From 8444331ef52c75a325c7cd8b4e06f055eb5e00b6 Mon Sep 17 00:00:00 2001 From: Simon Vacek Date: Tue, 5 May 2026 16:56:28 +0200 Subject: [PATCH 1/3] Move the rest of TestingResource methods to a utils-shared helper class (1/2) Closes: #48708 Signed-off-by: Simon Vacek --- .../providers/runonserver/RunOnServer.java | 2 +- .../util/runonserver/RunHelpers.java | 117 ++++++++++++- .../rest/TestingResourceProvider.java | 159 ------------------ .../client/KeycloakTestingClient.java | 3 +- .../client/resources/TestingResource.java | 97 ----------- .../testsuite/AbstractKeycloakTest.java | 9 +- .../KcOidcBrokerTransientSessionsTest.java | 4 +- .../policies/AbstractClientPoliciesTest.java | 5 +- .../federation/storage/ClientStorageTest.java | 4 +- .../testsuite/forms/BruteForceTest.java | 9 +- .../keycloak/testsuite/forms/LoginTest.java | 51 +++++- .../AbstractClientAuthSignedJWTTest.java | 5 +- .../testsuite/oauth/AccessTokenTest.java | 2 +- .../oauth/PreAuthorizedGrantTest.java | 58 ++++++- .../oauth/RPInitiatedLogoutTest.java | 12 +- .../testsuite/oauth/ServiceAccountTest.java | 3 +- .../oauth/TokenIntrospectionTest.java | 3 +- .../StandardTokenExchangeV2Test.java | 9 +- .../oidc/AbstractWellKnownProviderTest.java | 3 +- .../oidc/LightWeightAccessTokenTest.java | 8 +- .../keycloak/testsuite/oidc/UserInfoTest.java | 4 +- .../providers/ProvidersOverrideTest.java | 20 ++- 22 files changed, 282 insertions(+), 305 deletions(-) diff --git a/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/RunOnServer.java b/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/RunOnServer.java index 3a737d0ba50e..ceab31ad0bfd 100644 --- a/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/RunOnServer.java +++ b/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/RunOnServer.java @@ -11,6 +11,6 @@ */ public interface RunOnServer extends Serializable { - void run(KeycloakSession session) throws IOException, VerificationException; + void run(KeycloakSession session) throws IOException, VerificationException, ClassNotFoundException; } diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/runonserver/RunHelpers.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/runonserver/RunHelpers.java index 58d50c31cd03..85337da45405 100644 --- a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/runonserver/RunHelpers.java +++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/runonserver/RunHelpers.java @@ -5,13 +5,22 @@ import jakarta.ws.rs.NotFoundException; +import org.keycloak.Config; import org.keycloak.credential.CredentialModel; +import org.keycloak.events.EventListenerProvider; +import org.keycloak.events.EventType; +import org.keycloak.events.email.EmailEventListenerProviderFactory; import org.keycloak.models.KeycloakSession; import org.keycloak.models.RealmModel; import org.keycloak.models.RealmProvider; import org.keycloak.models.UserModel; import org.keycloak.models.UserSessionModel; +import org.keycloak.models.session.UserSessionPersisterProvider; import org.keycloak.models.utils.ModelToRepresentation; +import org.keycloak.protocol.oidc.encode.AccessTokenContext; +import org.keycloak.protocol.oidc.encode.TokenContextEncoderProvider; +import org.keycloak.provider.Provider; +import org.keycloak.provider.ProviderFactory; import org.keycloak.representations.idm.ComponentRepresentation; import org.keycloak.representations.idm.CredentialRepresentation; import org.keycloak.representations.idm.RealmRepresentation; @@ -98,7 +107,113 @@ public static RunOnServer removeUserSessions(String realmName) { }; } - private static RealmModel getRealmByName(KeycloakSession session, String realmName) { + public static FetchOnServerWrapper getClientSessionsCountInUserSession(String realmName, String sessionId) { + return new FetchOnServerWrapper<>() { + @Override + public FetchOnServer getRunOnServer() { + return session -> { + RealmModel realm = getRealmByName(session, realmName); + + UserSessionModel sessionModel = session.sessions().getUserSession(realm, sessionId); + if (sessionModel == null) { + throw new NotFoundException("Session not found"); + } + + // TODO: Might need optimization to prevent loading client sessions from cache + return sessionModel.getAuthenticatedClientSessions().size(); + }; + } + + @Override + public Class getResultClass() { + return Integer.class; + } + }; + } + + public static RunOnServer removeExpired(String realmName) { + return session -> { + RealmModel realm = getRealmByName(session, realmName); + + session.getProvider(UserSessionPersisterProvider.class).removeExpired(realm); + session.realms().removeExpiredClientInitialAccess(); + }; + } + + /** + * Adds the following types to the email event listener included list. + * @param events The events to be included + */ + public static RunOnServer addEventsToEmailEventListenerProvider(List events) { + return session -> { + if (events != null && !events.isEmpty()) { + EmailEventListenerProviderFactory prov = (EmailEventListenerProviderFactory) session.getKeycloakSessionFactory() + .getProviderFactory(EventListenerProvider.class, EmailEventListenerProviderFactory.ID); + prov.addIncludedEvents(events.toArray(EventType[]::new)); + } + }; + } + + /** + * Removes the following types from the email event listener included list. + * @param events The events to be removed + */ + public static RunOnServer removeEventsToEmailEventListenerProvider(List events) { + return session -> { + if (events != null && !events.isEmpty()) { + EmailEventListenerProviderFactory prov = (EmailEventListenerProviderFactory) session.getKeycloakSessionFactory() + .getProviderFactory(EventListenerProvider.class, EmailEventListenerProviderFactory.ID); + prov.removeIncludedEvents(events.toArray(EventType[]::new)); + } + }; + } + + public static FetchOnServerWrapper getTokenContext(String tokenId) { + return new FetchOnServerWrapper<>() { + @Override + public FetchOnServer getRunOnServer() { + return session -> session.getProvider(TokenContextEncoderProvider.class).getTokenContextFromTokenId(tokenId); + } + + @Override + public Class getResultClass() { + return AccessTokenContext.class; + } + }; + } + + /** + * If property-value is null, the system property will be unset (removed) on the server + */ + public static RunOnServer setSystemPropertyOnServer(String propertyName, String propertyValue) { + return session -> { + if (propertyValue == null) { + System.getProperties().remove(propertyName); + } else { + System.setProperty(propertyName, propertyValue); + } + }; + } + + /** + * Re-initialize specified provider factory with system properties scope. This will allow to change providerConfig in runtime with {@link #setSystemPropertyOnServer} + *

+ * This works just for the provider factories, which can be re-initialized without any side-effects (EG. some functionality already dependent + * on the previously initialized properties, which cannot be easily changed in runtime) + * + * @param providerType fully qualified class name of provider (subclass of org.keycloak.provider.Provider) + * @param providerId provider Id + * @param systemPropertiesPrefix prefix to be used for system properties + */ + public static RunOnServer reinitializeProviderFactoryWithSystemPropertiesScope(String providerType, String providerId, String systemPropertiesPrefix) { + return session -> { + Class providerClass = (Class) Class.forName(providerType); + ProviderFactory factory = session.getKeycloakSessionFactory().getProviderFactory(providerClass, providerId); + factory.init(new Config.SystemPropertiesScope(systemPropertiesPrefix)); + }; + } + + public static RealmModel getRealmByName(KeycloakSession session, String realmName) { RealmProvider realmProvider = session.getProvider(RealmProvider.class); RealmModel realm = realmProvider.getRealmByName(realmName); if (realm == null) { diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/rest/TestingResourceProvider.java b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/rest/TestingResourceProvider.java index 73dd709a642a..0ba63f52900e 100644 --- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/rest/TestingResourceProvider.java +++ b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/rest/TestingResourceProvider.java @@ -26,7 +26,6 @@ import java.util.Collection; import java.util.Collections; import java.util.HashMap; -import java.util.List; import java.util.Map; import java.util.Properties; import java.util.Set; @@ -46,7 +45,6 @@ import jakarta.ws.rs.core.CacheControl; import jakarta.ws.rs.core.Response; -import org.keycloak.Config; import org.keycloak.common.Profile; import org.keycloak.common.Profile.Feature; import org.keycloak.common.enums.HostnameVerificationPolicy; @@ -54,10 +52,7 @@ import org.keycloak.common.util.HtmlUtils; import org.keycloak.component.ComponentModel; import org.keycloak.events.Event; -import org.keycloak.events.EventListenerProvider; -import org.keycloak.events.EventType; import org.keycloak.events.admin.AdminEvent; -import org.keycloak.events.email.EmailEventListenerProviderFactory; import org.keycloak.http.HttpRequest; import org.keycloak.models.AuthenticationFlowModel; import org.keycloak.models.ClientModel; @@ -68,27 +63,12 @@ import org.keycloak.models.UserCredentialModel; import org.keycloak.models.UserModel; import org.keycloak.models.UserProvider; -import org.keycloak.models.UserSessionModel; -import org.keycloak.models.session.UserSessionPersisterProvider; import org.keycloak.models.utils.ModelToRepresentation; -import org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerWellKnownProvider; -import org.keycloak.protocol.oid4vc.issuance.credentialoffer.CredentialOfferState; -import org.keycloak.protocol.oid4vc.issuance.credentialoffer.CredentialOfferStorage; -import org.keycloak.protocol.oid4vc.issuance.credentialoffer.preauth.JwtPreAuthCodeHandler; -import org.keycloak.protocol.oid4vc.model.CredentialsOffer; -import org.keycloak.protocol.oid4vc.model.OID4VCAuthorizationDetail; -import org.keycloak.protocol.oid4vc.model.PreAuthCodeCtx; -import org.keycloak.protocol.oidc.encode.AccessTokenContext; -import org.keycloak.protocol.oidc.encode.TokenContextEncoderProvider; -import org.keycloak.provider.Provider; -import org.keycloak.provider.ProviderFactory; import org.keycloak.representations.idm.AdminEventRepresentation; import org.keycloak.representations.idm.AuthenticationFlowRepresentation; import org.keycloak.representations.idm.EventRepresentation; import org.keycloak.representations.idm.UserRepresentation; -import org.keycloak.services.managers.AuthenticationSessionManager; import org.keycloak.services.resource.RealmResourceProvider; -import org.keycloak.sessions.RootAuthenticationSessionModel; import org.keycloak.storage.UserStorageProvider; import org.keycloak.testframework.remote.providers.runonserver.FetchOnServer; import org.keycloak.testframework.remote.providers.runonserver.RunOnServer; @@ -115,7 +95,6 @@ import static java.util.Objects.requireNonNull; -import static org.keycloak.OID4VCConstants.OPENID_CREDENTIAL; /** * @author Stian Thorgersen @@ -141,18 +120,6 @@ public TestingResourceProvider(KeycloakSession session, TestingResourceProviderF this.request = session.getContext().getHttpRequest(); } - @POST - @Path("/remove-expired") - @Produces(MediaType.APPLICATION_JSON) - public Response removeExpired(@QueryParam("realm") final String name) { - RealmModel realm = getRealmByName(name); - - session.getProvider(UserSessionPersisterProvider.class).removeExpired(realm); - session.realms().removeExpiredClientInitialAccess(); - - return Response.noContent().build(); - } - @POST @Path("/set-testing-infinispan-time-service") @Produces(MediaType.APPLICATION_JSON) @@ -169,22 +136,6 @@ public Response revertTestingInfinispanTimeService() { return Response.noContent().build(); } - @GET - @Path("/get-client-sessions-count") - @Produces(MediaType.APPLICATION_JSON) - public Integer getClientSessionsCountInUserSession(@QueryParam("realm") final String name, @QueryParam("session") final String sessionId) { - - RealmModel realm = getRealmByName(name); - - UserSessionModel sessionModel = session.sessions().getUserSession(realm, sessionId); - if (sessionModel == null) { - throw new NotFoundException("Session not found"); - } - - // TODO: Might need optimization to prevent loading client sessions from cache - return sessionModel.getAuthenticatedClientSessions().size(); - } - @POST @Path("/poll-event-queue") @Produces(MediaType.APPLICATION_JSON) @@ -526,29 +477,6 @@ private Set updateFeature(String featureKey, boolean shouldEnab return Profile.getInstance().getDisabledFeatures(); } - - @GET - @Path("/set-system-property") - @Consumes(MediaType.TEXT_HTML_UTF_8) - @NoCache - public void setSystemPropertyOnServer(@QueryParam("property-name") String propertyName, @QueryParam("property-value") String propertyValue) { - if (propertyValue == null) { - System.getProperties().remove(propertyName); - } else { - System.setProperty(propertyName, propertyValue); - } - } - - @GET - @Path("/reinitialize-provider-factory-with-system-properties-scope") - @Consumes(MediaType.TEXT_HTML_UTF_8) - public void reinitializeProviderFactoryWithSystemPropertiesScope(@QueryParam("provider-type") String providerType, @QueryParam("provider-id") String providerId, - @QueryParam("system-properties-prefix") String systemPropertiesPrefix) throws Exception { - Class providerClass = (Class) Class.forName(providerType); - ProviderFactory factory = session.getKeycloakSessionFactory().getProviderFactory(providerClass, providerId); - factory.init(new Config.SystemPropertiesScope(systemPropertiesPrefix)); - } - /** * This will send POST request to specified URL with specified form parameters. It's not easily possible to "trick" web driver to send POST * request with custom parameters, which are not directly available in the form. @@ -606,19 +534,6 @@ public Response simulatePostRequest(@QueryParam("postRequestUrl") String postReq } - @GET - @Path("/get-provider-implementation-class") - @Produces(MediaType.APPLICATION_JSON) - public String getProviderClassName(@QueryParam("providerClass") String providerClass, @QueryParam("providerId") String providerId) { - try { - Class providerClazz = (Class) Class.forName(providerClass); - Provider provider = (providerId == null) ? session.getProvider(providerClazz) : session.getProvider(providerClazz, providerId); - return provider.getClass().getName(); - } catch (ClassNotFoundException cnfe) { - throw new RuntimeException("Cannot find provider class: " + providerClass, cnfe); - } - } - private RealmModel getRealmByName(String realmName) { RealmProvider realmProvider = session.getProvider(RealmProvider.class); RealmModel realm = realmProvider.getRealmByName(realmName); @@ -662,21 +577,6 @@ public void reenableTruststoreSpi() { factory.setProvider(this.factory.truststoreProvider); } - @GET - @Path("/get-authentication-session-tabs-count") - @NoCache - public Integer getAuthenticationSessionTabsCount(@QueryParam("realm") String realmName, @QueryParam("authSessionId") String authSessionId) { - RealmModel realm = getRealmByName(realmName); - session.getContext().setRealm(realm); - String decodedAuthSessionId = new AuthenticationSessionManager(session).decodeBase64AndValidateSignature(authSessionId); - RootAuthenticationSessionModel rootAuthSession = session.authenticationSessions().getRootAuthenticationSession(realm, decodedAuthSessionId); - if (rootAuthSession == null) { - return 0; - } - - return rootAuthSession.getAuthenticationSessions().size(); - } - @GET @Path("/no-cache-annotated-endpoint") @Produces(MediaType.APPLICATION_JSON) @@ -696,63 +596,4 @@ public Response getNoCacheAnnotatedEndpointResponse(@QueryParam("programmatic_ma public Response getBlankPage() { return Response.ok("").build(); } - - @GET - @Path("/pre-authorized-code") - @NoCache - public String getPreAuthorizedCode(@QueryParam("realm") final String realmName, @QueryParam("userSessionId") final String userSessionId, @QueryParam("clientId") final String clientId, @QueryParam("expiration") final int expireAt) { - RealmModel realm = getRealmByName(realmName); - UserSessionModel userSession = session.sessions().getUserSession(realm, userSessionId); - - String credConfigId = "oid4vc_natural_person_sd"; - - CredentialsOffer credOffer = new CredentialsOffer() - .setCredentialIssuer(OID4VCIssuerWellKnownProvider.getIssuer(session.getContext())) - .setCredentialConfigurationIds(List.of(credConfigId)); - - String targetUserId = userSession.getUser().getId(); - CredentialOfferState offerState = new CredentialOfferState(credOffer, clientId, targetUserId, expireAt, credOfferId -> { - OID4VCAuthorizationDetail authDetail = new OID4VCAuthorizationDetail(); - authDetail.setType(OPENID_CREDENTIAL); - authDetail.setCredentialConfigurationId(credConfigId); - authDetail.setCredentialsOfferId(credOfferId); - return List.of(authDetail); - }); - - var offerStorage = session.getProvider(CredentialOfferStorage.class); - offerStorage.putOfferState( offerState); - - PreAuthCodeCtx preAuthCodeCtx = new PreAuthCodeCtx(offerState); - return new JwtPreAuthCodeHandler(session).createPreAuthCode(preAuthCodeCtx); - } - - @POST - @Path("/email-event-listener-provide/add-events") - @Consumes(MediaType.APPLICATION_JSON) - public void addEventsToEmailEventListenerProvider(List events) { - if (events != null && !events.isEmpty()) { - EmailEventListenerProviderFactory prov = (EmailEventListenerProviderFactory) session.getKeycloakSessionFactory() - .getProviderFactory(EventListenerProvider.class, EmailEventListenerProviderFactory.ID); - prov.addIncludedEvents(events.toArray(EventType[]::new)); - } - } - - @POST - @Path("/email-event-listener-provide/remove-events") - @Consumes(MediaType.APPLICATION_JSON) - public void removeEventsToEmailEventListenerProvider(List events) { - if (events != null && !events.isEmpty()) { - EmailEventListenerProviderFactory prov = (EmailEventListenerProviderFactory) session.getKeycloakSessionFactory() - .getProviderFactory(EventListenerProvider.class, EmailEventListenerProviderFactory.ID); - prov.removeIncludedEvents(events.toArray(EventType[]::new)); - } - } - - @GET - @Path("/token-context") - @Produces(MediaType.APPLICATION_JSON) - public AccessTokenContext getTokenContext(@QueryParam("tokenId") String tokenId) { - return session.getProvider(TokenContextEncoderProvider.class).getTokenContextFromTokenId(tokenId); - } - } diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/KeycloakTestingClient.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/KeycloakTestingClient.java index bd0f46767a2f..87766a1b6bd3 100755 --- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/KeycloakTestingClient.java +++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/KeycloakTestingClient.java @@ -17,6 +17,7 @@ package org.keycloak.testsuite.client; +import java.io.IOException; import java.util.Set; import jakarta.ws.rs.core.Response; @@ -174,7 +175,7 @@ public T fetch(FetchOnServer function, Class clazz) throws RunOnServerExc try { String s = fetchString(function); return s==null ? null : JsonSerialization.readValue(s, clazz); - } catch (Exception e) { + } catch (IOException e) { throw new RuntimeException(e); } } diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/resources/TestingResource.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/resources/TestingResource.java index a729b047efb5..ff1323349ca0 100644 --- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/resources/TestingResource.java +++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/resources/TestingResource.java @@ -17,7 +17,6 @@ package org.keycloak.testsuite.client.resources; -import java.util.List; import java.util.Map; import java.util.Set; @@ -33,8 +32,6 @@ import org.keycloak.common.Profile; import org.keycloak.common.enums.HostnameVerificationPolicy; -import org.keycloak.events.EventType; -import org.keycloak.protocol.oidc.encode.AccessTokenContext; import org.keycloak.representations.idm.AdminEventRepresentation; import org.keycloak.representations.idm.AuthenticationFlowRepresentation; import org.keycloak.representations.idm.EventRepresentation; @@ -74,11 +71,6 @@ public interface TestingResource { @Produces(MediaType.APPLICATION_JSON) void clearAdminEventQueue(); - @POST - @Path("/remove-expired") - @Produces(MediaType.APPLICATION_JSON) - void removeExpired(@QueryParam("realm") final String realm); - /** * Will set Inifispan's {@link TimeService} that is aware of Keycloak time shifts to the infinispan {@code CacheManager} before the test. * This will allow infinispan expiration to be aware of Keycloak {@link org.keycloak.common.util.Time#setOffset} @@ -93,11 +85,6 @@ public interface TestingResource { @Produces(MediaType.APPLICATION_JSON) void revertTestingInfinispanTimeService(); - @GET - @Path("/get-client-sessions-count") - @Produces(MediaType.APPLICATION_JSON) - Integer getClientSessionsCountInUserSession(@QueryParam("realm") final String realmName, @QueryParam("session") final String sessionId); - @Path("/cache/{cache}") TestingCacheResource cache(@PathParam("cache") String cacheName); @@ -203,32 +190,6 @@ String runModelTestOnServer(@QueryParam("testClassName") String testClassName, @Consumes(MediaType.APPLICATION_JSON) void resetFeature(@PathParam("feature") String feature); - /** - * If property-value is null, the system property will be unset (removed) on the server - */ - @GET - @Path("/set-system-property") - @Consumes(MediaType.TEXT_HTML_UTF_8) - void setSystemPropertyOnServer(@QueryParam("property-name") String propertyName, @QueryParam("property-value") String propertyValue); - - /** - * Re-initialize specified provider factory with system properties scope. This will allow to change providerConfig in runtime with {@link #setSystemPropertyOnServer} - *

- * This works just for the provider factories, which can be re-initialized without any side-effects (EG. some functionality already dependent - * on the previously initialized properties, which cannot be easily changed in runtime) - * - * @param providerType fully qualified class name of provider (subclass of org.keycloak.provider.Provider) - * @param providerId provider Id - * @param systemPropertiesPrefix prefix to be used for system properties - */ - @GET - @Path("/reinitialize-provider-factory-with-system-properties-scope") - @Consumes(MediaType.TEXT_HTML_UTF_8) - @NoCache - void reinitializeProviderFactoryWithSystemPropertiesScope(@QueryParam("provider-type") String providerType, @QueryParam("provider-id") String providerId, - @QueryParam("system-properties-prefix") String systemPropertiesPrefix); - - /** * This method is here just to have all endpoints from TestingResourceProvider available here. *

@@ -240,16 +201,6 @@ void reinitializeProviderFactoryWithSystemPropertiesScope(@QueryParam("provider- Response simulatePostRequest(@QueryParam("postRequestUrl") String postRequestUrl, @QueryParam("encodedFormParameters") String encodedFormParameters); - /** - * @param providerClass Full name of class such as for example "org.keycloak.authentication.Authenticator" - * @param providerId providerId referenced in particular provider factory. Can be null (in this case we're returning default provider for particular providerClass) - * @return fullname of provider implementation class - */ - @GET - @Path("/get-provider-implementation-class") - @Produces(MediaType.APPLICATION_JSON) - String getProviderClassName(@QueryParam("providerClass") String providerClass, @QueryParam("providerId") String providerId); - /** * Temporarily disables truststore SPI from the file. Useful for example to test some error scenarios, which require truststore SPI to be unset (or set incorrectly) */ @@ -276,55 +227,7 @@ Response simulatePostRequest(@QueryParam("postRequestUrl") String postRequestUrl @NoCache void reenableTruststoreSpi(); - /** - * Get count of tabs (child authentication sessions) for given "root authentication session" - * - * @param realm realm name (not ID) - * @param authSessionId ID of authentication session - * @return count of tabs. Return 0 if authentication session of given ID does not exists (or if it exists, but without any authenticationSessions attached, which should not happen with normal usage) - */ - @GET - @Path("/get-authentication-session-tabs-count") - @NoCache - Integer getAuthenticationSessionTabsCount(@QueryParam("realm") String realm, @QueryParam("authSessionId") String authSessionId); - @GET @Path("/no-cache-annotated-endpoint") Response getNoCacheAnnotatedEndpointResponse(@QueryParam("programmatic_max_age_value") Long programmaticMaxAgeValue); - - /** - * Return a pre-authorized code for the current session. - * - * @param realmName name of the realm to be used - * @param userSessionId id of the user session to get a code for - * @param clientId id of the client to be used - * @param expiration expiration time of the code - * @return the code - */ - @GET - @Path("/pre-authorized-code") - String getPreAuthorizedCode(@QueryParam("realm") final String realmName, @QueryParam("userSessionId") final String userSessionId, @QueryParam("clientId") final String clientId, @QueryParam("expiration") final int expiration); - - /** - * Adds the following types to the email event listener included list. - * @param events The events to be included - */ - @POST - @Path("/email-event-listener-provide/add-events") - @Consumes(MediaType.APPLICATION_JSON) - public void addEventsToEmailEventListenerProvider(List events); - - /** - * Removes the following types from the email event listener included list. - * @param events The events to be removed - */ - @POST - @Path("/email-event-listener-provide/remove-events") - @Consumes(MediaType.APPLICATION_JSON) - public void removeEventsToEmailEventListenerProvider(List events); - - @GET - @Path("/token-context") - @Produces(MediaType.APPLICATION_JSON) - AccessTokenContext getTokenContext(@QueryParam("tokenId") String tokenId); } diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractKeycloakTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractKeycloakTest.java index 1c50d9ad2737..eafd414c38ef 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractKeycloakTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractKeycloakTest.java @@ -100,6 +100,7 @@ import static org.keycloak.testsuite.admin.Users.setPasswordFor; import static org.keycloak.testsuite.auth.page.AuthRealm.MASTER; +import static org.keycloak.testsuite.auth.page.AuthRealm.TEST; import static org.keycloak.testsuite.util.ServerURLs.AUTH_SERVER_HOST; import static org.keycloak.testsuite.util.ServerURLs.AUTH_SERVER_PORT; import static org.keycloak.testsuite.util.ServerURLs.AUTH_SERVER_SCHEME; @@ -138,7 +139,8 @@ public abstract class AbstractKeycloakTest { protected KeycloakTestingClient testingClient; - protected KeycloakTestingClient.Server runOnServer; + protected KeycloakTestingClient.Server runOnServerMaster; + protected KeycloakTestingClient.Server runOnServerTest; protected TimeOffSet timeOffSet = new TimeOffSet(this); @@ -187,7 +189,8 @@ public void beforeAbstractKeycloakTest() throws Exception { } getTestingClient(); - runOnServer = testingClient.server(); + runOnServerMaster = testingClient.server(); + runOnServerTest = testingClient.server(TEST); setDefaultPageUriParameters(); @@ -251,7 +254,7 @@ public void afterAbstractKeycloakTest() throws Exception { } else { log.info("calling all TestCleanup"); // Remove all sessions - testContext.getTestRealmReps().stream().forEach((r)->runOnServer.run(RunHelpers.removeUserSessions(r.getRealm()))); + testContext.getTestRealmReps().stream().forEach((r)-> runOnServerMaster.run(RunHelpers.removeUserSessions(r.getRealm()))); // Cleanup objects for (TestCleanup cleanup : testContext.getCleanups().values()) { diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerTransientSessionsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerTransientSessionsTest.java index 04f2bbb04f7d..bea596a949bf 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerTransientSessionsTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerTransientSessionsTest.java @@ -659,9 +659,9 @@ private String testRefreshWithOfflineToken(AccessToken oldToken, RefreshToken of assertTrue(offlineToken.isActive()); // Assert userSession expired - testingClient.testing().removeExpired(bc.consumerRealmName()); + runOnServerMaster.run(RunHelpers.removeExpired(bc.consumerRealmName())); try { - runOnServer.run(RunHelpers.removeUserSession(bc.consumerRealmName(), sessionId)); + runOnServerMaster.run(RunHelpers.removeUserSession(bc.consumerRealmName(), sessionId)); } catch (RunOnServerException nfe) { if (!(nfe.getCause() instanceof NotFoundException)) { throw nfe; diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/AbstractClientPoliciesTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/AbstractClientPoliciesTest.java index 9c39aa23b9f0..9d5a30b0ea4f 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/AbstractClientPoliciesTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/AbstractClientPoliciesTest.java @@ -148,6 +148,7 @@ import org.keycloak.testsuite.util.oauth.IntrospectionResponse; import org.keycloak.testsuite.util.oauth.LogoutResponse; import org.keycloak.testsuite.util.oauth.PkceGenerator; +import org.keycloak.testsuite.util.runonserver.RunHelpers; import org.keycloak.util.JsonSerialization; import org.keycloak.util.TokenUtil; @@ -497,8 +498,8 @@ private String getKeyAlgorithmFromJwaAlgorithm(String jwaAlgorithm) { // Signed JWT for client authentication utility protected void allowMultipleAudiencesForClientJWTOnServer(boolean allowMultipleAudiences) { - getTestingClient().testing().setSystemPropertyOnServer("oidc." + OIDCLoginProtocolFactory.CONFIG_OIDC_ALLOW_MULTIPLE_AUDIENCES_FOR_JWT_CLIENT_AUTHENTICATION, String.valueOf(allowMultipleAudiences)); - getTestingClient().testing().reinitializeProviderFactoryWithSystemPropertiesScope(LoginProtocol.class.getName(), OIDCLoginProtocol.LOGIN_PROTOCOL, "oidc."); + runOnServerMaster.run(RunHelpers.setSystemPropertyOnServer("oidc." + OIDCLoginProtocolFactory.CONFIG_OIDC_ALLOW_MULTIPLE_AUDIENCES_FOR_JWT_CLIENT_AUTHENTICATION, String.valueOf(allowMultipleAudiences))); + runOnServerMaster.run(RunHelpers.reinitializeProviderFactoryWithSystemPropertiesScope(LoginProtocol.class.getName(), OIDCLoginProtocol.LOGIN_PROTOCOL, "oidc.")); } protected String createSignedRequestToken(String clientId, PrivateKey privateKey, PublicKey publicKey, String algorithm) { diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/ClientStorageTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/ClientStorageTest.java index 9153c44d4e99..7e407437e51d 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/ClientStorageTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/ClientStorageTest.java @@ -502,9 +502,9 @@ private String testRefreshWithOfflineToken(AccessToken oldToken, RefreshToken of Assertions.assertTrue(offlineToken.isActive()); // Assert userSession expired - testingClient.testing().removeExpired("test"); + runOnServerMaster.run(RunHelpers.removeExpired("test")); try { - runOnServer.run(RunHelpers.removeUserSession("test", sessionId)); + runOnServerMaster.run(RunHelpers.removeUserSession("test", sessionId)); } catch (RunOnServerException nfe) { if (!(nfe.getCause() instanceof NotFoundException)) { throw nfe; diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/BruteForceTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/BruteForceTest.java index 3969356690cb..e4697b7a1dc5 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/BruteForceTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/BruteForceTest.java @@ -60,6 +60,7 @@ import org.keycloak.testsuite.util.RealmRepUtil; import org.keycloak.testsuite.util.WaitUtils; import org.keycloak.testsuite.util.oauth.AccessTokenResponse; +import org.keycloak.testsuite.util.runonserver.RunHelpers; import org.hamcrest.MatcherAssert; import org.jboss.arquillian.graphene.page.Page; @@ -820,7 +821,7 @@ private void checkEmailPresent(String subject) { @Test public void testPermanentLockout() throws Exception { - testingClient.testing().addEventsToEmailEventListenerProvider(Collections.singletonList(EventType.USER_DISABLED_BY_PERMANENT_LOCKOUT)); + runOnServerMaster.run(RunHelpers.addEventsToEmailEventListenerProvider(Collections.singletonList(EventType.USER_DISABLED_BY_PERMANENT_LOCKOUT))); try (RealmAttributeUpdater updater = new RealmAttributeUpdater(managedRealm.admin()).setPermanentLockout(true) .setQuickLoginCheckMilliSeconds(0L) .addEventsListener(EmailEventListenerProviderFactory.ID).update()) { @@ -846,7 +847,7 @@ public void testPermanentLockout() throws Exception { updateUser(user); assertUserDisabledReason(null); } finally { - testingClient.testing().removeEventsToEmailEventListenerProvider(Collections.singletonList(EventType.USER_DISABLED_BY_PERMANENT_LOCKOUT)); + runOnServerMaster.run(RunHelpers.removeEventsToEmailEventListenerProvider(Collections.singletonList(EventType.USER_DISABLED_BY_PERMANENT_LOCKOUT))); UserRepresentation user = managedRealm.admin().users().search("test-user@localhost", 0, 1).get(0); user.setEnabled(true); updateUser(user); @@ -896,7 +897,7 @@ public void testPermanentLockoutWithTempLockoutParamsSet() @Test public void testTemporaryLockout() throws Exception { - testingClient.testing().addEventsToEmailEventListenerProvider(Collections.singletonList(EventType.USER_DISABLED_BY_TEMPORARY_LOCKOUT)); + runOnServerMaster.run(RunHelpers.addEventsToEmailEventListenerProvider(Collections.singletonList(EventType.USER_DISABLED_BY_TEMPORARY_LOCKOUT))); try (RealmAttributeUpdater updater = new RealmAttributeUpdater(managedRealm.admin()) .addEventsListener(EmailEventListenerProviderFactory.ID).update()) { loginInvalidPassword("test-user@localhost"); @@ -906,7 +907,7 @@ public void testTemporaryLockout() throws Exception { checkEmailPresent("User disabled by temporary lockout"); } finally { - testingClient.testing().removeEventsToEmailEventListenerProvider(Collections.singletonList(EventType.USER_DISABLED_BY_TEMPORARY_LOCKOUT)); + runOnServerMaster.run(RunHelpers.removeEventsToEmailEventListenerProvider(Collections.singletonList(EventType.USER_DISABLED_BY_TEMPORARY_LOCKOUT))); } } diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LoginTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LoginTest.java index 5db25c0cba03..72fe3e8605ab 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LoginTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LoginTest.java @@ -42,6 +42,7 @@ import org.keycloak.models.BrowserSecurityHeaders; import org.keycloak.models.ClientScopeModel; import org.keycloak.models.Constants; +import org.keycloak.models.RealmModel; import org.keycloak.models.UserModel.RequiredAction; import org.keycloak.models.credential.PasswordCredentialModel; import org.keycloak.models.utils.SessionTimeoutHelper; @@ -51,10 +52,14 @@ import org.keycloak.representations.idm.EventRepresentation; import org.keycloak.representations.idm.RealmRepresentation; import org.keycloak.representations.idm.UserRepresentation; +import org.keycloak.services.managers.AuthenticationSessionManager; +import org.keycloak.sessions.RootAuthenticationSessionModel; import org.keycloak.testframework.events.EventAssertion; import org.keycloak.testframework.events.EventMatchers; import org.keycloak.testframework.realm.RealmBuilder; import org.keycloak.testframework.realm.UserBuilder; +import org.keycloak.testframework.remote.providers.runonserver.FetchOnServer; +import org.keycloak.testframework.remote.providers.runonserver.FetchOnServerWrapper; import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest; import org.keycloak.testsuite.AssertEvents; import org.keycloak.testsuite.ProfileAssume; @@ -91,6 +96,7 @@ import static org.keycloak.testsuite.admin.AdminApiUtil.findClientByClientId; import static org.keycloak.testsuite.util.ServerURLs.getAuthServerContextRoot; import static org.keycloak.testsuite.util.oauth.OAuthClient.SERVER_ROOT; +import static org.keycloak.testsuite.util.runonserver.RunHelpers.getRealmByName; import static org.hamcrest.MatcherAssert.assertThat; import static org.hamcrest.Matchers.containsString; @@ -658,7 +664,7 @@ public void loginWithRememberMe() { String sessionId = loginEvent.getSessionId(); // Expire session - runOnServer.run(RunHelpers.removeUserSession("test", sessionId)); + runOnServerMaster.run(RunHelpers.removeUserSession("test", sessionId)); // Assert rememberMe checked and username/email prefilled oauth.openLoginForm(); @@ -716,7 +722,7 @@ public void loginAgainWithoutRememberMe() { String sessionId = loginEvent.getSessionId(); // Expire session - runOnServer.run(RunHelpers.removeUserSession("test", sessionId)); + runOnServerMaster.run(RunHelpers.removeUserSession("test", sessionId)); // Assert rememberMe checked and username/email prefilled oauth.openLoginForm(); @@ -731,7 +737,7 @@ public void loginAgainWithoutRememberMe() { loginEvent = EventAssertion.expectLoginSuccess(events.poll()).userId(userId) .details(Details.USERNAME, "login-test").getEvent(); sessionId = loginEvent.getSessionId(); - runOnServer.run(RunHelpers.removeUserSession("test", sessionId)); + runOnServerMaster.run(RunHelpers.removeUserSession("test", sessionId)); // Assert rememberMe not checked nor username/email prefilled oauth.openLoginForm(); @@ -761,7 +767,7 @@ public void loginWithEmailUserAndRememberMe() { String sessionId = loginEvent.getSessionId(); // Expire session - runOnServer.run(RunHelpers.removeUserSession("test", sessionId)); + runOnServerMaster.run(RunHelpers.removeUserSession("test", sessionId)); // Assert rememberMe checked and username/email prefilled oauth.openLoginForm(); @@ -976,17 +982,17 @@ public void testAuthenticationSessionExpiresEarlyAfterAuthentication() throws Ex // Assert authenticationSession in cache with 2 tabs String authSessionId = driver.manage().getCookieNamed(CookieType.AUTH_SESSION_ID.getName()).getValue(); - Assertions.assertEquals((Integer) 2, getTestingClient().testing().getAuthenticationSessionTabsCount("test", authSessionId)); + Assertions.assertEquals((Integer) 2, runOnServerMaster.fetch(getAuthenticationSessionTabsCount("test", authSessionId))); loginPage.login("test-user@localhost", getPassword("test-user@localhost")); appPage.assertCurrent(); // authentication session should still exists with remaining browser tab - Assertions.assertEquals((Integer) 1, getTestingClient().testing().getAuthenticationSessionTabsCount("test", authSessionId)); + Assertions.assertEquals((Integer) 1, runOnServerMaster.fetch(getAuthenticationSessionTabsCount("test", authSessionId))); // authentication session should be expired after 1 minute timeOffSet.set(300); - Assertions.assertEquals((Integer) 0, getTestingClient().testing().getAuthenticationSessionTabsCount("test", authSessionId)); + Assertions.assertEquals((Integer) 0, runOnServerMaster.fetch(getAuthenticationSessionTabsCount("test", authSessionId))); } @@ -1135,4 +1141,35 @@ public void testAuthSessionIdCookieFormat(){ Assertions.assertNotNull(session.authenticationSessions().getRootAuthenticationSession(session.getContext().getRealm(), authSessionId)); }); } + + /** + * Get count of tabs (child authentication sessions) for given "root authentication session" + * + * @param realmName realm name (not ID) + * @param authSessionId ID of authentication session + * @return count of tabs. Return 0 if authentication session of given ID does not exists (or if it exists, but without any authenticationSessions attached, which should not happen with normal usage) + */ + private static FetchOnServerWrapper getAuthenticationSessionTabsCount(String realmName, String authSessionId) { + return new FetchOnServerWrapper<>() { + @Override + public FetchOnServer getRunOnServer() { + return session ->{ + RealmModel realm = getRealmByName(session, realmName); + session.getContext().setRealm(realm); + String decodedAuthSessionId = new AuthenticationSessionManager(session).decodeBase64AndValidateSignature(authSessionId); + RootAuthenticationSessionModel rootAuthSession = session.authenticationSessions().getRootAuthenticationSession(realm, decodedAuthSessionId); + if (rootAuthSession == null) { + return 0; + } + + return rootAuthSession.getAuthenticationSessions().size(); + }; + } + + @Override + public Class getResultClass() { + return Integer.class; + } + }; + } } diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AbstractClientAuthSignedJWTTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AbstractClientAuthSignedJWTTest.java index 57d12129ec6e..dc787852b15f 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AbstractClientAuthSignedJWTTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AbstractClientAuthSignedJWTTest.java @@ -107,6 +107,7 @@ import org.keycloak.testsuite.util.SignatureSignerUtil; import org.keycloak.testsuite.util.oauth.AccessTokenResponse; import org.keycloak.testsuite.util.oauth.OAuthClient; +import org.keycloak.testsuite.util.runonserver.RunHelpers; import org.keycloak.util.JsonSerialization; import org.keycloak.util.TokenUtil; @@ -168,8 +169,8 @@ public void beforeAbstractKeycloakTest() throws Exception { } protected void allowMultipleAudiencesForClientJWTOnServer(boolean allowMultipleAudiences) { - getTestingClient().testing().setSystemPropertyOnServer("oidc." + OIDCLoginProtocolFactory.CONFIG_OIDC_ALLOW_MULTIPLE_AUDIENCES_FOR_JWT_CLIENT_AUTHENTICATION, String.valueOf(allowMultipleAudiences)); - getTestingClient().testing().reinitializeProviderFactoryWithSystemPropertiesScope(LoginProtocol.class.getName(), OIDCLoginProtocol.LOGIN_PROTOCOL, "oidc."); + runOnServerMaster.run(RunHelpers.setSystemPropertyOnServer("oidc." + OIDCLoginProtocolFactory.CONFIG_OIDC_ALLOW_MULTIPLE_AUDIENCES_FOR_JWT_CLIENT_AUTHENTICATION, String.valueOf(allowMultipleAudiences))); + runOnServerMaster.run(RunHelpers.reinitializeProviderFactoryWithSystemPropertiesScope(LoginProtocol.class.getName(), OIDCLoginProtocol.LOGIN_PROTOCOL, "oidc.")); } @Override diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenTest.java index c91d6990d174..737ce2d5166a 100755 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenTest.java @@ -419,7 +419,7 @@ public void accessTokenUserSessionExpired() { String sessionId = loginEvent.getSessionId(); - runOnServer.run(RunHelpers.removeUserSession("test", sessionId)); + runOnServerMaster.run(RunHelpers.removeUserSession("test", sessionId)); String code = oauth.parseLoginResponse().getCode(); AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code); diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/PreAuthorizedGrantTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/PreAuthorizedGrantTest.java index 2548cc467957..4eed3f5b0ddd 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/PreAuthorizedGrantTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/PreAuthorizedGrantTest.java @@ -26,11 +26,21 @@ import org.keycloak.OAuth2Constants; import org.keycloak.common.Profile; import org.keycloak.common.util.Time; +import org.keycloak.models.RealmModel; +import org.keycloak.models.UserSessionModel; +import org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerWellKnownProvider; +import org.keycloak.protocol.oid4vc.issuance.credentialoffer.CredentialOfferState; +import org.keycloak.protocol.oid4vc.issuance.credentialoffer.CredentialOfferStorage; +import org.keycloak.protocol.oid4vc.issuance.credentialoffer.preauth.JwtPreAuthCodeHandler; +import org.keycloak.protocol.oid4vc.model.CredentialsOffer; +import org.keycloak.protocol.oid4vc.model.OID4VCAuthorizationDetail; +import org.keycloak.protocol.oid4vc.model.PreAuthCodeCtx; import org.keycloak.protocol.oid4vc.model.PreAuthorizedCodeGrant; import org.keycloak.protocol.oidc.OIDCLoginProtocolService; import org.keycloak.representations.idm.RealmRepresentation; import org.keycloak.representations.idm.UserRepresentation; import org.keycloak.testframework.realm.UserBuilder; +import org.keycloak.testframework.remote.providers.runonserver.FetchOnServer; import org.keycloak.testsuite.AbstractTestRealmKeycloakTest; import org.keycloak.testsuite.arquillian.annotation.EnableFeature; import org.keycloak.testsuite.util.oauth.AccessTokenResponse; @@ -46,6 +56,9 @@ import org.junit.Before; import org.junit.Test; +import static org.keycloak.OID4VCConstants.OPENID_CREDENTIAL; +import static org.keycloak.testsuite.util.runonserver.RunHelpers.getRealmByName; + import static org.junit.jupiter.api.Assertions.assertEquals; @EnableFeature(value = Profile.Feature.OID4VC_VCI, skipRestart = true) @@ -62,7 +75,7 @@ public void setup() { @Test public void testPreAuthorizedGrant() throws Exception { String userSessionId = getUserSession(); - String preAuthorizedCode = getTestingClient().testing(TEST_REALM_NAME).getPreAuthorizedCode(TEST_REALM_NAME, userSessionId, "test-app", Time.currentTime() + 30); + String preAuthorizedCode = runOnServerTest.fetchString(getPreAuthorizedCode(TEST_REALM_NAME, userSessionId, "test-app", Time.currentTime() + 30)).replace("\"",""); AccessTokenResponse accessTokenResponse = postCode(preAuthorizedCode); assertEquals(HttpStatus.SC_OK, accessTokenResponse.getStatusCode(), "An access token should have successfully been returned."); @@ -71,7 +84,7 @@ public void testPreAuthorizedGrant() throws Exception { @Test public void testPreAuthorizedGrantExpired() throws Exception { String userSessionId = getUserSession(); - String preAuthorizedCode = getTestingClient().testing(TEST_REALM_NAME).getPreAuthorizedCode(TEST_REALM_NAME, userSessionId, "test-app", Time.currentTime() - 30); + String preAuthorizedCode = runOnServerTest.fetchString(getPreAuthorizedCode(TEST_REALM_NAME, userSessionId, "test-app", Time.currentTime() - 30)); AccessTokenResponse accessTokenResponse = postCode(preAuthorizedCode); assertEquals(HttpStatus.SC_BAD_REQUEST, accessTokenResponse.getStatusCode(), "An expired code should not get an access token."); } @@ -111,8 +124,8 @@ public void testPreAuthorizedGrantRealmDisabled() throws Exception { try { String userSessionId = getUserSession(); - String preAuthorizedCode = getTestingClient().testing() - .getPreAuthorizedCode(TEST_REALM_NAME, userSessionId, "test-app", Time.currentTime() + 30); + String preAuthorizedCode = runOnServerMaster.fetchString( + getPreAuthorizedCode(TEST_REALM_NAME, userSessionId, "test-app", Time.currentTime() + 30)); AccessTokenResponse accessTokenResponse = postCode(preAuthorizedCode); assertEquals(HttpStatus.SC_FORBIDDEN, accessTokenResponse.getStatusCode(), "Pre-authorized grant should be forbidden when verifiable credentials are disabled."); @@ -166,5 +179,40 @@ public void configureTestRealm(RealmRepresentation testRealm) { } } - + /** + * Return a pre-authorized code for the current session. + * + * @param realmName name of the realm to be used + * @param userSessionId id of the user session to get a code for + * @param clientId id of the client to be used + * @param expireAt expiration time of the code + * @return the code + */ + public static FetchOnServer getPreAuthorizedCode(String realmName, String userSessionId, String clientId, int expireAt) { + return session -> { + RealmModel realm = getRealmByName(session, realmName); + UserSessionModel userSession = session.sessions().getUserSession(realm, userSessionId); + + String credConfigId = "oid4vc_natural_person_sd"; + + CredentialsOffer credOffer = new CredentialsOffer() + .setCredentialIssuer(OID4VCIssuerWellKnownProvider.getIssuer(session.getContext())) + .setCredentialConfigurationIds(List.of(credConfigId)); + + String targetUserId = userSession.getUser().getId(); + CredentialOfferState offerState = new CredentialOfferState(credOffer, clientId, targetUserId, expireAt, credOfferId -> { + OID4VCAuthorizationDetail authDetail = new OID4VCAuthorizationDetail(); + authDetail.setType(OPENID_CREDENTIAL); + authDetail.setCredentialConfigurationId(credConfigId); + authDetail.setCredentialsOfferId(credOfferId); + return List.of(authDetail); + }); + + var offerStorage = session.getProvider(CredentialOfferStorage.class); + offerStorage.putOfferState(offerState); + + PreAuthCodeCtx preAuthCodeCtx = new PreAuthCodeCtx(offerState); + return new JwtPreAuthCodeHandler(session).createPreAuthCode(preAuthCodeCtx); + }; + } } diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/RPInitiatedLogoutTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/RPInitiatedLogoutTest.java index 36efeb053de7..12f56b391ffb 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/RPInitiatedLogoutTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/RPInitiatedLogoutTest.java @@ -44,6 +44,7 @@ import org.keycloak.representations.idm.RealmRepresentation; import org.keycloak.testframework.events.EventAssertion; import org.keycloak.testframework.realm.ClientBuilder; +import org.keycloak.testframework.remote.providers.runonserver.RunOnServerException; import org.keycloak.testsuite.AbstractTestRealmKeycloakTest; import org.keycloak.testsuite.AssertEvents; import org.keycloak.testsuite.admin.AdminApiUtil; @@ -305,7 +306,7 @@ public void logoutWithRememberMe() throws IOException { String sessionId = EventAssertion.expectLoginSuccess(events.poll()).getEvent().getSessionId(); // Expire session - runOnServer.run(RunHelpers.removeUserSession("test", sessionId)); + runOnServerMaster.run(RunHelpers.removeUserSession("test", sessionId)); // Assert rememberMe checked and username/email prefilled oauth.openLoginForm(); @@ -1117,10 +1118,13 @@ private AccessTokenResponse loginUser(boolean consentRequired) { private boolean isSessionActive(String sessionId) { try { - testingClient.testing().getClientSessionsCountInUserSession("test", sessionId); + runOnServerMaster.fetch(RunHelpers.getClientSessionsCountInUserSession("test", sessionId)); return true; - } catch (NotFoundException nfe) { - return false; + } catch (RunOnServerException nfe) { + if (nfe.getCause() instanceof NotFoundException) { + return false; + } + throw nfe; } } diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ServiceAccountTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ServiceAccountTest.java index 2696114744ad..d413726fab73 100755 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ServiceAccountTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ServiceAccountTest.java @@ -59,6 +59,7 @@ import org.keycloak.testsuite.util.TokenSignatureUtil; import org.keycloak.testsuite.util.oauth.AccessTokenResponse; import org.keycloak.testsuite.util.oauth.LogoutResponse; +import org.keycloak.testsuite.util.runonserver.RunHelpers; import org.keycloak.util.TokenUtil; import com.fasterxml.jackson.databind.JsonNode; @@ -424,7 +425,7 @@ private String clientCredentialsAuthSuccessWithoutRefreshTokenImpl() throws Exce Assertions.assertNull(accessToken.getSessionState()); Assertions.assertNull(response.getRefreshToken(), "Refresh-Token should not be present"); - AccessTokenContext ctx = testingClient.testing("test").getTokenContext(accessToken.getId()); + AccessTokenContext ctx = runOnServerTest.fetch(RunHelpers.getTokenContext(accessToken.getId())); Assertions.assertEquals(ctx.getSessionType(), AccessTokenContext.SessionType.TRANSIENT); Assertions.assertEquals(ctx.getTokenType(), AccessTokenContext.TokenType.REGULAR); Assertions.assertEquals(ctx.getGrantType(), OAuth2Constants.CLIENT_CREDENTIALS); diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenIntrospectionTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenIntrospectionTest.java index c0bb10a48891..bcd0fddda473 100755 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenIntrospectionTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenIntrospectionTest.java @@ -55,6 +55,7 @@ import org.keycloak.testsuite.util.TokenSignatureUtil; import org.keycloak.testsuite.util.oauth.AccessTokenResponse; import org.keycloak.testsuite.util.oauth.IntrospectionResponse; +import org.keycloak.testsuite.util.runonserver.RunHelpers; import org.keycloak.util.BasicAuthHelper; import org.keycloak.util.JsonSerialization; import org.keycloak.util.TokenUtil; @@ -462,7 +463,7 @@ public void testIntrospectAccessTokenOfflineAccess() throws Exception { assertEquals("test-app", rep.getClientId()); // "Online" session doesn't even exists - testingClient.testing().removeExpired("test"); + runOnServerMaster.run(RunHelpers.removeExpired("test")); oauth.client("test-app", "password"); accessTokenResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken()); diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/StandardTokenExchangeV2Test.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/StandardTokenExchangeV2Test.java index 000e96fb530e..ebc966a5fd1f 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/StandardTokenExchangeV2Test.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/StandardTokenExchangeV2Test.java @@ -83,6 +83,7 @@ import org.keycloak.testsuite.util.oauth.TokenExchangeRequest; import org.keycloak.testsuite.util.oauth.TokenRevocationResponse; import org.keycloak.testsuite.util.oauth.UserInfoResponse; +import org.keycloak.testsuite.util.runonserver.RunHelpers; import org.keycloak.testsuite.utils.tls.TLSUtils; import org.keycloak.util.TokenUtil; @@ -890,7 +891,7 @@ public void testOfflineAccessNotAllowed() throws Exception { .update()) { String accessToken = resourceOwnerLogin("mike", "password", "subject-client", "secret").getAccessToken(); String sessionId = TokenVerifier.create(accessToken, AccessToken.class).parse().getToken().getSessionId(); - Assertions.assertEquals(testingClient.testing(TEST).getClientSessionsCountInUserSession(TEST, sessionId), Integer.valueOf(1)); + Assertions.assertEquals(runOnServerTest.fetch(RunHelpers.getClientSessionsCountInUserSession(TEST, sessionId)), Integer.valueOf(1)); oauth.scope("offline_access"); AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret", List.of("target-client1"), OAuth2Constants.REFRESH_TOKEN_TYPE); @@ -899,7 +900,7 @@ public void testOfflineAccessNotAllowed() throws Exception { assertEquals("Scope offline_access not allowed for token exchange", response.getErrorDescription()); // Check that client session was not created - Assertions.assertEquals(testingClient.testing(TEST).getClientSessionsCountInUserSession(TEST, sessionId), Integer.valueOf(1)); + Assertions.assertEquals(runOnServerTest.fetch(RunHelpers.getClientSessionsCountInUserSession(TEST, sessionId)), Integer.valueOf(1)); } } @@ -919,7 +920,7 @@ public void testOfflineAccessLoginWithRegularTokenExchange() throws Exception { TokenVerifier verifier = TokenVerifier.create(accessToken, AccessToken.class); AccessToken originalToken = verifier.parse().getToken(); - AccessTokenContext ctx = getTestingClient().testing().getTokenContext(originalToken.getId()); + AccessTokenContext ctx = runOnServerMaster.fetch(RunHelpers.getTokenContext(originalToken.getId())); assertEquals(ctx.getSessionType(), AccessTokenContext.SessionType.OFFLINE); // normal access token exchange is allowed for the offline session @@ -1435,7 +1436,7 @@ private void assertUserInfoError(String token, String clientId, String clientSec private void assertAccessTokenContext(String jti, AccessTokenContext.SessionType sessionType, AccessTokenContext.TokenType tokenType, String grantType) { - AccessTokenContext ctx = testingClient.testing(TEST).getTokenContext(jti); + AccessTokenContext ctx = runOnServerTest.fetch(RunHelpers.getTokenContext(jti)); assertEquals(sessionType, ctx.getSessionType()); assertEquals(tokenType, ctx.getTokenType()); assertEquals(grantType, ctx.getGrantType()); diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AbstractWellKnownProviderTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AbstractWellKnownProviderTest.java index 5067e5599579..c6047d5866e9 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AbstractWellKnownProviderTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AbstractWellKnownProviderTest.java @@ -65,6 +65,7 @@ import org.keycloak.testsuite.util.oauth.AccessTokenResponse; import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse; import org.keycloak.testsuite.util.oauth.OAuthClient; +import org.keycloak.testsuite.util.runonserver.RunHelpers; import org.keycloak.testsuite.wellknown.CustomOIDCWellKnownProviderFactory; import org.keycloak.util.JsonSerialization; @@ -437,7 +438,7 @@ public void testDefaultProviderCustomizations() throws IOException { oidcConfig = getOIDCDiscoveryRepresentation(client, OAuthClient.AUTH_SERVER_ROOT); assertScopesSupportedMatchesWithRealm(oidcConfig, expectedScopeList); } finally { - getTestingClient().testing().setSystemPropertyOnServer(CustomOIDCWellKnownProviderFactory.INCLUDE_CLIENT_SCOPES, null); + runOnServerMaster.run(RunHelpers.setSystemPropertyOnServer(CustomOIDCWellKnownProviderFactory.INCLUDE_CLIENT_SCOPES, null)); if ( showScopeId != null) adminClient.realm("test").clientScopes().get(showScopeId).remove(); if ( hideScopeId != null) diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/LightWeightAccessTokenTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/LightWeightAccessTokenTest.java index 0e0e3e527aaf..fe1eba25bdb2 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/LightWeightAccessTokenTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/LightWeightAccessTokenTest.java @@ -360,7 +360,7 @@ public void testPolicyLightWeightTrueTest() throws Exception { AccessToken token = oauth.verifyToken(accessToken); assertAccessToken(token, true, true, true); - AccessTokenContext ctx = testingClient.testing("test").getTokenContext(token.getId()); + AccessTokenContext ctx = runOnServerTest.fetch(RunHelpers.getTokenContext(token.getId())); Assertions.assertEquals(ctx.getSessionType(), AccessTokenContext.SessionType.ONLINE); Assertions.assertEquals(ctx.getTokenType(), AccessTokenContext.TokenType.LIGHTWEIGHT); Assertions.assertEquals(ctx.getGrantType(), OAuth2Constants.AUTHORIZATION_CODE); @@ -647,15 +647,15 @@ public void testPublicClientWithLightweightAccessTokenViaDirectGrant() throws Ex // Verify lightweight token AccessToken token = oauth.verifyToken(response.getAccessToken()); - AccessTokenContext ctx = testingClient.testing(REALM_NAME).getTokenContext(token.getId()); + AccessTokenContext ctx = runOnServerTest.fetch(RunHelpers.getTokenContext(token.getId())); Assertions.assertEquals(AccessTokenContext.TokenType.LIGHTWEIGHT, ctx.getTokenType()); Assertions.assertEquals(TEST_USER_PASSWORD, ctx.getGrantType()); } private void removeSession(final String sessionId) { - testingClient.testing().removeExpired(REALM_NAME); + runOnServerMaster.run(RunHelpers.removeExpired(REALM_NAME)); try { - runOnServer.run(RunHelpers.removeUserSession(REALM_NAME, sessionId)); + runOnServerMaster.run(RunHelpers.removeUserSession(REALM_NAME, sessionId)); } catch (RunOnServerException nfe) { if (!(nfe.getCause() instanceof NotFoundException)) { throw nfe; diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/UserInfoTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/UserInfoTest.java index 8913e0cc5aff..9eee2810eae2 100755 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/UserInfoTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/UserInfoTest.java @@ -552,7 +552,7 @@ public void testSessionExpired() { AccessTokenResponse accessTokenResponse = executeGrantAccessTokenRequest(client); String realmName = "test"; - runOnServer.run(RunHelpers.removeUserSessions(realmName)); + runOnServerMaster.run(RunHelpers.removeUserSessions(realmName)); Response response = UserInfoClientUtil.executeUserInfoRequest_getMethod(client, accessTokenResponse.getToken()); @@ -787,7 +787,7 @@ public void testSessionExpiredOfflineAccess() throws Exception { try { AccessTokenResponse accessTokenResponse = executeGrantAccessTokenRequest(client, true, true); - testingClient.testing().removeExpired("test"); + runOnServerMaster.run(RunHelpers.removeExpired("test")); Response response = UserInfoClientUtil.executeUserInfoRequest_getMethod(client, accessTokenResponse.getToken()); diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/providers/ProvidersOverrideTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/providers/ProvidersOverrideTest.java index 2473a25dc47c..f369e8900257 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/providers/ProvidersOverrideTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/providers/ProvidersOverrideTest.java @@ -33,6 +33,7 @@ import org.keycloak.forms.login.LoginFormsProvider; import org.keycloak.provider.Provider; import org.keycloak.representations.idm.RealmRepresentation; +import org.keycloak.testframework.remote.providers.runonserver.FetchOnServer; import org.keycloak.testsuite.AbstractKeycloakTest; import org.junit.Test; @@ -71,7 +72,24 @@ public void testDefaultProvidersOverride() { } private void testProviderImplementationClass(Class providerClass, String providerId, Class expectedProviderImplClass) { - String providerImplClass = getTestingClient().testing().getProviderClassName(providerClass.getName(), providerId); + String providerImplClass = runOnServerMaster.fetchString(getProviderClassName(providerClass.getName(), providerId)).replaceAll("\"", ""); Assertions.assertEquals(expectedProviderImplClass.getName(), providerImplClass); } + + /** + * @param providerClass Full name of class such as for example "org.keycloak.authentication.Authenticator" + * @param providerId providerId referenced in particular provider factory. Can be null (in this case we're returning default provider for particular providerClass) + * @return fullname of provider implementation class + */ + private static FetchOnServer getProviderClassName(String providerClass, String providerId) { + return session -> { + try { + Class providerClazz = (Class) Class.forName(providerClass); + Provider provider = (providerId == null) ? session.getProvider(providerClazz) : session.getProvider(providerClazz, providerId); + return provider.getClass().getName(); + } catch (ClassNotFoundException cnfe) { + throw new RuntimeException("Cannot find provider class: " + providerClass, cnfe); + } + }; + } } From 9a851c03960b437e4e1b8529fa889bd676dc7323 Mon Sep 17 00:00:00 2001 From: Simon Vacek Date: Tue, 19 May 2026 16:18:40 +0200 Subject: [PATCH 2/3] rename runOnServer field Signed-off-by: Simon Vacek --- .../java/org/keycloak/testsuite/AbstractKeycloakTest.java | 4 ++-- .../keycloak/testsuite/oauth/PreAuthorizedGrantTest.java | 4 ++-- .../org/keycloak/testsuite/oauth/ServiceAccountTest.java | 2 +- .../oauth/tokenexchange/StandardTokenExchangeV2Test.java | 6 +++--- .../keycloak/testsuite/oidc/LightWeightAccessTokenTest.java | 4 ++-- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractKeycloakTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractKeycloakTest.java index eafd414c38ef..269f0fd38746 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractKeycloakTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractKeycloakTest.java @@ -140,7 +140,7 @@ public abstract class AbstractKeycloakTest { protected KeycloakTestingClient testingClient; protected KeycloakTestingClient.Server runOnServerMaster; - protected KeycloakTestingClient.Server runOnServerTest; + protected KeycloakTestingClient.Server runOnServer; protected TimeOffSet timeOffSet = new TimeOffSet(this); @@ -190,7 +190,7 @@ public void beforeAbstractKeycloakTest() throws Exception { getTestingClient(); runOnServerMaster = testingClient.server(); - runOnServerTest = testingClient.server(TEST); + runOnServer = testingClient.server(TEST); setDefaultPageUriParameters(); diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/PreAuthorizedGrantTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/PreAuthorizedGrantTest.java index 4eed3f5b0ddd..554b21a602b6 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/PreAuthorizedGrantTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/PreAuthorizedGrantTest.java @@ -75,7 +75,7 @@ public void setup() { @Test public void testPreAuthorizedGrant() throws Exception { String userSessionId = getUserSession(); - String preAuthorizedCode = runOnServerTest.fetchString(getPreAuthorizedCode(TEST_REALM_NAME, userSessionId, "test-app", Time.currentTime() + 30)).replace("\"",""); + String preAuthorizedCode = runOnServer.fetchString(getPreAuthorizedCode(TEST_REALM_NAME, userSessionId, "test-app", Time.currentTime() + 30)).replace("\"",""); AccessTokenResponse accessTokenResponse = postCode(preAuthorizedCode); assertEquals(HttpStatus.SC_OK, accessTokenResponse.getStatusCode(), "An access token should have successfully been returned."); @@ -84,7 +84,7 @@ public void testPreAuthorizedGrant() throws Exception { @Test public void testPreAuthorizedGrantExpired() throws Exception { String userSessionId = getUserSession(); - String preAuthorizedCode = runOnServerTest.fetchString(getPreAuthorizedCode(TEST_REALM_NAME, userSessionId, "test-app", Time.currentTime() - 30)); + String preAuthorizedCode = runOnServer.fetchString(getPreAuthorizedCode(TEST_REALM_NAME, userSessionId, "test-app", Time.currentTime() - 30)); AccessTokenResponse accessTokenResponse = postCode(preAuthorizedCode); assertEquals(HttpStatus.SC_BAD_REQUEST, accessTokenResponse.getStatusCode(), "An expired code should not get an access token."); } diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ServiceAccountTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ServiceAccountTest.java index d413726fab73..717f9505cc4e 100755 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ServiceAccountTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ServiceAccountTest.java @@ -425,7 +425,7 @@ private String clientCredentialsAuthSuccessWithoutRefreshTokenImpl() throws Exce Assertions.assertNull(accessToken.getSessionState()); Assertions.assertNull(response.getRefreshToken(), "Refresh-Token should not be present"); - AccessTokenContext ctx = runOnServerTest.fetch(RunHelpers.getTokenContext(accessToken.getId())); + AccessTokenContext ctx = runOnServer.fetch(RunHelpers.getTokenContext(accessToken.getId())); Assertions.assertEquals(ctx.getSessionType(), AccessTokenContext.SessionType.TRANSIENT); Assertions.assertEquals(ctx.getTokenType(), AccessTokenContext.TokenType.REGULAR); Assertions.assertEquals(ctx.getGrantType(), OAuth2Constants.CLIENT_CREDENTIALS); diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/StandardTokenExchangeV2Test.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/StandardTokenExchangeV2Test.java index ebc966a5fd1f..d9b7900ee8cb 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/StandardTokenExchangeV2Test.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/StandardTokenExchangeV2Test.java @@ -891,7 +891,7 @@ public void testOfflineAccessNotAllowed() throws Exception { .update()) { String accessToken = resourceOwnerLogin("mike", "password", "subject-client", "secret").getAccessToken(); String sessionId = TokenVerifier.create(accessToken, AccessToken.class).parse().getToken().getSessionId(); - Assertions.assertEquals(runOnServerTest.fetch(RunHelpers.getClientSessionsCountInUserSession(TEST, sessionId)), Integer.valueOf(1)); + Assertions.assertEquals(runOnServer.fetch(RunHelpers.getClientSessionsCountInUserSession(TEST, sessionId)), Integer.valueOf(1)); oauth.scope("offline_access"); AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret", List.of("target-client1"), OAuth2Constants.REFRESH_TOKEN_TYPE); @@ -900,7 +900,7 @@ public void testOfflineAccessNotAllowed() throws Exception { assertEquals("Scope offline_access not allowed for token exchange", response.getErrorDescription()); // Check that client session was not created - Assertions.assertEquals(runOnServerTest.fetch(RunHelpers.getClientSessionsCountInUserSession(TEST, sessionId)), Integer.valueOf(1)); + Assertions.assertEquals(runOnServer.fetch(RunHelpers.getClientSessionsCountInUserSession(TEST, sessionId)), Integer.valueOf(1)); } } @@ -1436,7 +1436,7 @@ private void assertUserInfoError(String token, String clientId, String clientSec private void assertAccessTokenContext(String jti, AccessTokenContext.SessionType sessionType, AccessTokenContext.TokenType tokenType, String grantType) { - AccessTokenContext ctx = runOnServerTest.fetch(RunHelpers.getTokenContext(jti)); + AccessTokenContext ctx = runOnServer.fetch(RunHelpers.getTokenContext(jti)); assertEquals(sessionType, ctx.getSessionType()); assertEquals(tokenType, ctx.getTokenType()); assertEquals(grantType, ctx.getGrantType()); diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/LightWeightAccessTokenTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/LightWeightAccessTokenTest.java index fe1eba25bdb2..a929e18d2926 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/LightWeightAccessTokenTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/LightWeightAccessTokenTest.java @@ -360,7 +360,7 @@ public void testPolicyLightWeightTrueTest() throws Exception { AccessToken token = oauth.verifyToken(accessToken); assertAccessToken(token, true, true, true); - AccessTokenContext ctx = runOnServerTest.fetch(RunHelpers.getTokenContext(token.getId())); + AccessTokenContext ctx = runOnServer.fetch(RunHelpers.getTokenContext(token.getId())); Assertions.assertEquals(ctx.getSessionType(), AccessTokenContext.SessionType.ONLINE); Assertions.assertEquals(ctx.getTokenType(), AccessTokenContext.TokenType.LIGHTWEIGHT); Assertions.assertEquals(ctx.getGrantType(), OAuth2Constants.AUTHORIZATION_CODE); @@ -647,7 +647,7 @@ public void testPublicClientWithLightweightAccessTokenViaDirectGrant() throws Ex // Verify lightweight token AccessToken token = oauth.verifyToken(response.getAccessToken()); - AccessTokenContext ctx = runOnServerTest.fetch(RunHelpers.getTokenContext(token.getId())); + AccessTokenContext ctx = runOnServer.fetch(RunHelpers.getTokenContext(token.getId())); Assertions.assertEquals(AccessTokenContext.TokenType.LIGHTWEIGHT, ctx.getTokenType()); Assertions.assertEquals(TEST_USER_PASSWORD, ctx.getGrantType()); } From 4da61e1b3a1877b40defc6a6963711f32eee0d9a Mon Sep 17 00:00:00 2001 From: Simon Vacek Date: Wed, 20 May 2026 10:40:31 +0200 Subject: [PATCH 3/3] remove realm name from method input Signed-off-by: Simon Vacek --- .../util/runonserver/RunHelpers.java | 28 ++++++------------- .../testsuite/AbstractKeycloakTest.java | 7 +++-- .../KcOidcBrokerTransientSessionsTest.java | 6 ++-- .../federation/storage/ClientStorageTest.java | 4 +-- .../keycloak/testsuite/forms/LoginTest.java | 21 ++++++-------- .../testsuite/oauth/AccessTokenTest.java | 2 +- .../oauth/PreAuthorizedGrantTest.java | 13 ++++----- .../oauth/RPInitiatedLogoutTest.java | 4 +-- .../oauth/TokenIntrospectionTest.java | 2 +- .../StandardTokenExchangeV2Test.java | 4 +-- .../oidc/LightWeightAccessTokenTest.java | 4 +-- .../keycloak/testsuite/oidc/UserInfoTest.java | 4 +-- 12 files changed, 43 insertions(+), 56 deletions(-) diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/runonserver/RunHelpers.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/runonserver/RunHelpers.java index 85337da45405..59faea7bdc4f 100644 --- a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/runonserver/RunHelpers.java +++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/runonserver/RunHelpers.java @@ -10,9 +10,7 @@ import org.keycloak.events.EventListenerProvider; import org.keycloak.events.EventType; import org.keycloak.events.email.EmailEventListenerProviderFactory; -import org.keycloak.models.KeycloakSession; import org.keycloak.models.RealmModel; -import org.keycloak.models.RealmProvider; import org.keycloak.models.UserModel; import org.keycloak.models.UserSessionModel; import org.keycloak.models.session.UserSessionPersisterProvider; @@ -86,9 +84,9 @@ public Class getResultClass() { }; } - public static RunOnServer removeUserSession(String realmName, String sessionId) { + public static RunOnServer removeUserSession(String sessionId) { return session -> { - RealmModel realm = getRealmByName(session, realmName); + RealmModel realm = session.getContext().getRealm(); UserSessionModel sessionModel = session.sessions().getUserSession(realm, sessionId); if (sessionModel == null) { @@ -99,20 +97,19 @@ public static RunOnServer removeUserSession(String realmName, String sessionId) }; } - public static RunOnServer removeUserSessions(String realmName) { + public static RunOnServer removeUserSessions() { return session -> { - RealmModel realm = getRealmByName(session, realmName); - + RealmModel realm = session.getContext().getRealm(); session.sessions().removeUserSessions(realm); }; } - public static FetchOnServerWrapper getClientSessionsCountInUserSession(String realmName, String sessionId) { + public static FetchOnServerWrapper getClientSessionsCountInUserSession(String sessionId) { return new FetchOnServerWrapper<>() { @Override public FetchOnServer getRunOnServer() { return session -> { - RealmModel realm = getRealmByName(session, realmName); + RealmModel realm = session.getContext().getRealm(); UserSessionModel sessionModel = session.sessions().getUserSession(realm, sessionId); if (sessionModel == null) { @@ -131,9 +128,9 @@ public Class getResultClass() { }; } - public static RunOnServer removeExpired(String realmName) { + public static RunOnServer removeExpired() { return session -> { - RealmModel realm = getRealmByName(session, realmName); + RealmModel realm = session.getContext().getRealm(); session.getProvider(UserSessionPersisterProvider.class).removeExpired(realm); session.realms().removeExpiredClientInitialAccess(); @@ -213,13 +210,4 @@ public static RunOnServer reinitializeProviderFactoryWithSystemPropertiesScope(S }; } - public static RealmModel getRealmByName(KeycloakSession session, String realmName) { - RealmProvider realmProvider = session.getProvider(RealmProvider.class); - RealmModel realm = realmProvider.getRealmByName(realmName); - if (realm == null) { - throw new NotFoundException("Realm not found"); - } - return realm; - } - } diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractKeycloakTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractKeycloakTest.java index 269f0fd38746..875f77d23aeb 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractKeycloakTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractKeycloakTest.java @@ -51,6 +51,7 @@ import org.keycloak.common.util.KeycloakUriBuilder; import org.keycloak.common.util.SecretGenerator; import org.keycloak.common.util.Time; +import org.keycloak.models.RealmModel; import org.keycloak.models.UserModel; import org.keycloak.models.utils.TimeBasedOTP; import org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper; @@ -78,7 +79,6 @@ import org.keycloak.testsuite.util.TestEventsLogger; import org.keycloak.testsuite.util.WaitUtils; import org.keycloak.testsuite.util.oauth.OAuthClient; -import org.keycloak.testsuite.util.runonserver.RunHelpers; import org.apache.commons.configuration.ConfigurationException; import org.apache.commons.configuration.PropertiesConfiguration; @@ -254,7 +254,10 @@ public void afterAbstractKeycloakTest() throws Exception { } else { log.info("calling all TestCleanup"); // Remove all sessions - testContext.getTestRealmReps().stream().forEach((r)-> runOnServerMaster.run(RunHelpers.removeUserSessions(r.getRealm()))); + testContext.getTestRealmReps().stream().map(RealmRepresentation::getRealm).forEach((r)-> runOnServerMaster.run(session -> { + RealmModel realm = session.realms().getRealmByName(r); + session.sessions().removeUserSessions(realm); + })); // Cleanup objects for (TestCleanup cleanup : testContext.getCleanups().values()) { diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerTransientSessionsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerTransientSessionsTest.java index bea596a949bf..7dc8b10fdb5f 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerTransientSessionsTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerTransientSessionsTest.java @@ -61,6 +61,7 @@ import org.keycloak.testsuite.AssertEvents; import org.keycloak.testsuite.arquillian.annotation.EnableFeature; import org.keycloak.testsuite.broker.util.SimpleHttpDefault; +import org.keycloak.testsuite.client.KeycloakTestingClient; import org.keycloak.testsuite.pages.UpdateAccountInformationPage; import org.keycloak.testsuite.updaters.ClientAttributeUpdater; import org.keycloak.testsuite.updaters.Creator; @@ -659,9 +660,10 @@ private String testRefreshWithOfflineToken(AccessToken oldToken, RefreshToken of assertTrue(offlineToken.isActive()); // Assert userSession expired - runOnServerMaster.run(RunHelpers.removeExpired(bc.consumerRealmName())); + KeycloakTestingClient.Server runOnServerConsumer = testingClient.server(bc.consumerRealmName()); + runOnServerConsumer.run(RunHelpers.removeExpired()); try { - runOnServerMaster.run(RunHelpers.removeUserSession(bc.consumerRealmName(), sessionId)); + runOnServerConsumer.run(RunHelpers.removeUserSession(sessionId)); } catch (RunOnServerException nfe) { if (!(nfe.getCause() instanceof NotFoundException)) { throw nfe; diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/ClientStorageTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/ClientStorageTest.java index 7e407437e51d..5952b5ff91f8 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/ClientStorageTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/ClientStorageTest.java @@ -502,9 +502,9 @@ private String testRefreshWithOfflineToken(AccessToken oldToken, RefreshToken of Assertions.assertTrue(offlineToken.isActive()); // Assert userSession expired - runOnServerMaster.run(RunHelpers.removeExpired("test")); + runOnServer.run(RunHelpers.removeExpired()); try { - runOnServerMaster.run(RunHelpers.removeUserSession("test", sessionId)); + runOnServer.run(RunHelpers.removeUserSession(sessionId)); } catch (RunOnServerException nfe) { if (!(nfe.getCause() instanceof NotFoundException)) { throw nfe; diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LoginTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LoginTest.java index 72fe3e8605ab..b4529995d87d 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LoginTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LoginTest.java @@ -96,7 +96,6 @@ import static org.keycloak.testsuite.admin.AdminApiUtil.findClientByClientId; import static org.keycloak.testsuite.util.ServerURLs.getAuthServerContextRoot; import static org.keycloak.testsuite.util.oauth.OAuthClient.SERVER_ROOT; -import static org.keycloak.testsuite.util.runonserver.RunHelpers.getRealmByName; import static org.hamcrest.MatcherAssert.assertThat; import static org.hamcrest.Matchers.containsString; @@ -664,7 +663,7 @@ public void loginWithRememberMe() { String sessionId = loginEvent.getSessionId(); // Expire session - runOnServerMaster.run(RunHelpers.removeUserSession("test", sessionId)); + runOnServer.run(RunHelpers.removeUserSession(sessionId)); // Assert rememberMe checked and username/email prefilled oauth.openLoginForm(); @@ -722,7 +721,7 @@ public void loginAgainWithoutRememberMe() { String sessionId = loginEvent.getSessionId(); // Expire session - runOnServerMaster.run(RunHelpers.removeUserSession("test", sessionId)); + runOnServer.run(RunHelpers.removeUserSession(sessionId)); // Assert rememberMe checked and username/email prefilled oauth.openLoginForm(); @@ -737,7 +736,7 @@ public void loginAgainWithoutRememberMe() { loginEvent = EventAssertion.expectLoginSuccess(events.poll()).userId(userId) .details(Details.USERNAME, "login-test").getEvent(); sessionId = loginEvent.getSessionId(); - runOnServerMaster.run(RunHelpers.removeUserSession("test", sessionId)); + runOnServer.run(RunHelpers.removeUserSession(sessionId)); // Assert rememberMe not checked nor username/email prefilled oauth.openLoginForm(); @@ -767,7 +766,7 @@ public void loginWithEmailUserAndRememberMe() { String sessionId = loginEvent.getSessionId(); // Expire session - runOnServerMaster.run(RunHelpers.removeUserSession("test", sessionId)); + runOnServer.run(RunHelpers.removeUserSession(sessionId)); // Assert rememberMe checked and username/email prefilled oauth.openLoginForm(); @@ -982,17 +981,17 @@ public void testAuthenticationSessionExpiresEarlyAfterAuthentication() throws Ex // Assert authenticationSession in cache with 2 tabs String authSessionId = driver.manage().getCookieNamed(CookieType.AUTH_SESSION_ID.getName()).getValue(); - Assertions.assertEquals((Integer) 2, runOnServerMaster.fetch(getAuthenticationSessionTabsCount("test", authSessionId))); + Assertions.assertEquals((Integer) 2, runOnServer.fetch(getAuthenticationSessionTabsCount(authSessionId))); loginPage.login("test-user@localhost", getPassword("test-user@localhost")); appPage.assertCurrent(); // authentication session should still exists with remaining browser tab - Assertions.assertEquals((Integer) 1, runOnServerMaster.fetch(getAuthenticationSessionTabsCount("test", authSessionId))); + Assertions.assertEquals((Integer) 1, runOnServer.fetch(getAuthenticationSessionTabsCount(authSessionId))); // authentication session should be expired after 1 minute timeOffSet.set(300); - Assertions.assertEquals((Integer) 0, runOnServerMaster.fetch(getAuthenticationSessionTabsCount("test", authSessionId))); + Assertions.assertEquals((Integer) 0, runOnServer.fetch(getAuthenticationSessionTabsCount(authSessionId))); } @@ -1145,17 +1144,15 @@ public void testAuthSessionIdCookieFormat(){ /** * Get count of tabs (child authentication sessions) for given "root authentication session" * - * @param realmName realm name (not ID) * @param authSessionId ID of authentication session * @return count of tabs. Return 0 if authentication session of given ID does not exists (or if it exists, but without any authenticationSessions attached, which should not happen with normal usage) */ - private static FetchOnServerWrapper getAuthenticationSessionTabsCount(String realmName, String authSessionId) { + private static FetchOnServerWrapper getAuthenticationSessionTabsCount(String authSessionId) { return new FetchOnServerWrapper<>() { @Override public FetchOnServer getRunOnServer() { return session ->{ - RealmModel realm = getRealmByName(session, realmName); - session.getContext().setRealm(realm); + RealmModel realm = session.getContext().getRealm(); String decodedAuthSessionId = new AuthenticationSessionManager(session).decodeBase64AndValidateSignature(authSessionId); RootAuthenticationSessionModel rootAuthSession = session.authenticationSessions().getRootAuthenticationSession(realm, decodedAuthSessionId); if (rootAuthSession == null) { diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenTest.java index 737ce2d5166a..0fa42fc50f5d 100755 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenTest.java @@ -419,7 +419,7 @@ public void accessTokenUserSessionExpired() { String sessionId = loginEvent.getSessionId(); - runOnServerMaster.run(RunHelpers.removeUserSession("test", sessionId)); + runOnServer.run(RunHelpers.removeUserSession(sessionId)); String code = oauth.parseLoginResponse().getCode(); AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code); diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/PreAuthorizedGrantTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/PreAuthorizedGrantTest.java index 554b21a602b6..d41b5247a8b8 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/PreAuthorizedGrantTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/PreAuthorizedGrantTest.java @@ -57,7 +57,6 @@ import org.junit.Test; import static org.keycloak.OID4VCConstants.OPENID_CREDENTIAL; -import static org.keycloak.testsuite.util.runonserver.RunHelpers.getRealmByName; import static org.junit.jupiter.api.Assertions.assertEquals; @@ -75,7 +74,7 @@ public void setup() { @Test public void testPreAuthorizedGrant() throws Exception { String userSessionId = getUserSession(); - String preAuthorizedCode = runOnServer.fetchString(getPreAuthorizedCode(TEST_REALM_NAME, userSessionId, "test-app", Time.currentTime() + 30)).replace("\"",""); + String preAuthorizedCode = runOnServer.fetchString(getPreAuthorizedCode(userSessionId, "test-app", Time.currentTime() + 30)).replace("\"",""); AccessTokenResponse accessTokenResponse = postCode(preAuthorizedCode); assertEquals(HttpStatus.SC_OK, accessTokenResponse.getStatusCode(), "An access token should have successfully been returned."); @@ -84,7 +83,7 @@ public void testPreAuthorizedGrant() throws Exception { @Test public void testPreAuthorizedGrantExpired() throws Exception { String userSessionId = getUserSession(); - String preAuthorizedCode = runOnServer.fetchString(getPreAuthorizedCode(TEST_REALM_NAME, userSessionId, "test-app", Time.currentTime() - 30)); + String preAuthorizedCode = runOnServer.fetchString(getPreAuthorizedCode(userSessionId, "test-app", Time.currentTime() - 30)); AccessTokenResponse accessTokenResponse = postCode(preAuthorizedCode); assertEquals(HttpStatus.SC_BAD_REQUEST, accessTokenResponse.getStatusCode(), "An expired code should not get an access token."); } @@ -124,8 +123,7 @@ public void testPreAuthorizedGrantRealmDisabled() throws Exception { try { String userSessionId = getUserSession(); - String preAuthorizedCode = runOnServerMaster.fetchString( - getPreAuthorizedCode(TEST_REALM_NAME, userSessionId, "test-app", Time.currentTime() + 30)); + String preAuthorizedCode = runOnServer.fetchString(getPreAuthorizedCode(userSessionId, "test-app", Time.currentTime() + 30)); AccessTokenResponse accessTokenResponse = postCode(preAuthorizedCode); assertEquals(HttpStatus.SC_FORBIDDEN, accessTokenResponse.getStatusCode(), "Pre-authorized grant should be forbidden when verifiable credentials are disabled."); @@ -182,15 +180,14 @@ public void configureTestRealm(RealmRepresentation testRealm) { /** * Return a pre-authorized code for the current session. * - * @param realmName name of the realm to be used * @param userSessionId id of the user session to get a code for * @param clientId id of the client to be used * @param expireAt expiration time of the code * @return the code */ - public static FetchOnServer getPreAuthorizedCode(String realmName, String userSessionId, String clientId, int expireAt) { + public static FetchOnServer getPreAuthorizedCode(String userSessionId, String clientId, int expireAt) { return session -> { - RealmModel realm = getRealmByName(session, realmName); + RealmModel realm = session.getContext().getRealm(); UserSessionModel userSession = session.sessions().getUserSession(realm, userSessionId); String credConfigId = "oid4vc_natural_person_sd"; diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/RPInitiatedLogoutTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/RPInitiatedLogoutTest.java index 12f56b391ffb..4c3bd339e8d3 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/RPInitiatedLogoutTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/RPInitiatedLogoutTest.java @@ -306,7 +306,7 @@ public void logoutWithRememberMe() throws IOException { String sessionId = EventAssertion.expectLoginSuccess(events.poll()).getEvent().getSessionId(); // Expire session - runOnServerMaster.run(RunHelpers.removeUserSession("test", sessionId)); + runOnServer.run(RunHelpers.removeUserSession(sessionId)); // Assert rememberMe checked and username/email prefilled oauth.openLoginForm(); @@ -1118,7 +1118,7 @@ private AccessTokenResponse loginUser(boolean consentRequired) { private boolean isSessionActive(String sessionId) { try { - runOnServerMaster.fetch(RunHelpers.getClientSessionsCountInUserSession("test", sessionId)); + runOnServer.fetch(RunHelpers.getClientSessionsCountInUserSession(sessionId)); return true; } catch (RunOnServerException nfe) { if (nfe.getCause() instanceof NotFoundException) { diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenIntrospectionTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenIntrospectionTest.java index bcd0fddda473..9ac4388b4c57 100755 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenIntrospectionTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenIntrospectionTest.java @@ -463,7 +463,7 @@ public void testIntrospectAccessTokenOfflineAccess() throws Exception { assertEquals("test-app", rep.getClientId()); // "Online" session doesn't even exists - runOnServerMaster.run(RunHelpers.removeExpired("test")); + runOnServer.run(RunHelpers.removeExpired()); oauth.client("test-app", "password"); accessTokenResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken()); diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/StandardTokenExchangeV2Test.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/StandardTokenExchangeV2Test.java index d9b7900ee8cb..37ca30201f8b 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/StandardTokenExchangeV2Test.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/StandardTokenExchangeV2Test.java @@ -891,7 +891,7 @@ public void testOfflineAccessNotAllowed() throws Exception { .update()) { String accessToken = resourceOwnerLogin("mike", "password", "subject-client", "secret").getAccessToken(); String sessionId = TokenVerifier.create(accessToken, AccessToken.class).parse().getToken().getSessionId(); - Assertions.assertEquals(runOnServer.fetch(RunHelpers.getClientSessionsCountInUserSession(TEST, sessionId)), Integer.valueOf(1)); + Assertions.assertEquals(runOnServer.fetch(RunHelpers.getClientSessionsCountInUserSession(sessionId)), Integer.valueOf(1)); oauth.scope("offline_access"); AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret", List.of("target-client1"), OAuth2Constants.REFRESH_TOKEN_TYPE); @@ -900,7 +900,7 @@ public void testOfflineAccessNotAllowed() throws Exception { assertEquals("Scope offline_access not allowed for token exchange", response.getErrorDescription()); // Check that client session was not created - Assertions.assertEquals(runOnServer.fetch(RunHelpers.getClientSessionsCountInUserSession(TEST, sessionId)), Integer.valueOf(1)); + Assertions.assertEquals(runOnServer.fetch(RunHelpers.getClientSessionsCountInUserSession(sessionId)), Integer.valueOf(1)); } } diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/LightWeightAccessTokenTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/LightWeightAccessTokenTest.java index a929e18d2926..d2df4a6b44cc 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/LightWeightAccessTokenTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/LightWeightAccessTokenTest.java @@ -653,9 +653,9 @@ public void testPublicClientWithLightweightAccessTokenViaDirectGrant() throws Ex } private void removeSession(final String sessionId) { - runOnServerMaster.run(RunHelpers.removeExpired(REALM_NAME)); + runOnServer.run(RunHelpers.removeExpired()); try { - runOnServerMaster.run(RunHelpers.removeUserSession(REALM_NAME, sessionId)); + runOnServer.run(RunHelpers.removeUserSession(sessionId)); } catch (RunOnServerException nfe) { if (!(nfe.getCause() instanceof NotFoundException)) { throw nfe; diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/UserInfoTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/UserInfoTest.java index 9eee2810eae2..0ba810f077c3 100755 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/UserInfoTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/UserInfoTest.java @@ -552,7 +552,7 @@ public void testSessionExpired() { AccessTokenResponse accessTokenResponse = executeGrantAccessTokenRequest(client); String realmName = "test"; - runOnServerMaster.run(RunHelpers.removeUserSessions(realmName)); + runOnServer.run(RunHelpers.removeUserSessions()); Response response = UserInfoClientUtil.executeUserInfoRequest_getMethod(client, accessTokenResponse.getToken()); @@ -787,7 +787,7 @@ public void testSessionExpiredOfflineAccess() throws Exception { try { AccessTokenResponse accessTokenResponse = executeGrantAccessTokenRequest(client, true, true); - runOnServerMaster.run(RunHelpers.removeExpired("test")); + runOnServer.run(RunHelpers.removeExpired()); Response response = UserInfoClientUtil.executeUserInfoRequest_getMethod(client, accessTokenResponse.getToken());