libre.sh/keycloak-scim
4
0
Fork 0
Code Issues 15 Pull requests Releases 1 Activity Actions

Correct isValidScope method of TokenManager for Dynamic scopes

Browse source 
Closes #13158
This commit is contained in:
Konstantinos Georgilakis 2022-07-18 11:01:22 +03:00 committed by Marek Posolda
parent 6b1c64a1a9
commit baa89debd9
2 changed files with 22 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
services/src/main/java/org/keycloak/protocol/oidc/TokenManager.java
View file

@ -650,9 +650,6 @@ public class TokenManager {
if (scopes == null) { if (scopes == null) {
return true; return true;
} }
if (authorizationRequestContext.getAuthorizationDetailEntries() == null || authorizationRequestContext.getAuthorizationDetailEntries().isEmpty()) {
return false;
}
Collection<String> requestedScopes = TokenManager.parseScopeParameter(scopes).collect(Collectors.toSet()); Collection<String> requestedScopes = TokenManager.parseScopeParameter(scopes).collect(Collectors.toSet());
Set<String> rarScopes = authorizationRequestContext.getAuthorizationDetailEntries() Set<String> rarScopes = authorizationRequestContext.getAuthorizationDetailEntries()
.stream() .stream()
@ -664,6 +661,10 @@ public class TokenManager {
requestedScopes.remove(OAuth2Constants.SCOPE_OPENID); requestedScopes.remove(OAuth2Constants.SCOPE_OPENID);
} }
if ((authorizationRequestContext.getAuthorizationDetailEntries() == null || authorizationRequestContext.getAuthorizationDetailEntries().isEmpty()) && requestedScopes.size()>0) {
return false;
}
if (logger.isTraceEnabled()) { if (logger.isTraceEnabled()) {
logger.tracef("Rar scopes to validate requested scopes against: %1s", String.join(" ", rarScopes)); logger.tracef("Rar scopes to validate requested scopes against: %1s", String.join(" ", rarScopes));
logger.tracef("Requested scopes: %1s", String.join(" ", requestedScopes)); logger.tracef("Requested scopes: %1s", String.join(" ", requestedScopes));

18
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/FlowOverrideTest.java
View file

@ -26,6 +26,7 @@ import org.keycloak.OAuth2Constants;
import org.keycloak.admin.client.resource.ClientsResource; import org.keycloak.admin.client.resource.ClientsResource;
import org.keycloak.authentication.authenticators.browser.UsernamePasswordFormFactory; import org.keycloak.authentication.authenticators.browser.UsernamePasswordFormFactory;
import org.keycloak.authentication.authenticators.challenge.BasicAuthOTPAuthenticatorFactory; import org.keycloak.authentication.authenticators.challenge.BasicAuthOTPAuthenticatorFactory;
import org.keycloak.common.Profile;
import org.keycloak.events.Details; import org.keycloak.events.Details;
import org.keycloak.models.AuthenticationExecutionModel; import org.keycloak.models.AuthenticationExecutionModel;
import org.keycloak.models.AuthenticationFlowBindings; import org.keycloak.models.AuthenticationFlowBindings;
@ -41,6 +42,7 @@ import org.keycloak.representations.idm.UserRepresentation;
import org.keycloak.testsuite.AbstractTestRealmKeycloakTest; import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
import org.keycloak.testsuite.AssertEvents; import org.keycloak.testsuite.AssertEvents;
import org.keycloak.testsuite.arquillian.annotation.AuthServerContainerExclude; import org.keycloak.testsuite.arquillian.annotation.AuthServerContainerExclude;
import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
import org.keycloak.testsuite.arquillian.annotation.UncaughtServerErrorExpected; import org.keycloak.testsuite.arquillian.annotation.UncaughtServerErrorExpected;
import org.keycloak.testsuite.authentication.PushButtonAuthenticatorFactory; import org.keycloak.testsuite.authentication.PushButtonAuthenticatorFactory;
import org.keycloak.testsuite.pages.AppPage; import org.keycloak.testsuite.pages.AppPage;
@ -264,6 +266,14 @@ public class FlowOverrideTest extends AbstractTestRealmKeycloakTest {
events.expectLogin().client("test-app-flow").detail(Details.USERNAME, "test-user@localhost").assertEvent(); events.expectLogin().client("test-app-flow").detail(Details.USERNAME, "test-user@localhost").assertEvent();
} }
// TODO remove this once DYNAMIC_SCOPES feature is enabled by default
@Test
@EnableFeature(value = Profile.Feature.DYNAMIC_SCOPES, skipRestart = true)
public void testWithClientBrowserOverrideWithDynamicScope() throws Exception {
// Just use existing test with DYNAMIC_SCOPES feature enabled as it was failing with DYNAMIC_SCOPES
testWithClientBrowserOverride();
}
@Test @Test
public void testNoOverrideBrowser() throws Exception { public void testNoOverrideBrowser() throws Exception {
String clientId = "test-app"; String clientId = "test-app";
@ -531,6 +541,14 @@ public class FlowOverrideTest extends AbstractTestRealmKeycloakTest {
events.clear(); events.clear();
} }
// TODO remove this once DYNAMIC_SCOPES feature is enabled by default
@Test
@EnableFeature(value = Profile.Feature.DYNAMIC_SCOPES, skipRestart = true)
public void testClientOverrideFlowUsingBrowserHttpChallengeWithDynamicScope() {
// Just use existing test with DYNAMIC_SCOPES feature enabled as it was failing with DYNAMIC_SCOPES
testClientOverrideFlowUsingBrowserHttpChallenge();
}
@Test @Test
public void testRestInterface() throws Exception { public void testRestInterface() throws Exception {
ClientsResource clients = adminClient.realm("test").clients(); ClientsResource clients = adminClient.realm("test").clients();