diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/SecureRedirectUrisEnforcerExecutorTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/SecureRedirectUrisEnforcerExecutorTest.java index 4f5b3f8cf5bc..0b36233ac16b 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/SecureRedirectUrisEnforcerExecutorTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/SecureRedirectUrisEnforcerExecutorTest.java @@ -51,6 +51,62 @@ public void addTestRealms(List testRealms) { testRealms.add(realm); } + @Test + public void testNotRedirectBasedFlowClient_normalUri() throws Exception { + // register profiles + String json = (new ClientPoliciesUtil.ClientProfilesBuilder()).addProfile( + (new ClientPoliciesUtil.ClientProfileBuilder()).createProfile(PROFILE_NAME, "Le Premier Profil") + .addExecutor(SecureRedirectUrisEnforcerExecutorFactory.PROVIDER_ID, + createSecureRedirectUrisEnforcerExecutorConfig(it->{})) + .toRepresentation() + ).toString(); + updateProfiles(json); + + // register policies + json = (new ClientPoliciesUtil.ClientPoliciesBuilder()).addPolicy( + (new ClientPoliciesUtil.ClientPolicyBuilder()).createPolicy(POLICY_NAME, "La Premiere Politique", Boolean.TRUE) + .addCondition(AnyClientConditionFactory.PROVIDER_ID, + createAnyClientConditionConfig()) + .addProfile(PROFILE_NAME) + .toRepresentation() + ).toString(); + updatePolicies(json); + + // The executor's check logic is not executed to an auth code flow or implicit flow disabled client. + + // Registration + // Success - even if not setting a valid redirect uri + String clientId = null; + String cId = null; + try { + clientId = generateSuffixedName(CLIENT_NAME); + cId = createClientByAdmin(clientId, (ClientRepresentation clientRep) -> { + clientRep.setSecret("secret"); + clientRep.setRedirectUris(List.of("http://oauth.redirect/some")); // normally, a redirect url with http scheme is not allowed. + clientRep.setStandardFlowEnabled(false); + clientRep.setImplicitFlowEnabled(false); + clientRep.setServiceAccountsEnabled(true); + }); + ClientRepresentation cRep = getClientByAdmin(cId); + assertEquals(new HashSet<>(List.of("http://oauth.redirect/some")), new HashSet<>(cRep.getRedirectUris())); + } catch (ClientPolicyException cpe) { + fail(); + } + + // Update + // Success - even if not setting a valid redirect uri + try { + updateClientByAdmin(cId, (ClientRepresentation clientRep) -> { + clientRep.setAttributes(new HashMap<>()); + clientRep.setRedirectUris(List.of("")); // nomally, vacant redirect uri is not allowed. + }); + ClientRepresentation cRep = getClientByAdmin(cId); + assertEquals(new HashSet<>(List.of("")), new HashSet<>(cRep.getRedirectUris())); + } catch (ClientPolicyException cpe) { + fail(); + } + } + @Test public void testSecureRedirectUrisEnforcerExecutor_normalUri() throws Exception { // register profiles