndSecretNotAcceptableAuthType(POLICY_NAME);
    // register another profile with "SecureClientAuthEnforceExecutorFactory", but use different configuration of client authenticator.
    // This profile won't allow JWTClientSecretAuthenticator.PROVIDER_ID
    String profileName = "UnusedProfile";
    String json = (new ClientProfilesBuilder(getProfilesWithoutGlobals())).addProfile((new ClientProfileBuilder()).createProfile(profileName, "Profile with SecureClientAuthEnforceExecutorFactory").addExecutor(SecureClientAuthenticatorExecutorFactory.PROVIDER_ID, createSecureClientAuthenticatorExecutorConfig(Arrays.asList(JWTClientAuthenticator.PROVIDER_ID, X509ClientAuthenticator.PROVIDER_ID), null)).toRepresentation()).toString();
    updateProfiles(json);
    // Make sure it is still possible to create client with JWTClientSecretAuthenticator. The "UnusedProfile" should not be used as it is not referenced from any client policy
    String cId = createClientByAdmin(generateSuffixedName(CLIENT_NAME), (ClientRepresentation clientRep) -> {
        clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID);
    });
    assertEquals(JWTClientSecretAuthenticator.PROVIDER_ID, getClientByAdmin(cId).getClientAuthenticatorType());
}