-
Notifications
You must be signed in to change notification settings - Fork 113
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: Add Authorizatoin Server vNext (#79)
- Loading branch information
1 parent
9ba23f4
commit 591063f
Showing
10 changed files
with
189 additions
and
10 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| # Authorization Server | ||
|
|
||
| Keycloak is an open-source Identity and Access Management solution that provides an Authorization Server. The Authorization Server is responsible for access to clients after successfully authenticating and authorizing the users. | ||
|
|
||
| In addition to the Authorization Server, Keycloak also supports a *Policy Enforcement Point* (PEP). The PEP is responsible for enforcing access control policies and protecting resources. It intercepts requests from clients and verifies the access token before allowing or denying access to the requested resource. | ||
|
|
||
| By integrating Keycloak's Authorization Server and PEP into your application, you can implement fine-grained access control and secure your resources based on user roles, permissions, and other attributes. | ||
|
|
||
| ## Evaluate Permissions | ||
|
|
||
| Assume we have a default resource with Name *"urn:test-client:resources:default"*. | ||
|
|
||
| We want to check if a given user has access to it. It is accomplished based on permissions. In our case default permission is applied to default resource type. *"Default Permission"* is based on policy named - *"Require Admin Role"*. This policy checks if a user has *"Admin"* realm role. | ||
|
|
||
| Here is how to do it from code: | ||
|
|
||
| <<< @/../tests/Keycloak.AuthServices.IntegrationTests/AuthorizationServerPolicyTests.cs#RequireProtectedResource_DefaultResource_Verified | ||
|
|
||
| > [!Note] | ||
| > The calls to Authorization Servers are made on behalf of a user based on header propagation. We are taking user's *access_token* (JWT Bearer Token) from `IHttpContextAccessor`. `AddHeaderPropagation` adds `AccessTokenPropagationHandler` delegating handler to `IKeycloakProtectionClient` responsible for header propagation. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
86 changes: 86 additions & 0 deletions
86
tests/Keycloak.AuthServices.IntegrationTests/AuthorizationServerPolicyTests.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,86 @@ | ||
| namespace Keycloak.AuthServices.IntegrationTests; | ||
|
|
||
| using System.Net; | ||
| using Alba; | ||
| using Alba.Security; | ||
| using Keycloak.AuthServices.Authentication; | ||
| using Keycloak.AuthServices.Authorization; | ||
| using Microsoft.AspNetCore.Authentication.JwtBearer; | ||
| using Microsoft.Extensions.DependencyInjection; | ||
| using Xunit.Abstractions; | ||
| using static Keycloak.AuthServices.IntegrationTests.Utils; | ||
|
|
||
| public class AuthorizationServerPolicyTests( | ||
| KeycloakFixture fixture, | ||
| ITestOutputHelper testOutputHelper | ||
| ) : AuthenticationScenario(fixture) | ||
| { | ||
| private static readonly string AppSettings = "appsettings.json"; | ||
|
|
||
| [Fact] | ||
| public async Task RequireProtectedResource_DefaultResource_Verified() | ||
| { | ||
| var policyName = "RequireProtectedResource"; | ||
| await using var host = await AlbaHost.For<Program>( | ||
| x => | ||
| { | ||
| x.WithLogging(testOutputHelper); | ||
| x.UseConfiguration(AppSettings); | ||
| x.ConfigureServices( | ||
| (context, services) => | ||
| { | ||
| #region RequireProtectedResource_DefaultResource_Verified | ||
| services | ||
| .AddAuthentication(JwtBearerDefaults.AuthenticationScheme) | ||
| .AddKeycloakWebApi(context.Configuration); | ||
| services | ||
| .AddAuthorization() | ||
| .AddKeycloakAuthorization() | ||
| .AddAuthorizationBuilder() | ||
| .AddPolicy( | ||
| policyName, | ||
| policy => | ||
| policy.RequireProtectedResource( | ||
| resource: "urn:test-client:resources:default", | ||
| scope: string.Empty | ||
| ) | ||
| ); | ||
| services | ||
| .AddAuthorizationServer(context.Configuration) | ||
| .AddStandardResilienceHandler(); // an example of how to extend IKeycloakProtectionClient by adding Polly | ||
| #endregion RequireProtectedResource_DefaultResource_Verified | ||
| services.PostConfigure<JwtBearerOptions>(options => | ||
| options.WithKeycloakFixture(this.Keycloak) | ||
| ); | ||
| } | ||
| ); | ||
| }, | ||
| UserPasswordFlow(ReadKeycloakAuthenticationOptions(AppSettings)) | ||
| ); | ||
|
|
||
| await host.Scenario(_ => | ||
| { | ||
| _.Get.Url(RunPolicyBuyName(policyName)); | ||
| _.UserAndPasswordIs(TestUsersRegistry.Admin.UserName, TestUsersRegistry.Admin.Password); | ||
| _.StatusCodeShouldBe(HttpStatusCode.OK); | ||
| }); | ||
|
|
||
| await host.Scenario(_ => | ||
| { | ||
| _.Get.Url(RunPolicyBuyName(policyName)); | ||
| _.UserAndPasswordIs( | ||
| TestUsersRegistry.Tester.UserName, | ||
| TestUsersRegistry.Tester.Password | ||
| ); | ||
| _.StatusCodeShouldBe(HttpStatusCode.Forbidden); | ||
| }); | ||
| } | ||
|
|
||
| private static string RunPolicyBuyName(string policyName) => | ||
| $"/endpoints/RunPolicyBuyName?policy={policyName}"; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
17 changes: 17 additions & 0 deletions
17
tests/Keycloak.AuthServices.IntegrationTests/KeycloakConfiguration/Test-users-0.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters