Merge pull request #2813 from abstractj/OAuthGrantTest

OAuthGrantTest migration

testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/OAuthClient.java

@@ -122,10 +122,15 @@ public class OAuthClient {
 
     public void doLoginGrant(String username, String password) {
         openLoginForm();
-
+        String src = driver.getPageSource();
+        try {
             driver.findElement(By.id("username")).sendKeys(username);
             driver.findElement(By.id("password")).sendKeys(password);
             driver.findElement(By.name("login")).click();
+        } catch (Throwable t) {
+            System.err.println(src);
+            throw t;
+        }
     }
 
     public AccessTokenResponse doAccessTokenRequest(String code, String password) {

testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/ApiUtil.java

@@ -23,6 +23,7 @@ import org.keycloak.admin.client.resource.RoleResource;
 import org.keycloak.admin.client.resource.UserResource;
 import org.keycloak.representations.idm.ClientRepresentation;
 import org.keycloak.representations.idm.CredentialRepresentation;
+import org.keycloak.representations.idm.ProtocolMapperRepresentation;
 import org.keycloak.representations.idm.RoleRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 
@@ -90,6 +91,15 @@ public class ApiUtil {
         return client.roles().get(role);
     }
 
+    public static ProtocolMapperRepresentation findProtocolMapperByName(ClientResource client, String name) {
+        for (ProtocolMapperRepresentation p : client.getProtocolMappers().getMappers()) {
+            if (p.getName().equals(name)) {
+                return p;
+            }
+        }
+        return null;
+    }
+
     public static RoleResource findRealmRoleByName(RealmResource realm, String role) {
         return realm.roles().get(role);
     }

testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthGrantTest.java

@@ -16,78 +16,78 @@
  */
 package org.keycloak.testsuite.oauth;
 
+import org.jboss.arquillian.graphene.page.Page;
 import org.junit.Assert;
-import org.junit.ClassRule;
 import org.junit.Rule;
 import org.junit.Test;
 import org.keycloak.OAuth2Constants;
+import org.keycloak.admin.client.resource.ClientResource;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.admin.client.resource.UserResource;
 import org.keycloak.common.constants.KerberosConstants;
 import org.keycloak.events.Details;
-import org.keycloak.events.Event;
 import org.keycloak.events.EventType;
-import org.keycloak.models.ClientModel;
-import org.keycloak.models.ProtocolMapperModel;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.RoleModel;
-import org.keycloak.models.UserModel;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
-import org.keycloak.protocol.oidc.mappers.UserSessionNoteMapper;
 import org.keycloak.representations.AccessToken;
-import org.keycloak.services.managers.RealmManager;
+import org.keycloak.representations.idm.EventRepresentation;
+import org.keycloak.representations.idm.ProtocolMapperRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.testsuite.AbstractKeycloakTest;
 import org.keycloak.testsuite.AssertEvents;
-import org.keycloak.testsuite.OAuthClient;
 import org.keycloak.testsuite.pages.AccountApplicationsPage;
 import org.keycloak.testsuite.pages.AppPage;
-import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.pages.OAuthGrantPage;
-import org.keycloak.testsuite.rule.KeycloakRule;
+import org.keycloak.testsuite.util.ClientManager;
-import org.keycloak.testsuite.rule.WebResource;
+import org.keycloak.testsuite.util.OAuthClient;
-import org.keycloak.testsuite.rule.WebRule;
+import org.keycloak.testsuite.util.ProtocolMapperUtil;
+import org.keycloak.testsuite.util.RoleBuilder;
 import org.openqa.selenium.By;
-import org.openqa.selenium.WebDriver;
 
+import java.util.Collections;
+import java.util.List;
 import java.util.Map;
 
 import static org.junit.Assert.assertEquals;
+import static org.keycloak.testsuite.admin.AbstractAdminTest.loadJson;
+import static org.keycloak.testsuite.admin.ApiUtil.findClientByClientId;
+import static org.keycloak.testsuite.admin.ApiUtil.findUserByUsernameId;
 
 /**
  * @author <a href="mailto:vrockai@redhat.com">Viliam Rockai</a>
  */
-public class OAuthGrantTest {
+public class OAuthGrantTest extends AbstractKeycloakTest {
-
-    @ClassRule
-    public static KeycloakRule keycloakRule = new KeycloakRule();
 
+    public static final String THIRD_PARTY_APP = "third-party";
+    public static final String REALM_NAME = "test";
     @Rule
-    public AssertEvents events = new AssertEvents(keycloakRule);
+    public AssertEvents events = new AssertEvents(this);
 
-    @Rule
+    @Page
-    public WebRule webRule = new WebRule(this);
-
-    @WebResource
-    protected WebDriver driver;
-
-    @WebResource
-    protected OAuthClient oauth;
-
-    @WebResource
-    protected LoginPage loginPage;
-
-    @WebResource
     protected OAuthGrantPage grantPage;
-
+    @Page
-    @WebResource
     protected AccountApplicationsPage accountAppsPage;
-
+    @Page
-    @WebResource
     protected AppPage appPage;
 
+    @Override
+    public void beforeAbstractKeycloakTest() throws Exception {
+        super.beforeAbstractKeycloakTest();
+    }
+
+    @Override
+    public void addTestRealms(List<RealmRepresentation> testRealms) {
+
+        RealmRepresentation realmRepresentation = loadJson(getClass().getResourceAsStream("/testrealm.json"), RealmRepresentation.class);
+        testRealms.add(realmRepresentation);
+    }
+
     private static String ROLE_USER = "Have User privileges";
     private static String ROLE_CUSTOMER = "Have Customer User privileges";
 
     @Test
     public void oauthGrantAcceptTest() {
-        oauth.clientId("third-party");
+        oauth.clientId(THIRD_PARTY_APP);
         oauth.doLoginGrant("test-user@localhost", "password");
 
         grantPage.assertCurrent();
@@ -98,8 +98,8 @@ public class OAuthGrantTest {
 
         Assert.assertTrue(oauth.getCurrentQuery().containsKey(OAuth2Constants.CODE));
 
-        Event loginEvent = events.expectLogin()
+        EventRepresentation loginEvent = events.expectLogin()
-                .client("third-party")
+                .client(THIRD_PARTY_APP)
                 .detail(Details.CONSENT, Details.CONSENT_VALUE_CONSENT_GRANTED)
                 .assertEvent();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
@@ -121,23 +121,23 @@ public class OAuthGrantTest {
         assertEquals(1, resourceAccess.get("test-app").getRoles().size());
         Assert.assertTrue(resourceAccess.get("test-app").isUserInRole("customer-user"));
 
-        events.expectCodeToToken(codeId, loginEvent.getSessionId()).client("third-party").assertEvent();
+        events.expectCodeToToken(codeId, loginEvent.getSessionId()).client(THIRD_PARTY_APP).assertEvent();
 
         accountAppsPage.open();
 
         assertEquals(1, driver.findElements(By.id("revoke-third-party")).size());
 
-        accountAppsPage.revokeGrant("third-party");
+        accountAppsPage.revokeGrant(THIRD_PARTY_APP);
 
         events.expect(EventType.REVOKE_GRANT)
-                .client("account").detail(Details.REVOKED_CLIENT, "third-party").assertEvent();
+                .client("account").detail(Details.REVOKED_CLIENT, THIRD_PARTY_APP).assertEvent();
 
         assertEquals(0, driver.findElements(By.id("revoke-third-party")).size());
     }
 
     @Test
     public void oauthGrantCancelTest() {
-        oauth.clientId("third-party");
+        oauth.clientId(THIRD_PARTY_APP);
         oauth.doLoginGrant("test-user@localhost", "password");
 
         grantPage.assertCurrent();
@@ -150,7 +150,7 @@ public class OAuthGrantTest {
         assertEquals("access_denied", oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
 
         events.expectLogin()
-                .client("third-party")
+                .client(THIRD_PARTY_APP)
                 .error("rejected_by_user")
                 .removeDetail(Details.CONSENT)
                 .assertEvent();
@@ -159,20 +159,20 @@ public class OAuthGrantTest {
     @Test
     public void oauthGrantNotShownWhenAlreadyGranted() {
         // Grant permissions on grant screen
-        oauth.clientId("third-party");
+        oauth.clientId(THIRD_PARTY_APP);
         oauth.doLoginGrant("test-user@localhost", "password");
 
         grantPage.assertCurrent();
         grantPage.accept();
 
         events.expectLogin()
-                .client("third-party")
+                .client(THIRD_PARTY_APP)
                 .detail(Details.CONSENT, Details.CONSENT_VALUE_CONSENT_GRANTED)
                 .assertEvent();
 
         // Assert permissions granted on Account mgmt. applications page
         accountAppsPage.open();
-        AccountApplicationsPage.AppEntry thirdPartyEntry = accountAppsPage.getApplications().get("third-party");
+        AccountApplicationsPage.AppEntry thirdPartyEntry = accountAppsPage.getApplications().get(THIRD_PARTY_APP);
         Assert.assertTrue(thirdPartyEntry.getRolesGranted().contains(ROLE_USER));
         Assert.assertTrue(thirdPartyEntry.getRolesGranted().contains("Have Customer User privileges in test-app"));
         Assert.assertTrue(thirdPartyEntry.getProtocolMappersGranted().contains("Full name"));
@@ -185,14 +185,14 @@ public class OAuthGrantTest {
                 .detail(Details.AUTH_METHOD, OIDCLoginProtocol.LOGIN_PROTOCOL)
                 .detail(Details.CONSENT, Details.CONSENT_VALUE_PERSISTED_CONSENT)
                 .removeDetail(Details.USERNAME)
-                .client("third-party").assertEvent();
+                .client(THIRD_PARTY_APP).assertEvent();
 
         // Revoke grant in account mgmt.
         accountAppsPage.open();
-        accountAppsPage.revokeGrant("third-party");
+        accountAppsPage.revokeGrant(THIRD_PARTY_APP);
 
         events.expect(EventType.REVOKE_GRANT)
-                .client("account").detail(Details.REVOKED_CLIENT, "third-party").assertEvent();
+                .client("account").detail(Details.REVOKED_CLIENT, THIRD_PARTY_APP).assertEvent();
 
         // Open login form again and assert grant Page is shown
         oauth.openLoginForm();
@@ -204,108 +204,99 @@ public class OAuthGrantTest {
     @Test
     public void oauthGrantAddAnotherRoleAndMapper() {
         // Grant permissions on grant screen
-        oauth.clientId("third-party");
+        oauth.clientId(THIRD_PARTY_APP);
         oauth.doLoginGrant("test-user@localhost", "password");
+        oauth.scope(OAuth2Constants.GRANT_TYPE);
 
         // Add new protocolMapper and role before showing grant page
-        keycloakRule.update(new KeycloakRule.KeycloakSetup() {
+        ProtocolMapperRepresentation protocolMapper = ProtocolMapperUtil.createClaimMapper(
-
+                KerberosConstants.GSS_DELEGATION_CREDENTIAL_DISPLAY_NAME,
-            @Override
-            public void config(RealmManager manager, RealmModel adminstrationRealm, RealmModel appRealm) {
-                ProtocolMapperModel protocolMapper = UserSessionNoteMapper.createClaimMapper(KerberosConstants.GSS_DELEGATION_CREDENTIAL_DISPLAY_NAME,
                 KerberosConstants.GSS_DELEGATION_CREDENTIAL,
                 KerberosConstants.GSS_DELEGATION_CREDENTIAL, "String",
                 true, KerberosConstants.GSS_DELEGATION_CREDENTIAL_DISPLAY_NAME,
                 true, false);
 
-                ClientModel thirdPartyApp = appRealm.getClientByClientId("third-party");
-                thirdPartyApp.addProtocolMapper(protocolMapper);
 
-                RoleModel newRole = appRealm.addRole("new-role");
+        RealmResource appRealm = adminClient.realm(REALM_NAME);
-                thirdPartyApp.addScopeMapping(newRole);
+        appRealm.roles().create(RoleBuilder.create().name("new-role").build());
-                UserModel testUser = manager.getSession().users().getUserByUsername("test-user@localhost", appRealm);
+        RoleRepresentation newRole = appRealm.roles().get("new-role").toRepresentation();
-                testUser.grantRole(newRole);
-            }
 
-        });
+        ClientManager.realm(adminClient.realm(REALM_NAME)).clientId(THIRD_PARTY_APP)
+                .addProtocolMapper(protocolMapper)
+                .addScopeMapping(newRole);
+
+        UserResource userResource = findUserByUsernameId(appRealm, "test-user@localhost");
+        userResource.roles().realmLevel().add(Collections.singletonList(newRole));
 
         // Confirm grant page
         grantPage.assertCurrent();
         grantPage.accept();
         events.expectLogin()
-                .client("third-party")
+                .client(THIRD_PARTY_APP)
                 .detail(Details.CONSENT, Details.CONSENT_VALUE_CONSENT_GRANTED)
                 .assertEvent();
 
         // Assert new role and protocol mapper not in account mgmt.
         accountAppsPage.open();
-        AccountApplicationsPage.AppEntry appEntry = accountAppsPage.getApplications().get("third-party");
+        AccountApplicationsPage.AppEntry appEntry = accountAppsPage.getApplications().get(THIRD_PARTY_APP);
         Assert.assertFalse(appEntry.getRolesGranted().contains("new-role"));
         Assert.assertFalse(appEntry.getProtocolMappersGranted().contains(KerberosConstants.GSS_DELEGATION_CREDENTIAL_DISPLAY_NAME));
 
         // Show grant page another time. Just new role and protocol mapper are on the page
         oauth.openLoginForm();
         grantPage.assertCurrent();
+
         Assert.assertFalse(driver.getPageSource().contains(ROLE_USER));
         Assert.assertFalse(driver.getPageSource().contains("Full name"));
         Assert.assertTrue(driver.getPageSource().contains("new-role"));
         Assert.assertTrue(driver.getPageSource().contains(KerberosConstants.GSS_DELEGATION_CREDENTIAL_DISPLAY_NAME));
         grantPage.accept();
         events.expectLogin()
-                .client("third-party")
+                .client(THIRD_PARTY_APP)
                 .detail(Details.CONSENT, Details.CONSENT_VALUE_CONSENT_GRANTED)
                 .assertEvent();
 
         // Go to account mgmt. Everything is granted now
         accountAppsPage.open();
-        appEntry = accountAppsPage.getApplications().get("third-party");
+        appEntry = accountAppsPage.getApplications().get(THIRD_PARTY_APP);
         Assert.assertTrue(appEntry.getRolesGranted().contains("new-role"));
         Assert.assertTrue(appEntry.getProtocolMappersGranted().contains(KerberosConstants.GSS_DELEGATION_CREDENTIAL_DISPLAY_NAME));
 
         // Revoke
-        accountAppsPage.revokeGrant("third-party");
+        accountAppsPage.revokeGrant(THIRD_PARTY_APP);
         events.expect(EventType.REVOKE_GRANT)
-                .client("account").detail(Details.REVOKED_CLIENT, "third-party").assertEvent();
+                .client("account").detail(Details.REVOKED_CLIENT, THIRD_PARTY_APP).assertEvent();
 
         // Cleanup
-        keycloakRule.update(new KeycloakRule.KeycloakSetup() {
+        ClientManager.realm(adminClient.realm(REALM_NAME)).clientId(THIRD_PARTY_APP)
+                .removeProtocolMapper(KerberosConstants.GSS_DELEGATION_CREDENTIAL_DISPLAY_NAME)
+                .removeScopeMapping(newRole);
 
-            @Override
+        appRealm.roles().deleteRole("new-role");
-            public void config(RealmManager manager, RealmModel adminstrationRealm, RealmModel appRealm) {
-                ClientModel thirdPartyApp = appRealm.getClientByClientId("third-party");
-                ProtocolMapperModel gssMapper = thirdPartyApp.getProtocolMapperByName(OIDCLoginProtocol.LOGIN_PROTOCOL, KerberosConstants.GSS_DELEGATION_CREDENTIAL_DISPLAY_NAME);
-                thirdPartyApp.removeProtocolMapper(gssMapper);
 
-                RoleModel newRole = appRealm.getRole("new-role");
-                appRealm.removeRole(newRole);
-            }
-
-        });
     }
 
     @Test
     public void oauthGrantScopeParamRequired() throws Exception {
-        keycloakRule.update(new KeycloakRule.KeycloakSetup() {
 
-            @Override
+        RealmResource appRealm = adminClient.realm(REALM_NAME);
-            public void config(RealmManager manager, RealmModel adminstrationRealm, RealmModel appRealm) {
-                ClientModel thirdParty = appRealm.getClientByClientId("third-party");
-                RoleModel barAppRole = thirdParty.addRole("bar-role");
-                barAppRole.setScopeParamRequired(true);
 
-                RoleModel fooRole = appRealm.addRole("foo-role");
+        ClientResource thirdParty = findClientByClientId(appRealm, THIRD_PARTY_APP);
-                fooRole.setScopeParamRequired(true);
+        thirdParty.roles().create(RoleBuilder.create().id("bar-role").name("bar-role").scopeParamRequired(true).build());
-                thirdParty.addScopeMapping(fooRole);
+        RoleRepresentation barAppRole = thirdParty.roles().get("bar-role").toRepresentation();
 
-                UserModel testUser = manager.getSession().users().getUserByUsername("test-user@localhost", appRealm);
+        appRealm.roles().create(RoleBuilder.create().id("foo-role").name("foo-role").scopeParamRequired(true).build());
-                testUser.grantRole(fooRole);
+        RoleRepresentation fooRole = appRealm.roles().get("foo-role").toRepresentation();
-                testUser.grantRole(barAppRole);
+        ClientManager.realm(appRealm).clientId(THIRD_PARTY_APP).addScopeMapping(fooRole);
-            }
 
-        });
+        UserResource testUser = findUserByUsernameId(appRealm, "test-user@localhost");
+
+        testUser.roles().clientLevel(thirdParty.toRepresentation().getId()).add(Collections.singletonList(barAppRole));
+        testUser.roles().realmLevel().add(Collections.singletonList(fooRole));
 
         // Assert roles not on grant screen when not requested
-        oauth.clientId("third-party");
+
+        oauth.clientId(THIRD_PARTY_APP);
         oauth.doLoginGrant("test-user@localhost", "password");
         grantPage.assertCurrent();
         Assert.assertFalse(driver.getPageSource().contains("foo-role"));
@@ -313,7 +304,7 @@ public class OAuthGrantTest {
         grantPage.cancel();
 
         events.expectLogin()
-                .client("third-party")
+                .client(THIRD_PARTY_APP)
                 .error("rejected_by_user")
                 .removeDetail(Details.CONSENT)
                 .assertEvent();
@@ -326,27 +317,18 @@ public class OAuthGrantTest {
         grantPage.accept();
 
         events.expectLogin()
-                .client("third-party")
+                .client(THIRD_PARTY_APP)
                 .detail(Details.CONSENT, Details.CONSENT_VALUE_CONSENT_GRANTED)
                 .assertEvent();
 
         // Revoke
         accountAppsPage.open();
-        accountAppsPage.revokeGrant("third-party");
+        accountAppsPage.revokeGrant(THIRD_PARTY_APP);
         events.expect(EventType.REVOKE_GRANT)
-                .client("account").detail(Details.REVOKED_CLIENT, "third-party").assertEvent();
+                .client("account").detail(Details.REVOKED_CLIENT, THIRD_PARTY_APP).assertEvent();
-
         // cleanup
-        keycloakRule.update(new KeycloakRule.KeycloakSetup() {
+        appRealm.roles().deleteRole(fooRole.getName());
-
+        thirdParty.roles().deleteRole(barAppRole.getName());
-            @Override
-            public void config(RealmManager manager, RealmModel adminstrationRealm, RealmModel appRealm) {
-                appRealm.removeRole(appRealm.getRole("foo-role"));
-                ClientModel thirdparty = appRealm.getClientByClientId("third-party");
-                thirdparty.removeRole(thirdparty.getRole("bar-role"));
-            }
-
-        });
 
     }
 

testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/ClientManager.java

@@ -3,10 +3,14 @@ package org.keycloak.testsuite.util;
 import org.keycloak.admin.client.resource.ClientResource;
 import org.keycloak.admin.client.resource.RealmResource;
 import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.ProtocolMapperRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
 
+import java.util.Collections;
 import java.util.LinkedHashMap;
 
 import static org.keycloak.testsuite.admin.ApiUtil.findClientByClientId;
+import static org.keycloak.testsuite.admin.ApiUtil.findProtocolMapperByName;
 
 /**
  * @author <a href="mailto:bruno@abstractj.org">Bruno Oliveira</a>.
@@ -73,5 +77,24 @@ public class ClientManager {
             app.setConsentRequired(enable);
             clientResource.update(app);
         }
+
+        public ClientManagerBuilder addProtocolMapper(ProtocolMapperRepresentation protocolMapper) {
+            clientResource.getProtocolMappers().createMapper(protocolMapper);
+            return this;
+        }
+
+        public void addScopeMapping(RoleRepresentation newRole) {
+            clientResource.getScopeMappings().realmLevel().add(Collections.singletonList(newRole));
+        }
+
+        public ClientManagerBuilder removeProtocolMapper(String protocolMapperName) {
+            ProtocolMapperRepresentation rep = findProtocolMapperByName(clientResource, protocolMapperName);
+            clientResource.getProtocolMappers().delete(rep.getId());
+            return this;
+        }
+
+        public void removeScopeMapping(RoleRepresentation newRole) {
+            clientResource.getScopeMappings().realmLevel().remove(Collections.singletonList(newRole));
+        }
     }
 }

testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/ProtocolMapperUtil.java

@@ -6,6 +6,7 @@ import org.keycloak.protocol.oidc.mappers.HardcodedClaim;
 import org.keycloak.protocol.oidc.mappers.HardcodedRole;
 import org.keycloak.protocol.oidc.mappers.RoleNameMapper;
 import org.keycloak.protocol.oidc.mappers.UserAttributeMapper;
+import org.keycloak.protocol.oidc.mappers.UserSessionNoteMapper;
 import org.keycloak.representations.idm.ProtocolMapperRepresentation;
 
 /**
@@ -90,4 +91,16 @@ public class ProtocolMapperUtil {
 
     }
 
+    public static ProtocolMapperRepresentation createClaimMapper(String name,
+                                                                 String userSessionNote,
+                                                                 String tokenClaimName, String jsonType,
+                                                                 boolean consentRequired, String consentText,
+                                                                 boolean accessToken, boolean idToken) {
+
+        return ModelToRepresentation.toRepresentation(UserSessionNoteMapper.createClaimMapper(name,
+                userSessionNote,
+                tokenClaimName, jsonType,
+                consentRequired, consentText,
+                accessToken, idToken));
+    }
 }

testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/RoleBuilder.java

@@ -48,6 +48,11 @@ public class RoleBuilder {
         return this;
     }
 
+    public RoleBuilder scopeParamRequired(Boolean required) {
+        rep.setScopeParamRequired(required);
+        return this;
+    }
+
     public RoleRepresentation build() {
         return rep;
     }

testsuite/integration-arquillian/tests/base/src/test/resources/testrealm.json

@@ -114,7 +114,7 @@
       "consentRequired": true,
 
       "redirectUris": [
-        "http://localhost:8180/app/*"
+        "http://localhost:8180/auth/realms/master/app/*"
       ],
       "secret": "password"
     }