diff --git a/core/src/main/java/org/keycloak/OAuth2Constants.java b/core/src/main/java/org/keycloak/OAuth2Constants.java index 409843936f..d0b445cf3b 100644 --- a/core/src/main/java/org/keycloak/OAuth2Constants.java +++ b/core/src/main/java/org/keycloak/OAuth2Constants.java @@ -79,6 +79,7 @@ public interface OAuth2Constants { String UI_LOCALES_PARAM = "ui_locales"; String PROMPT = "prompt"; + String ACR_VALUES = "acr_values"; String MAX_AGE = "max_age"; diff --git a/services/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java b/services/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java index 98d4e34643..c5496883c1 100755 --- a/services/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java +++ b/services/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java @@ -306,6 +306,19 @@ public abstract class AbstractOAuth2IdentityProvider implements ExchangeExternalToken { protected static final Logger logger = Logger.getLogger(OIDCIdentityProvider.class); - public static final String OAUTH2_PARAMETER_PROMPT = "prompt"; public static final String SCOPE_OPENID = "openid"; public static final String FEDERATED_ID_TOKEN = "FEDERATED_ID_TOKEN"; public static final String USER_INFO = "UserInfo"; @@ -213,18 +212,6 @@ public class OIDCIdentityProvider extends AbstractOAuth2IdentityProvider createIdentityProviderMappers() { + IdentityProviderMapperRepresentation attrMapper1 = new IdentityProviderMapperRepresentation(); + attrMapper1.setName("manager-role-mapper"); + attrMapper1.setIdentityProviderMapper(ExternalKeycloakRoleToRoleMapper.PROVIDER_ID); + attrMapper1.setConfig(ImmutableMap.builder() + .put("external.role", "manager") + .put("role", "manager") + .build()); + + IdentityProviderMapperRepresentation attrMapper2 = new IdentityProviderMapperRepresentation(); + attrMapper2.setName("user-role-mapper"); + attrMapper2.setIdentityProviderMapper(ExternalKeycloakRoleToRoleMapper.PROVIDER_ID); + attrMapper2.setConfig(ImmutableMap.builder() + .put("external.role", "user") + .put("role", "user") + .build()); + + return Lists.newArrayList(attrMapper1, attrMapper2); + } + + @Override + protected void loginUser() { + driver.navigate().to(getAccountUrl(bc.consumerRealmName())); + + driver.navigate().to(driver.getCurrentUrl() + "&" + ACR_VALUES + "=" + ACR_3); + + log.debug("Clicking social " + bc.getIDPAlias()); + accountLoginPage.clickSocial(bc.getIDPAlias()); + + waitForPage(driver, "log in to"); + + Assert.assertTrue("Driver should be on the provider realm page right now", + driver.getCurrentUrl().contains("/auth/realms/" + bc.providerRealmName() + "/")); + + Assert.assertTrue(ACR_VALUES + "=" + ACR_3 + " should be part of the url", + driver.getCurrentUrl().contains(ACR_VALUES + "=" + ACR_3)); + + log.debug("Logging in"); + accountLoginPage.login(bc.getUserLogin(), bc.getUserPassword()); + + waitForPage(driver, "update account information"); + + updateAccountInformationPage.assertCurrent(); + Assert.assertTrue("We must be on correct realm right now", + driver.getCurrentUrl().contains("/auth/realms/" + bc.consumerRealmName() + "/")); + + + log.debug("Updating info on updateAccount page"); + updateAccountInformationPage.updateAccountInformation(bc.getUserLogin(), bc.getUserEmail(), "Firstname", "Lastname"); + + UsersResource consumerUsers = adminClient.realm(bc.consumerRealmName()).users(); + + int userCount = consumerUsers.count(); + Assert.assertTrue("There must be at least one user", userCount > 0); + + List users = consumerUsers.search("", 0, userCount); + + boolean isUserFound = false; + for (UserRepresentation user : users) { + if (user.getUsername().equals(bc.getUserLogin()) && user.getEmail().equals(bc.getUserEmail())) { + isUserFound = true; + break; + } + } + + Assert.assertTrue("There must be user " + bc.getUserLogin() + " in realm " + bc.consumerRealmName(), + isUserFound); + } +} diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerPromptParameterTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerPromptParameterTest.java new file mode 100644 index 0000000000..bf85af8a4b --- /dev/null +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerPromptParameterTest.java @@ -0,0 +1,107 @@ +package org.keycloak.testsuite.broker; + +import com.google.common.collect.ImmutableMap; +import com.google.common.collect.Lists; +import org.keycloak.admin.client.resource.UsersResource; +import org.keycloak.broker.oidc.mappers.ExternalKeycloakRoleToRoleMapper; +import org.keycloak.protocol.oidc.OIDCLoginProtocol; +import org.keycloak.representations.idm.IdentityProviderMapperRepresentation; +import org.keycloak.representations.idm.UserRepresentation; +import org.keycloak.testsuite.Assert; +import org.keycloak.testsuite.arquillian.SuiteContext; + +import java.util.List; +import java.util.Map; + +import static org.keycloak.testsuite.broker.BrokerTestTools.waitForPage; + +public class KcOidcBrokerPromptParameterTest extends AbstractBrokerTest { + + private static final String PROMPT_CONSENT = "consent"; + private static final String PROMPT_LOGIN = "login"; + + @Override + protected BrokerConfiguration getBrokerConfiguration() { + return new KcOidcBrokerConfiguration2(); + } + + @Override + protected Iterable createIdentityProviderMappers() { + IdentityProviderMapperRepresentation attrMapper1 = new IdentityProviderMapperRepresentation(); + attrMapper1.setName("manager-role-mapper"); + attrMapper1.setIdentityProviderMapper(ExternalKeycloakRoleToRoleMapper.PROVIDER_ID); + attrMapper1.setConfig(ImmutableMap.builder() + .put("external.role", "manager") + .put("role", "manager") + .build()); + + IdentityProviderMapperRepresentation attrMapper2 = new IdentityProviderMapperRepresentation(); + attrMapper2.setName("user-role-mapper"); + attrMapper2.setIdentityProviderMapper(ExternalKeycloakRoleToRoleMapper.PROVIDER_ID); + attrMapper2.setConfig(ImmutableMap.builder() + .put("external.role", "user") + .put("role", "user") + .build()); + + return Lists.newArrayList(attrMapper1, attrMapper2); + } + + @Override + protected void loginUser() { + driver.navigate().to(getAccountUrl(bc.consumerRealmName())); + + driver.navigate().to(driver.getCurrentUrl() + "&" + OIDCLoginProtocol.PROMPT_PARAM + "=" + PROMPT_CONSENT); + + log.debug("Clicking social " + bc.getIDPAlias()); + accountLoginPage.clickSocial(bc.getIDPAlias()); + + waitForPage(driver, "log in to"); + + Assert.assertTrue("Driver should be on the provider realm page right now", + driver.getCurrentUrl().contains("/auth/realms/" + bc.providerRealmName() + "/")); + + Assert.assertFalse(OIDCLoginProtocol.PROMPT_PARAM + "=" + PROMPT_LOGIN + " should not be part of the url", + driver.getCurrentUrl().contains(OIDCLoginProtocol.PROMPT_PARAM + "=" + PROMPT_LOGIN)); + + Assert.assertTrue(OIDCLoginProtocol.PROMPT_PARAM + "=" + PROMPT_CONSENT + " should be part of the url", + driver.getCurrentUrl().contains(OIDCLoginProtocol.PROMPT_PARAM + "=" + PROMPT_CONSENT)); + + log.debug("Logging in"); + accountLoginPage.login(bc.getUserLogin(), bc.getUserPassword()); + + waitForPage(driver, "update account information"); + + updateAccountInformationPage.assertCurrent(); + Assert.assertTrue("We must be on correct realm right now", + driver.getCurrentUrl().contains("/auth/realms/" + bc.consumerRealmName() + "/")); + + + log.debug("Updating info on updateAccount page"); + updateAccountInformationPage.updateAccountInformation(bc.getUserLogin(), bc.getUserEmail(), "Firstname", "Lastname"); + + UsersResource consumerUsers = adminClient.realm(bc.consumerRealmName()).users(); + + int userCount = consumerUsers.count(); + Assert.assertTrue("There must be at least one user", userCount > 0); + + List users = consumerUsers.search("", 0, userCount); + + boolean isUserFound = false; + for (UserRepresentation user : users) { + if (user.getUsername().equals(bc.getUserLogin()) && user.getEmail().equals(bc.getUserEmail())) { + isUserFound = true; + break; + } + } + + Assert.assertTrue("There must be user " + bc.getUserLogin() + " in realm " + bc.consumerRealmName(), + isUserFound); + } + + private class KcOidcBrokerConfiguration2 extends KcOidcBrokerConfiguration { + protected void applyDefaultConfiguration(final SuiteContext suiteContext, final Map config) { + super.applyDefaultConfiguration(suiteContext, config); + config.remove("prompt"); + } + } +} diff --git a/testsuite/integration-deprecated/src/test/java/org/keycloak/testsuite/keycloaksaml/SamlAdapterTestStrategy.java b/testsuite/integration-deprecated/src/test/java/org/keycloak/testsuite/keycloaksaml/SamlAdapterTestStrategy.java index 91074e3936..1dd5f72d33 100755 --- a/testsuite/integration-deprecated/src/test/java/org/keycloak/testsuite/keycloaksaml/SamlAdapterTestStrategy.java +++ b/testsuite/integration-deprecated/src/test/java/org/keycloak/testsuite/keycloaksaml/SamlAdapterTestStrategy.java @@ -558,7 +558,7 @@ public class SamlAdapterTestStrategy extends ExternalResource { Retry.execute(new Runnable() { @Override public void run() { - assertEquals(driver.getCurrentUrl(), APP_SERVER_BASE_URL + "/sales-post-enc/"); + assertEquals(APP_SERVER_BASE_URL + "/sales-post-enc/", driver.getCurrentUrl()); } }, 10, 100); Assert.assertTrue(driver.getPageSource().contains("bburke"));