cavuugroup · Feb 1, 2024 · Jan 25, 2024 · Feb 1, 2024 · Jan 21, 2024 · Feb 1, 2024
@@ -20,6 +20,7 @@
 import org.jboss.logging.Logger;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.OAuthErrorException;
+import org.keycloak.TokenVerifier;
 import org.keycloak.broker.provider.BrokeredIdentityContext;
 import org.keycloak.broker.provider.ExchangeExternalToken;
 import org.keycloak.broker.provider.ExchangeTokenToIdentityProviderToken;
@@ -29,6 +30,7 @@
 import org.keycloak.broker.provider.IdentityProviderMapperSyncModeDelegate;
 import org.keycloak.common.ClientConnection;
 import org.keycloak.common.Profile;
+import org.keycloak.common.VerificationException;
 import org.keycloak.common.constants.ServiceAccountConstants;
 import org.keycloak.common.util.Base64Url;
 import org.keycloak.events.Details;
@@ -38,6 +40,7 @@
 import org.keycloak.jose.jws.JWSInput;
 import org.keycloak.jose.jws.JWSInputException;
 import org.keycloak.models.ClientModel;
+import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.ClientSessionContext;
 import org.keycloak.models.FederatedIdentityModel;
 import org.keycloak.models.IdentityProviderMapperModel;
@@ -84,7 +87,9 @@
 import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.atomic.AtomicReference;
+import java.util.function.Supplier;
 import java.util.stream.Collectors;
+import java.util.stream.Stream;
 
 import jakarta.ws.rs.core.HttpHeaders;
 import jakarta.ws.rs.core.MediaType;
@@ -126,7 +131,7 @@ public Response exchange(TokenExchangeContext context) {
         this.event = context.getEvent();
         this.clientConnection = context.getClientConnection();
         this.headers = context.getHeaders();
-        this.tokenManager = (TokenManager)context.getTokenManager();
+        this.tokenManager = (TokenManager) context.getTokenManager();
         this.clientAuthAttributes = context.getClientAuthAttributes();
         return tokenExchange();
     }
@@ -255,7 +260,7 @@ protected Response tokenExchange() {
                     }
                 }
             }
-         }
+        }
     }
 
     protected Response exchangeToIdentityProvider(UserModel targetUser, UserSessionModel targetUserSession, String requestedIssuer) {
@@ -311,10 +316,28 @@ protected Response exchangeClientToClient(UserModel targetUser, UserSessionModel
             }
         }
 
-        if (targetClient.isConsentRequired()) {
-            event.detail(Details.REASON, "audience requires consent");
-            event.error(Errors.CONSENT_DENIED);
-            throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_CLIENT, "Client requires user consent", Response.Status.BAD_REQUEST);
+        String scopesFromSubjectToken = null;
+        String subjectToken = formParams.getFirst(OAuth2Constants.SUBJECT_TOKEN);
+        if (subjectToken != null) {
+            try {
+                scopesFromSubjectToken = TokenVerifier.create(subjectToken, AccessToken.class).parse().getToken().getScope();
+            } catch (VerificationException e) {
+                event.detail(Details.REASON, "unable to parse jwt subject_token");
+                event.error(Errors.INVALID_TOKEN);
+                throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_TOKEN, "Invalid subject token", Response.Status.BAD_REQUEST);
+            }
+        }
+
+        // verification of existing users consents for requested scopes of target client
+        if (!TokenManager.verifyConsentStillAvailable(session, targetUser, targetClient, TokenManager.getRequestedClientScopes(scopesFromSubjectToken, client))) {
+            event.error(Errors.NOT_ALLOWED);
+            event.detail(Details.REASON, String.format(
+                    "Missing some consents of [%s] for audience [%s]",
+                    TokenManager.getRequestedClientScopes(scopesFromSubjectToken, client)
+                            .map(ClientScopeModel::getName)
+                            .collect(Collectors.joining(",")),
+                    targetClient.getClientId()));
+            throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_SCOPE, "Client requires user consent", Response.Status.BAD_REQUEST);
         }
 
         boolean isClientTheAudience = client.equals(targetClient);
@@ -430,7 +453,7 @@ protected Response exchangeClientToOIDCClient(UserModel targetUser, UserSessionM
         }
 
         if (requestedTokenType.equals(OAuth2Constants.REFRESH_TOKEN_TYPE)
-            && OIDCAdvancedConfigWrapper.fromClientModel(client).isUseRefreshToken()) {
+                && OIDCAdvancedConfigWrapper.fromClientModel(client).isUseRefreshToken()) {
             responseBuilder.generateRefreshToken();
             responseBuilder.getRefreshToken().issuedFor(client.getClientId());
         }
@@ -442,7 +465,7 @@ protected Response exchangeClientToOIDCClient(UserModel targetUser, UserSessionM
 
         AccessTokenResponse res = responseBuilder.build();
         event.detail(Details.AUDIENCE, targetClient.getClientId())
-            .user(targetUser);
+                .user(targetUser);
 
         event.success();
 
@@ -492,7 +515,7 @@ protected Response exchangeClientToSAML2Client(UserModel targetUser, UserSession
         res.setOtherClaims(OAuth2Constants.ISSUED_TOKEN_TYPE, requestedTokenType);
 
         event.detail(Details.AUDIENCE, targetClient.getClientId())
-            .user(targetUser);
+                .user(targetUser);
 
         event.success();
 
@@ -557,12 +580,12 @@ protected UserModel importUserFromExternalIdentity(BrokeredIdentityContext conte
                 .collect(Collectors.toSet());
         KeycloakSessionFactory sessionFactory = session.getKeycloakSessionFactory();
         for (IdentityProviderMapperModel mapper : mappers) {
-            IdentityProviderMapper target = (IdentityProviderMapper)sessionFactory.getProviderFactory(IdentityProviderMapper.class, mapper.getIdentityProviderMapper());
+            IdentityProviderMapper target = (IdentityProviderMapper) sessionFactory.getProviderFactory(IdentityProviderMapper.class, mapper.getIdentityProviderMapper());
             target.preprocessFederatedIdentity(session, realm, mapper, context);
         }
 
         UserModel user = null;
-        if (! context.getIdpConfig().isTransientUsers()) {
+        if (!context.getIdpConfig().isTransientUsers()) {
             FederatedIdentityModel federatedIdentityModel = new FederatedIdentityModel(providerId, context.getId(),
                     context.getUsername(), context.getToken());
 
@@ -610,7 +633,7 @@ protected UserModel importUserFromExternalIdentity(BrokeredIdentityContext conte
             user.setLastName(context.getLastName());
 
 
-            if (! context.getIdpConfig().isTransientUsers()) {
+            if (!context.getIdpConfig().isTransientUsers()) {
                 FederatedIdentityModel federatedIdentityModel = new FederatedIdentityModel(context.getIdpConfig().getAlias(), context.getId(),
                         context.getModelUsername(), context.getToken());
                 session.users().addFederatedIdentity(realm, user, federatedIdentityModel);
@@ -619,7 +642,7 @@ protected UserModel importUserFromExternalIdentity(BrokeredIdentityContext conte
             context.getIdp().importNewUser(session, realm, user, context);
 
             for (IdentityProviderMapperModel mapper : mappers) {
-                IdentityProviderMapper target = (IdentityProviderMapper)sessionFactory.getProviderFactory(IdentityProviderMapper.class, mapper.getIdentityProviderMapper());
+                IdentityProviderMapper target = (IdentityProviderMapper) sessionFactory.getProviderFactory(IdentityProviderMapper.class, mapper.getIdentityProviderMapper());
                 target.importNewUser(session, realm, user, mapper, context);
             }
 
@@ -650,7 +673,7 @@ protected UserModel importUserFromExternalIdentity(BrokeredIdentityContext conte
             context.getIdp().updateBrokeredUser(session, realm, user, context);
 
             for (IdentityProviderMapperModel mapper : mappers) {
-                IdentityProviderMapper target = (IdentityProviderMapper)sessionFactory.getProviderFactory(IdentityProviderMapper.class, mapper.getIdentityProviderMapper());
+                IdentityProviderMapper target = (IdentityProviderMapper) sessionFactory.getProviderFactory(IdentityProviderMapper.class, mapper.getIdentityProviderMapper());
                 IdentityProviderMapperSyncModeDelegate.delegateUpdateBrokeredUser(session, realm, user, mapper, context, target);
             }
         }

@@ -30,6 +30,7 @@
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
+import org.keycloak.models.UserConsentModel;
 import org.keycloak.models.UserCredentialModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.protocol.oidc.OIDCConfigAttributes;
@@ -52,6 +53,7 @@
 import org.keycloak.testsuite.arquillian.annotation.DisableFeature;
 import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
 import org.keycloak.testsuite.arquillian.annotation.UncaughtServerErrorExpected;
+import org.keycloak.testsuite.util.AccountHelper;
 import org.keycloak.testsuite.util.OAuthClient;
 import org.keycloak.util.BasicAuthHelper;
 
@@ -63,6 +65,9 @@
 import jakarta.ws.rs.core.Response;
 
 import java.util.Arrays;
+
+import java.time.LocalDateTime;
+import java.time.ZoneId;
 import java.util.List;
 import java.util.Map;
 
@@ -241,6 +246,7 @@ public static void setupRealm(KeycloakSession session) {
         ResourceServer server = management.realmResourceServer();
         Policy clientPolicy = management.authz().getStoreFactory().getPolicyStore().create(server, clientRep);
         management.clients().exchangeToPermission(target).addAssociatedPolicy(clientPolicy);
+        management.clients().exchangeToPermission(realm.getClientByClientId("target-with-consent")).addAssociatedPolicy(clientPolicy);
 
         // permission for user impersonation for a client
 
@@ -279,6 +285,19 @@ public static void setUpUserImpersonatePermissions(KeycloakSession session) {
         userImpersonationPermission.addAssociatedPolicy(clientsAllowedToImpersonate);
     }
 
+    public static void setUpTokenExchangeConsent(KeycloakSession session) {
+        RealmModel realm = session.realms().getRealmByName(TEST);
+        ClientModel targetClientRequiredConsent = session.clients().getClientByClientId(realm, "target-with-consent");
+        UserConsentModel userConsentModel = new UserConsentModel(targetClientRequiredConsent);
+        userConsentModel.setCreatedDate(LocalDateTime.now().atZone(ZoneId.systemDefault()).toInstant().toEpochMilli());
+
+        session.clients().getClientScopes(realm, targetClientRequiredConsent, true).values().forEach(userConsentModel::addGrantedClientScope);
+        session.clients().getClientScopes(realm, targetClientRequiredConsent, false).values().forEach(userConsentModel::addGrantedClientScope);
+        userConsentModel.setLastUpdatedDate(LocalDateTime.now().atZone(ZoneId.systemDefault()).toInstant().toEpochMilli());
+
+        session.users().addConsent(realm, session.users().getUserByUsername(realm, "user").getId(), userConsentModel);
+    }
+
     @Override
     protected boolean isImportAfterEachMethod() {
         return true;
@@ -967,6 +986,43 @@ public void testClientExchange() throws Exception {
         assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
     }
 
+    @Test
+    public void testClientExchangeBadRequestWhenNoConsent() throws Exception {
+        testingClient.server().run(ClientTokenExchangeTest::setupRealm);
+
+        oauth.realm(TEST);
+        oauth.clientId("direct-legal");
+        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "user", "password");
+        String accessToken = response.getAccessToken();
+        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
+        AccessToken token = accessTokenVerifier.parse().getToken();
+        Assert.assertEquals(token.getPreferredUsername(), "user");
+        assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
+
+        response = oauth.doTokenExchange(TEST, accessToken, "target-with-consent", "direct-legal", "secret");
+        assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+
+    }
+    @Test
+    public void testClientExchangeOKWhenNoConsentExists() throws Exception {
+        testingClient.server().run(ClientTokenExchangeTest::setupRealm);
+        testingClient.server().run(ClientTokenExchangeTest::setUpTokenExchangeConsent);
+
+        oauth.realm(TEST);
+        oauth.clientId("direct-legal");
+        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "user", "password");
+        String accessToken = response.getAccessToken();
+        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
+        AccessToken token = accessTokenVerifier.parse().getToken();
+        Assert.assertEquals(token.getPreferredUsername(), "user");
+        assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
+
+        response = oauth.doTokenExchange(TEST, accessToken, "target-with-consent", "direct-legal", "secret");
+        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+
+    }
+
     @Test
     public void testPublicClientNotAllowed() throws Exception {
         testingClient.server().run(ClientTokenExchangeTest::setupRealm);
@@ -1025,6 +1081,17 @@ private static void addDirectExchanger(KeycloakSession session) {
         target.setFullScopeAllowed(false);
         target.addScopeMapping(exampleRole);
 
+        ClientModel targetWithConsentRequired = realm.addClient("target-with-consent");
+        targetWithConsentRequired.setName("target-with-consent");
+        targetWithConsentRequired.setClientId("target-with-consent");
+        targetWithConsentRequired.setDirectAccessGrantsEnabled(true);
+        targetWithConsentRequired.setEnabled(true);
+        targetWithConsentRequired.setSecret("secret");
+        targetWithConsentRequired.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        targetWithConsentRequired.setFullScopeAllowed(false);
+        targetWithConsentRequired.addScopeMapping(exampleRole);
+        targetWithConsentRequired.setConsentRequired(true);
+
         ClientModel directExchanger = realm.addClient("direct-exchanger");
         directExchanger.setName("direct-exchanger");
         directExchanger.setClientId("direct-exchanger");
@@ -1037,6 +1104,7 @@ private static void addDirectExchanger(KeycloakSession session) {
 
         // permission for client to client exchange to "target" client
         management.clients().setPermissionsEnabled(target, true);
+        management.clients().setPermissionsEnabled(targetWithConsentRequired, true);
 
         ClientPolicyRepresentation clientImpersonateRep = new ClientPolicyRepresentation();
         clientImpersonateRep.setName("clientImpersonatorsDirect");