Examples with AuthenticationRequestAcknowledgement org.keycloak.testsuite.util.OAuthClient.AuthenticationRequestAcknowledgement used on opensource projects

Example 46 with AuthenticationRequestAcknowledgement

use of org.keycloak.testsuite.util.OAuthClient.AuthenticationRequestAcknowledgement in project keycloak by keycloak.

the class FAPICIBATest method testFAPICIBAUserAuthenticationCancelled.

@Test
public void testFAPICIBAUserAuthenticationCancelled() throws Exception {
    // this test is the same as conformance suite's "fapi-ciba-id1-user-rejects-authentication" test that can only be checked manually
    // by kc-sig-fapi's automated conformance testing environment.
    setupPolicyFAPICIBAForAllClient();
    // Register client with private-key-jwt
    String clientUUID = createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
        clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID);
        setClientAuthMethodNeutralSettings(clientRep);
    });
    ClientResource clientResource = adminClient.realm(REALM_NAME).clients().get(clientUUID);
    ClientRepresentation client = clientResource.toRepresentation();
    assertEquals(JWTClientAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
    // prepare valid signed authentication request
    AuthorizationEndpointRequestObject requestObject = createFAPIValidAuthorizationEndpointRequestObject(username, bindingMessage);
    String encodedRequestObject = registerSharedAuthenticationRequest(requestObject, clientId, Algorithm.PS256);
    // Get keys of client. Will be used for client authentication and signing of authentication request
    TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
    Map<String, String> generatedKeys = oidcClientEndpointsResource.getKeysAsBase64();
    KeyPair keyPair = getKeyPairFromGeneratedBase64(generatedKeys, Algorithm.PS256);
    PrivateKey privateKey = keyPair.getPrivate();
    PublicKey publicKey = keyPair.getPublic();
    String signedJwt = createSignedRequestToken(clientId, privateKey, publicKey, org.keycloak.crypto.Algorithm.PS256);
    // user Backchannel Authentication Request
    AuthenticationRequestAcknowledgement response = doBackchannelAuthenticationRequestWithClientSignedJWT(signedJwt, encodedRequestObject, () -> MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore());
    assertThat(response.getStatusCode(), is(equalTo(200)));
    // user Authentication Channel Request
    TestAuthenticationChannelRequest testRequest = doAuthenticationChannelRequest(bindingMessage);
    AuthenticationChannelRequest authenticationChannelReq = testRequest.getRequest();
    assertThat(authenticationChannelReq.getBindingMessage(), is(equalTo(bindingMessage)));
    assertThat(authenticationChannelReq.getScope(), is(containsString(OAuth2Constants.SCOPE_OPENID)));
    // user Authentication Channel completed
    doAuthenticationChannelCallbackCancelled(testRequest);
    String signedJwt2 = createSignedRequestToken(clientId, privateKey, publicKey, org.keycloak.crypto.Algorithm.PS256);
    // user Token Request
    OAuthClient.AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequestWithClientSignedJWT(signedJwt2, response.getAuthReqId(), () -> MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore());
    assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
    assertThat(tokenRes.getError(), is(equalTo(OAuthErrorException.ACCESS_DENIED)));
    assertThat(tokenRes.getErrorDescription(), is(equalTo("not authorized")));
}