libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases Packages Activity Actions

[KEYCLOAK-4683] Add key usage tests for X.509 Authentication

Browse source 
These tests cover the scenarios already available at our certificates:
* Key Usage with the flag critical
* Extended Key Usage without the flag critical
This commit is contained in:
Bruno Oliveira 2017-11-23 18:29:00 -02:00 committed by Stian Thorgersen
parent 92504e8ba3
commit 697caaa805
3 changed files with 60 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/AbstractX509AuthenticationTest.java
View file

@ -301,6 +301,16 @@ public abstract class AbstractX509AuthenticationTest extends AbstractTestRealmKe
.setUserIdentityMapperType(USERNAME_EMAIL);
}
protected static X509AuthenticatorConfigModel createLoginSubjectEmailWithKeyUsage(String keyUsage) {
return createLoginSubjectEmail2UsernameOrEmailConfig()
.setKeyUsage(keyUsage);
}
protected static X509AuthenticatorConfigModel createLoginSubjectEmailWithExtendedKeyUsage(String extendedKeyUsage) {
return createLoginSubjectEmail2UsernameOrEmailConfig()
.setExtendedKeyUsage(extendedKeyUsage);
}
protected static X509AuthenticatorConfigModel createLoginSubjectCN2UsernameOrEmailConfig() {
return new X509AuthenticatorConfigModel()
.setConfirmationPageAllowed(true)

19
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509BrowserLoginTest.java
View file

@ -86,6 +86,25 @@ public class X509BrowserLoginTest extends AbstractX509AuthenticationTest {
login(createLoginSubjectEmail2UsernameOrEmailConfig(), userId, "test-user@localhost", "test-user@localhost");
}
@Test
public void loginWithNonSupportedCertKeyUsage() throws Exception {
// Set the X509 authenticator configuration
AuthenticatorConfigRepresentation cfg = newConfig("x509-browser-config",
createLoginSubjectEmailWithKeyUsage("dataEncipherment").getConfig());
String cfgId = createConfig(browserExecution.getId(), cfg);
Assert.assertNotNull(cfgId);
loginConfirmationPage.open();
Assert.assertThat(loginPage.getError(), containsString("Certificate validation's failed.\n" +
"Key Usage bit 'dataEncipherment' is not set."));
}
@Test
public void loginWithNonSupportedCertExtendedKeyUsage() throws Exception {
login(createLoginSubjectEmailWithExtendedKeyUsage("serverAuth"), userId, "test-user@localhost", "test-user@localhost");
}
@Test
public void loginIgnoreX509IdentityContinueToFormLogin() throws Exception {
// Set the X509 authenticator configuration

31
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509DirectGrantTest.java
View file

@ -114,6 +114,37 @@ public class X509DirectGrantTest extends AbstractX509AuthenticationTest {
assertEquals("Invalid user credentials", response.getErrorDescription());
}
@Test
public void loginWithNonSupportedCertKeyUsage() throws Exception {
// Set the X509 authenticator configuration
AuthenticatorConfigRepresentation cfg = newConfig("x509-directgrant-config",
createLoginSubjectEmailWithKeyUsage("dataEncipherment").getConfig());
String cfgId = createConfig(directGrantExecution.getId(), cfg);
Assert.assertNotNull(cfgId);
oauth.clientId("resource-owner");
OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "", "", null);
assertEquals(401, response.getStatusCode());
assertEquals("invalid_request", response.getError());
Assert.assertThat(response.getErrorDescription(), containsString("Key Usage bit 'dataEncipherment' is not set."));
events.clear();
}
@Test
public void loginWithNonSupportedCertExtendedKeyUsage() throws Exception {
// Set the X509 authenticator configuration
AuthenticatorConfigRepresentation cfg = newConfig("x509-directgrant-config",
createLoginSubjectEmailWithExtendedKeyUsage("serverAuth").getConfig());
String cfgId = createConfig(directGrantExecution.getId(), cfg);
Assert.assertNotNull(cfgId);
oauth.clientId("resource-owner");
OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "", "", null);
assertEquals(200, response.getStatusCode());
}
@Test
public void loginFailedDisabledUser() throws Exception {
setUserEnabled("test-user@localhost", false);