Examples with AccessTokenResponse org.keycloak.testsuite.util.OAuthClient.AccessTokenResponse used on opensource projects

Example 41 with AccessTokenResponse

use of org.keycloak.testsuite.util.OAuthClient.AccessTokenResponse in project keycloak by keycloak.

the class HoKTest method testIntrospectHoKAccessToken.

@Test
public void testIntrospectHoKAccessToken() throws Exception {
    // get an access token with client certificate in mutual authenticate TLS
    // mimic Client
    oauth.doLogin("test-user@localhost", "password");
    String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
    EventRepresentation loginEvent = events.expectLogin().assertEvent();
    AccessTokenResponse accessTokenResponse = null;
    try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
        accessTokenResponse = oauth.doAccessTokenRequest(code, "password", client);
    } catch (IOException ioe) {
        throw new RuntimeException(ioe);
    }
    // Do token introspection
    // mimic Resource Server
    String tokenResponse;
    try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithoutKeyStoreAndTrustStore()) {
        tokenResponse = oauth.introspectTokenWithClientCredential("confidential-cli", "secret1", "access_token", accessTokenResponse.getAccessToken(), client);
    } catch (IOException ioe) {
        throw new RuntimeException(ioe);
    }
    TokenMetadataRepresentation rep = JsonSerialization.readValue(tokenResponse, TokenMetadataRepresentation.class);
    JWSInput jws = new JWSInput(accessTokenResponse.getAccessToken());
    AccessToken at = jws.readJsonContent(AccessToken.class);
    jws = new JWSInput(accessTokenResponse.getRefreshToken());
    RefreshToken rt = jws.readJsonContent(RefreshToken.class);
    String certThumprintFromAccessToken = at.getCertConf().getCertThumbprint();
    String certThumprintFromRefreshToken = rt.getCertConf().getCertThumbprint();
    String certThumprintFromTokenIntrospection = rep.getCertConf().getCertThumbprint();
    String certThumprintFromBoundClientCertificate = MutualTLSUtils.getThumbprintFromDefaultClientCert();
    assertTrue(rep.isActive());
    assertEquals("test-user@localhost", rep.getUserName());
    assertEquals("test-app", rep.getClientId());
    assertEquals(loginEvent.getUserId(), rep.getSubject());
    assertEquals(certThumprintFromTokenIntrospection, certThumprintFromBoundClientCertificate);
    assertEquals(certThumprintFromBoundClientCertificate, certThumprintFromAccessToken);
    assertEquals(certThumprintFromAccessToken, certThumprintFromRefreshToken);
}

Example 42 with AccessTokenResponse

use of org.keycloak.testsuite.util.OAuthClient.AccessTokenResponse in project keycloak by keycloak.

the class HoKTest method serviceAccountWithClientCertificate.

@Test
public void serviceAccountWithClientCertificate() throws Exception {
    oauth.clientId("service-account-client");
    AccessTokenResponse response;
    Supplier<CloseableHttpClient> previous = oauth.getHttpClient();
    try {
        // Request without HoK should fail
        oauth.httpClient(MutualTLSUtils::newCloseableHttpClientWithoutKeyStoreAndTrustStore);
        response = oauth.doClientCredentialsGrantAccessTokenRequest("secret1");
        assertEquals(400, response.getStatusCode());
        assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
        assertEquals("Client Certification missing for MTLS HoK Token Binding", response.getErrorDescription());
        // Request with HoK - success
        oauth.httpClient(MutualTLSUtils::newCloseableHttpClientWithDefaultKeyStoreAndTrustStore);
        response = oauth.doClientCredentialsGrantAccessTokenRequest("secret1");
        assertEquals(200, response.getStatusCode());
        // Success Pattern
        verifyHoKTokenCertThumbPrint(response, MutualTLSUtils.getThumbprintFromDefaultClientCert(), false);
    } catch (IOException ioe) {
        throw new RuntimeException(ioe);
    } finally {
        oauth.httpClient(previous);
    }
}

Example 43 with AccessTokenResponse

use of org.keycloak.testsuite.util.OAuthClient.AccessTokenResponse in project keycloak by keycloak.

the class TokenRevocationTest method isTokenEnabled.

private void isTokenEnabled(AccessTokenResponse tokenResponse, String clientId) throws IOException {
    String introspectionResponse = oauth.introspectAccessTokenWithClientCredential(clientId, "password", tokenResponse.getAccessToken());
    TokenMetadataRepresentation rep = JsonSerialization.readValue(introspectionResponse, TokenMetadataRepresentation.class);
    assertTrue(rep.isActive());
    oauth.clientId(clientId);
    OAuthClient.AccessTokenResponse tokenRefreshResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
    assertEquals(Status.OK.getStatusCode(), tokenRefreshResponse.getStatusCode());
}

Example 44 with AccessTokenResponse

use of org.keycloak.testsuite.util.OAuthClient.AccessTokenResponse in project keycloak by keycloak.

the class TokenRevocationTest method isTokenDisabled.

private void isTokenDisabled(AccessTokenResponse tokenResponse, String clientId) throws IOException {
    isAccessTokenDisabled(tokenResponse.getAccessToken(), clientId);
    oauth.clientId(clientId);
    OAuthClient.AccessTokenResponse tokenRefreshResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
    assertEquals(Status.BAD_REQUEST.getStatusCode(), tokenRefreshResponse.getStatusCode());
}

Example 45 with AccessTokenResponse

use of org.keycloak.testsuite.util.OAuthClient.AccessTokenResponse in project keycloak by keycloak.

the class IdTokenEncryptionTest method testIdTokenEncryptionWithoutEncryptionKEK.

@Test
@UncaughtServerErrorExpected
public void testIdTokenEncryptionWithoutEncryptionKEK() {
    ClientResource clientResource = null;
    ClientRepresentation clientRep = null;
    try {
        // generate and register signing/verifying key onto client, not encryption key
        TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
        oidcClientEndpointsResource.generateKeys(Algorithm.RS256);
        clientResource = ApiUtil.findClientByClientId(adminClient.realm("test"), "test-app");
        clientRep = clientResource.toRepresentation();
        // set id token signature algorithm and encryption algorithms
        OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setIdTokenSignedResponseAlg(Algorithm.RS256);
        OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setIdTokenEncryptedResponseAlg(JWEConstants.RSA1_5);
        OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setIdTokenEncryptedResponseEnc(JWEConstants.A128CBC_HS256);
        // use and set jwks_url
        OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setUseJwksUrl(true);
        String jwksUrl = TestApplicationResourceUrls.clientJwksUri();
        OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setJwksUrl(jwksUrl);
        clientResource.update(clientRep);
        // get id token but failed
        OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
        AccessTokenResponse atr = oauth.doAccessTokenRequest(response.getCode(), "password");
        Assert.assertEquals(OAuthErrorException.INVALID_REQUEST, atr.getError());
        Assert.assertEquals("can not get encryption KEK", atr.getErrorDescription());
    } finally {
        // Revert
        clientResource = ApiUtil.findClientByClientId(adminClient.realm("test"), "test-app");
        clientRep = clientResource.toRepresentation();
        OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setIdTokenSignedResponseAlg(Algorithm.RS256);
        OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setIdTokenEncryptedResponseAlg(null);
        OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setIdTokenEncryptedResponseEnc(null);
        // Revert jwks_url settings
        OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setUseJwksUrl(false);
        OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setJwksUrl(null);
        clientResource.update(clientRep);
    }
}