Examples with AuthenticationRequestAcknowledgement org.keycloak.testsuite.util.OAuthClient.AuthenticationRequestAcknowledgement used on opensource projects

Example 21 with AuthenticationRequestAcknowledgement

use of org.keycloak.testsuite.util.OAuthClient.AuthenticationRequestAcknowledgement in project keycloak by keycloak.

the class CIBATest method testBackchannelAuthnReqWithUnknownUser.

@Test
public void testBackchannelAuthnReqWithUnknownUser() throws Exception {
    ClientResource clientResource = null;
    ClientRepresentation clientRep = null;
    try {
        final String username = "Unbekannt";
        final String bindingMessage = "BASTION";
        // prepare CIBA settings
        clientResource = ApiUtil.findClientByClientId(adminClient.realm(TEST_REALM_NAME), TEST_CLIENT_NAME);
        clientRep = clientResource.toRepresentation();
        prepareCIBASettings(clientResource, clientRep);
        oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
        // user Backchannel Authentication Request
        AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, bindingMessage, "urn:mace:incommon:iap:silver urn:mace:incommon:iap:gold");
        assertThat(response.getStatusCode(), is(equalTo(400)));
        assertThat(response.getError(), is(OAuthErrorException.INVALID_REQUEST));
    } finally {
        revertCIBASettings(clientResource, clientRep);
    }
}

Example 22 with AuthenticationRequestAcknowledgement

use of org.keycloak.testsuite.util.OAuthClient.AuthenticationRequestAcknowledgement in project keycloak by keycloak.

the class CIBATest method testExplicitConsentRequiredBackchannelAuthenticationFlows.

@Test
public void testExplicitConsentRequiredBackchannelAuthenticationFlows() throws Exception {
    ClientResource clientResource = null;
    ClientRepresentation clientRep = null;
    try {
        final String username = "nutzername-gelb";
        // see testrealm.json : "consentRequired": true
        final String clientName = "third-party";
        final String clientPassword = "password";
        String clientAuthReqId = null;
        clientResource = ApiUtil.findClientByClientId(adminClient.realm(TEST_REALM_NAME), clientName);
        clientRep = clientResource.toRepresentation();
        prepareCIBASettings(clientResource, clientRep);
        // client Backchannel Authentication Request
        AuthenticationRequestAcknowledgement response = doBackchannelAuthenticationRequest(clientName, clientPassword, username, "asdfghjkl");
        clientAuthReqId = response.getAuthReqId();
        // client Authentication Channel Request
        TestAuthenticationChannelRequest clientAuthenticationChannelReq = doAuthenticationChannelRequest("asdfghjkl");
        Assert.assertTrue(clientAuthenticationChannelReq.getRequest().getConsentRequired());
        assertThat(clientAuthenticationChannelReq.getRequest().getScope(), is(containsString(OAuth2Constants.SCOPE_OPENID)));
        assertThat(clientAuthenticationChannelReq.getRequest().getScope(), is(containsString("email")));
        assertThat(clientAuthenticationChannelReq.getRequest().getScope(), is(containsString("profile")));
        assertThat(clientAuthenticationChannelReq.getRequest().getScope(), is(containsString("roles")));
        // client Authentication Channel completed
        EventRepresentation clientloginEvent = doAuthenticationChannelCallback(clientAuthenticationChannelReq);
        String clientSessionId = clientloginEvent.getSessionId();
        String clientSessionCodeId = clientloginEvent.getDetails().get(Details.CODE_ID);
        // client Token Request
        OAuthClient.AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequest(clientName, clientPassword, username, clientAuthReqId);
    } finally {
        revertCIBASettings(clientResource, clientRep);
    }
}

Example 23 with AuthenticationRequestAcknowledgement

use of org.keycloak.testsuite.util.OAuthClient.AuthenticationRequestAcknowledgement in project keycloak by keycloak.

the class CIBATest method testRequestTokenBeforeAuthenticationNotCompleted.

@Test
public void testRequestTokenBeforeAuthenticationNotCompleted() throws Exception {
    ClientResource clientResource = null;
    ClientRepresentation clientRep = null;
    try {
        final String username = "nutzername-rot";
        // prepare CIBA settings
        clientResource = ApiUtil.findClientByClientId(adminClient.realm(TEST_REALM_NAME), TEST_CLIENT_NAME);
        assertThat(clientResource, notNullValue());
        clientRep = clientResource.toRepresentation();
        prepareCIBASettings(clientResource, clientRep);
        // user Backchannel Authentication Request
        AuthenticationRequestAcknowledgement response = doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, "kvoDKw98");
        // user Token Request before Authentication Channel completion
        OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(TEST_CLIENT_PASSWORD, response.getAuthReqId());
        assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
        assertThat(tokenRes.getError(), is(OAuthErrorException.AUTHORIZATION_PENDING));
        // user Authentication Channel Request
        TestAuthenticationChannelRequest authenticationChannelReq = doAuthenticationChannelRequest("kvoDKw98");
        // user Authentication Channel completed
        doAuthenticationChannelCallback(authenticationChannelReq);
        setTimeOffset(6);
        // user Token Request after Authentication Channel completion
        tokenRes = oauth.doBackchannelAuthenticationTokenRequest(TEST_CLIENT_PASSWORD, response.getAuthReqId());
        assertThat(tokenRes.getStatusCode(), is(equalTo(200)));
        IDToken idToken = oauth.verifyIDToken(tokenRes.getIdToken());
        assertThat(idToken.getPreferredUsername(), is(equalTo(username)));
        AccessToken accessToken = oauth.verifyToken(tokenRes.getAccessToken());
        assertThat(accessToken, notNullValue());
    } finally {
        revertCIBASettings(clientResource, clientRep);
    }
}

Example 24 with AuthenticationRequestAcknowledgement

use of org.keycloak.testsuite.util.OAuthClient.AuthenticationRequestAcknowledgement in project keycloak by keycloak.

the class CIBATest method testTokenRequestAfterIntervalButNotYetAuthenticated.

@Test
public void testTokenRequestAfterIntervalButNotYetAuthenticated() throws Exception {
    ClientResource clientResource = null;
    ClientRepresentation clientRep = null;
    try {
        final String username = "nutzername-rot";
        final String bindingMessage = "BASTION";
        // prepare CIBA settings
        clientResource = ApiUtil.findClientByClientId(adminClient.realm(TEST_REALM_NAME), TEST_CLIENT_NAME);
        clientRep = clientResource.toRepresentation();
        prepareCIBASettings(clientResource, clientRep);
        RealmRepresentation rep = backupCIBAPolicy();
        Map<String, String> attrMap = Optional.ofNullable(rep.getAttributes()).orElse(new HashMap<>());
        attrMap.put(CibaConfig.CIBA_INTERVAL, String.valueOf(5));
        rep.setAttributes(attrMap);
        testRealm().update(rep);
        // user Backchannel Authentication Request
        AuthenticationRequestAcknowledgement response = doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, bindingMessage);
        // user Token Request but not yet user being authenticated
        OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, response.getAuthReqId());
        assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
        assertThat(tokenRes.getError(), is(OAuthErrorException.AUTHORIZATION_PENDING));
        // user Token Request but not yet user being authenticated
        tokenRes = oauth.doBackchannelAuthenticationTokenRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, response.getAuthReqId());
        assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
        assertThat(tokenRes.getError(), is(OAuthErrorException.SLOW_DOWN));
        // user Authentication Channel Request
        TestAuthenticationChannelRequest authenticationChannelReq = doAuthenticationChannelRequest(bindingMessage);
        assertThat(authenticationChannelReq.getRequest().getBindingMessage(), is(equalTo(bindingMessage)));
        // user Authentication Channel completed
        EventRepresentation loginEvent = doAuthenticationChannelCallback(authenticationChannelReq);
        String sessionId = loginEvent.getSessionId();
        String codeId = loginEvent.getDetails().get(Details.CODE_ID);
        String userId = loginEvent.getUserId();
        setTimeOffset(5);
        // user Token Request again
        tokenRes = doBackchannelAuthenticationTokenRequest(username, response.getAuthReqId());
        // token introspection
        String tokenResponse = doIntrospectAccessTokenWithClientCredential(tokenRes, username);
        // token refresh
        tokenRes = doRefreshTokenRequest(tokenRes.getRefreshToken(), username, sessionId, false);
        // token introspection after token refresh
        tokenResponse = doIntrospectAccessTokenWithClientCredential(tokenRes, username);
        // revoke by refresh token
        EventRepresentation logoutEvent = doTokenRevokeByRefreshToken(tokenRes.getRefreshToken(), sessionId, userId, false);
    } finally {
        revertCIBASettings(clientResource, clientRep);
        restoreCIBAPolicy();
    }
}

Example 25 with AuthenticationRequestAcknowledgement

use of org.keycloak.testsuite.util.OAuthClient.AuthenticationRequestAcknowledgement in project keycloak by keycloak.

the class CIBATest method testPingMode_requestWithInvalidClientNotificationShouldFail.

// PING MODE TESTS
@Test
public void testPingMode_requestWithInvalidClientNotificationShouldFail() throws Exception {
    ClientResource clientResource = null;
    ClientRepresentation clientRep = null;
    try {
        // prepare CIBA settings
        clientResource = ApiUtil.findClientByClientId(adminClient.realm(TEST_REALM_NAME), TEST_CLIENT_NAME);
        assertThat(clientResource, notNullValue());
        clientRep = clientResource.toRepresentation();
        prepareCIBASettings(clientResource, clientRep, "ping");
        // Backchannel Authentication Request without client_notification should fail
        AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, "nutzername-rot", "BASTION_PING", null, null, Collections.emptyMap());
        assertThat(response.getStatusCode(), is(equalTo(400)));
        assertThat(response.getError(), is(OAuthErrorException.INVALID_REQUEST));
        // Backchannel Authentication Request without client_notification should fail
        String clientNotificationLongerThan1024Characters = "123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789_123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789_123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789_123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789_123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789_123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789_123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789_123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789_123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789_123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789_123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789_123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789";
        response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, "nutzername-rot", "BASTION_PING", null, clientNotificationLongerThan1024Characters, Collections.emptyMap());
        assertThat(response.getStatusCode(), is(equalTo(400)));
        assertThat(response.getError(), is(OAuthErrorException.INVALID_REQUEST));
    } finally {
        revertCIBASettings(clientResource, clientRep);
    }
}