8000 Migrate OIDC broker config-variant and parameter-forwarding tests by sguilhen · Pull Request #52372 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

Migrate OIDC broker config-variant and parameter-forwarding tests #52372

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pedroigor merged 2 commits into from
Sep 8, 2026
Merged

Migrate OIDC broker config-variant and parameter-forwarding tests #52372

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5728f5a
Move OIDC config-variant and parameter-forwarding tests to new testsu…
sguilhen Sep 3, 2026
514a844
Migrate OIDC broker config-variant and parameter-forwarding tests
sguilhen Sep 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions tests/base/src/test/java/org/keycloak/tests/broker/oidc/KcOidcBrokerAcrParameterTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
package org.keycloak.tests.broker.oidc;

import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
import org.keycloak.tests.broker.AbstractKcOidcBrokerTest;

import static org.hamcrest.CoreMatchers.containsString;
import static org.hamcrest.MatcherAssert.assertThat;

@KeycloakIntegrationTest
public class KcOidcBrokerAcrParameterTest extends AbstractKcOidcBrokerTest {

private static final String ACR_VALUES = "acr_values";
private static final String ACR_3 = "3";

@Override
protected void loginUser() {
oauth.loginForm().param(ACR_VALUES, ACR_3).open();

logInWithBroker();

webDriver.waiting().until(d -> webDriver.getCurrentUrl().contains("/realms/" + PROVIDER_REALM + "/"));
assertThat(ACR_VALUES + "=" + ACR_3 + " should be part of the url",
webDriver.getCurrentUrl(), containsString(ACR_VALUES + "=" + ACR_3));

logInAsUserInIDPForFirstTime();
updateAccountInformation();
assertUserCreatedInConsumerRealm();
}
}
3 changes: 2 additions & 1 deletion 10BC8 ...cOidcBrokerClientSecretBasicAuthTest.java → ...cOidcBrokerClientSecretBasicAuthTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
package org.keycloak.tests.broker;
package org.keycloak.tests.broker.oidc;

import org.keycloak.protocol.oidc.OIDCLoginProtocol;
import org.keycloak.testframework.annotations.InjectRealm;
Expand All @@ -7,6 +7,7 @@
import org.keycloak.testframework.realm.ManagedRealm;
import org.keycloak.testframework.realm.RealmBuilder;
import org.keycloak.testframework.realm.RealmConfig;
import org.keycloak.tests.broker.AbstractKcOidcBrokerTest;

@KeycloakIntegrationTest
public class KcOidcBrokerClientSecretBasicAuthTest extends AbstractKcOidcBrokerTest {
Expand Down
46 changes: 46 additions & 0 deletions tests/base/src/test/java/org/keycloak/tests/broker/oidc/KcOidcBrokerNoLoginHintTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
package org.keycloak.tests.broker.oidc;

import org.keycloak.models.IdentityProviderModel;
import org.keycloak.testframework.annotations.InjectRealm;
import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
import org.keycloak.testframework.injection.LifeCycle;
import org.keycloak.testframework.realm.ManagedRealm;
import org.keycloak.testframework.realm.RealmBuilder;
import org.keycloak.testframework.realm.RealmConfig;
import org.keycloak.tests.broker.AbstractKcOidcBrokerTest;

import org.junit.jupiter.api.Assertions;

@KeycloakIntegrationTest
public class KcOidcBrokerNoLoginHintTest extends AbstractKcOidcBrokerTest {

@InjectRealm(ref = "consumer", lifecycle = LifeCycle.METHOD,
config = NoLoginHintConsumerRealmConfig.class)
ManagedRealm consumerRealm;

@Override
protected void loginUser() {
oauth.loginForm().loginHint(USER_EMAIL).open();

logInWithBroker();

webDriver.waiting().until(d -> webDriver.getCurrentUrl().contains("/realms/" + PROVIDER_REALM + "/"));
Assertions.assertTrue(webDriver.getCurrentUrl().contains("/realms/" + PROVIDER_REALM + "/"),
"Driver should be on the provider realm page right now");
Assertions.assertTrue(loginPage.getUsername().isBlank(),
"User identifier should not be filled");

logInAsUserInIDPForFirstTime();
updateAccountInformation();
assertUserCreatedInConsumerRealm();
}

static class NoLoginHintConsumerRealmConfig implements RealmConfig {
@Override
public RealmBuilder configure(RealmBuilder realm) {
return configureConsumerRealm(realm,
createOidcIdentityProvider()
.attribute(IdentityProviderModel.LOGIN_HINT, "false"));
}
}
}
82 changes: 82 additions & 0 deletions ...s/base/src/test/java/org/keycloak/tests/broker/oidc/KcOidcBrokerParameterForwardTest.java
View file 6870
Open in desktop
8000
Original file line number Diff line number Diff line change
@@ -0,0 +1,82 @@
package org.keycloak.tests.broker.oidc;

import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;

import org.keycloak.OAuth2Constants;
import org.keycloak.protocol.oidc.OIDCLoginProtocol;
import org.keycloak.testframework.annotations.InjectRealm;
import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
import org.keycloak.testframework.injection.LifeCycle;
import org.keycloak.testframework.realm.ManagedRealm;
import org.keycloak.testframework.realm.RealmBuilder;
import org.keycloak.testframework.realm.RealmConfig;
import org.keycloak.tests.broker.AbstractKcOidcBrokerTest;

import static org.hamcrest.CoreMatchers.containsString;
import static org.hamcrest.CoreMatchers.not;
import static org.hamcrest.MatcherAssert.assertThat;

@KeycloakIntegrationTest
public class KcOidcBrokerParameterForwardTest extends AbstractKcOidcBrokerTest {

private static final String FORWARDED_PARAMETER = "forwarded_parameter";
private static final String FORWARDED_PARAMETER_VALUE = "forwarded_value";
private static final String PARAMETER_NOT_SET = "parameter_not_set";
private static final String PARAMETER_NOT_FORWARDED = "parameter_not_forwarded";

@InjectRealm(ref = "consumer", lifecycle = LifeCycle.METHOD,
config = ParameterForwardConsumerRealmConfig.class)
ManagedRealm consumerRealm;

@Override
protected void loginUser() {
String claimsValue = "{\"userinfo\":{\"http://itsme.services/v2/claim/BENationalNumber\":null,\"spaced_value\":\"with space\"}}";
String urlEncodedClaims = URLEncoder.encode(claimsValue, StandardCharsets.UTF_8);
String forwardedEncodedParam = "forwarded_encoded";
String forwardedEncodedParamValue = "encoded value";
String forwardedEncodedParamValueEncoded = URLEncoder.encode(forwardedEncodedParamValue, StandardCharsets.UTF_8);

oauth.openLoginForm();
String queryString = "&" + FORWARDED_PARAMETER + "=" + FORWARDED_PARAMETER_VALUE
+ "&" + PARAMETER_NOT_FORWARDED + "=" + "value"
+ "&" + OAuth2Constants.ACR_VALUES + "=" + "phr"
+ "&" + OIDCLoginProtocol.CLAIMS_PARAM + "=" + urlEncodedClaims
+ "&" + forwardedEncodedParam + "=" + forwardedEncodedParamValue;
webDriver.open(webDriver.getCurrentUrl() + queryString);

logInWithBroker();

webDriver.waiting().until(d -> webDriver.getCurrentUrl().contains("/realms/" + PROVIDER_REALM + "/"));

String currentUrl = webDriver.getCurrentUrl();
assertThat(FORWARDED_PARAMETER + "=" + FORWARDED_PARAMETER_VALUE + " should be part of the url",
currentUrl, containsString(FORWARDED_PARAMETER + "=" + FORWARDED_PARAMETER_VALUE));
assertThat(OAuth2Constants.ACR_VALUES + "=phr should be part of the url",
currentUrl, containsString(OAuth2Constants.ACR_VALUES + "=" + "phr"));
assertThat(OIDCLoginProtocol.CLAIMS_PARAM + " should be part of the url",
currentUrl, containsString(OIDCLoginProtocol.CLAIMS_PARAM + "=" + urlEncodedClaims));
assertThat(forwardedEncodedParam + " should be part of the url",
currentUrl, containsString(forwardedEncodedParam + "=" + forwardedEncodedParamValueEncoded));
assertThat(PARAMETER_NOT_SET + " should NOT be part of the url",
currentUrl, not(containsString(PARAMETER_NOT_SET)));
assertThat(PARAMETER_NOT_FORWARDED + " should NOT be part of the url",
currentUrl, not(containsString(PARAMETER_NOT_FORWARDED)));

logInAsUserInIDPForFirstTime();
updateAccountInformation();
assertUserCreatedInConsumerRealm();
}

static class ParameterForwardConsumerRealmConfig implements RealmConfig {
@Override
public RealmBuilder configure(RealmBuilder realm) {
return configureConsumerRealm(realm,
createOidcIdentityProvider()
.attribute("forwardParameters",
FORWARDED_PARAMETER + ", " + PARAMETER_NOT_SET + ", "
+ OAuth2Constants.ACR_VALUES + ", " + OIDCLoginProtocol.CLAIMS_PARAM
+ ",forwarded_encoded"));
}
}
}
29 changes: 29 additions & 0 deletions tests/base/src/test/java/org/keycloak/tests/broker/oidc/KcOidcBrokerPkceTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
package org.keycloak.tests.broker.oidc;

import org.keycloak.OAuth2Constants;
import org.keycloak.broker.oidc.OAuth2IdentityProviderConfig;
import org.keycloak.testframework.annotations.InjectRealm;
import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
import org.keycloak.testframework.injection.LifeCycle;
import org.keycloak.testframework.realm.ManagedRealm;
import org.keycloak.testframework.realm.RealmBuilder;
import org.keycloak.testframework.realm.RealmConfig;
import org.keycloak.tests.broker.AbstractKcOidcBrokerTest;

@KeycloakIntegrationTest
public class KcOidcBrokerPkceTest extends AbstractKcOidcBrokerTest {

@InjectRealm(ref = "consumer", lifecycle = LifeCycle.METHOD,
config = PkceConsumerRealmConfig.class)
ManagedRealm consumerRealm;

static class PkceConsumerRealmConfig implements RealmConfig {
@Override
public RealmBuilder configure(RealmBuilder realm) {
return configureConsumerRealm(realm,
createOidcIdentityProvider()
.attribute(OAuth2IdentityProviderConfig.PKCE_ENABLED, "true")
.attribute(OAuth2IdentityProviderConfig.PKCE_METHOD, OAuth2Constants.PKCE_METHOD_S256));
}
}
}
55 changes: 55 additions & 0 deletions tests/base/src/test/java/org/keycloak/tests/broker/oidc/KcOidcBrokerPromptParameterTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
package org.keycloak.tests.broker.oidc;

import org.keycloak.protocol.oidc.OIDCLoginProtocol;
import org.keycloak.testframework.annotations.InjectRealm;
import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
import org.keycloak.testframework.injection.LifeCycle;
import org.keycloak.testframework.realm.ManagedRealm;
import org.keycloak.testframework.realm.RealmBuilder;
import org.keycloak.testframework.realm.RealmConfig;
import org.keycloak.tests.broker.AbstractKcOidcBrokerTest;

import static org.hamcrest.CoreMatchers.containsString;
import static org.hamcrest.CoreMatchers.not;
import static org.hamcrest.MatcherAssert.assertThat;

@KeycloakIntegrationTest
public class KcOidcBrokerPromptParameterTest extends AbstractKcOidcBrokerTest {

private static final String PROMPT_CONSENT = "consent";
private static final String PROMPT_LOGIN = "login";

@InjectRealm(ref = "consumer", lifecycle = LifeCycle.METHOD,
config = PromptConsumerRealmConfig.class)
ManagedRealm consumerRealm;

@Override
protected void loginUser() {
oauth.loginForm()
.param(OIDCLoginProtocol.PROMPT_PARAM, PROMPT_CONSENT)
.open();

logInWithBroker();

webDriver.waiting().until(d -> webDriver.getCurrentUrl().contains("/realms/" + PROVIDER_REALM + "/"));
assertThat(OIDCLoginProtocol.PROMPT_PARAM + "=" + PROMPT_LOGIN + " should not be part of the url",
webDriver.getCurrentUrl(), not(containsString(OIDCLoginProtocol.PROMPT_PARAM + "=" + PROMPT_LOGIN)));
assertThat(OIDCLoginProtocol.PROMPT_PARAM + "=" + PROMPT_CONSENT + " should be part of the url",
webDriver.getCurrentUrl(), containsString(OIDCLoginProtocol.PROMPT_PARAM + "=" + PROMPT_CONSENT));

logInAsUserInIDPForFirstTime();
updateAccountInformation();
assertUserCreatedInConsumerRealm();
}

// The shared createOidcIdentityProvider() sets prompt=login, which the broker always prefers over the
// client-forwarded prompt. This test needs the client's prompt=consent to pass through, so it clears the
// IDP-configured prompt - mirroring the legacy KcOidcBrokerConfiguration2, which removed the attribute.
static class PromptConsumerRealmConfig implements RealmConfig {
@Override
public RealmBuilder configure(RealmBuilder realm) {
return configureConsumerRealm(realm,
createOidcIdentityProvider().attribute("prompt", null));
}
}
}
3 changes: 2 additions & 1 deletion ...ycloak/tests/broker/KcOidcBrokerTest.java → ...k/tests/broker/oidc/KcOidcBrokerTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package org.keycloak.tests.broker;
package org.keycloak.tests.broker.oidc;

import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
import org.keycloak.tests.broker.AbstractKcOidcBrokerTest;

@KeycloakIntegrationTest
public class KcOidcBrokerTest extends AbstractKcOidcBrokerTest {
Expand Down
49 changes: 49 additions & 0 deletions .../base/src/test/java/org/keycloak/tests/broker/oidc/KcOidcBrokerUiLocalesDisabledTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
package org.keycloak.tests.broker.oidc;

import org.keycloak.testframework.annotations.InjectRealm;
import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
import org.keycloak.testframework.injection.LifeCycle;
import org.keycloak.testframework.realm.ManagedRealm;
import org.keycloak.testframework.realm.RealmBuilder;
import org.keycloak.testframework.realm.RealmConfig;
import org.keycloak.tests.broker.AbstractKcOidcBrokerTest;

import static java.util.Locale.ENGLISH;

import static org.keycloak.OAuth2Constants.UI_LOCALES_PARAM;

import static org.hamcrest.CoreMatchers.containsString;
import static org.hamcrest.CoreMatchers.not;
import static org.hamcrest.MatcherAssert.assertThat;

@KeycloakIntegrationTest
public class KcOidcBrokerUiLocalesDisabledTest extends AbstractKcOidcBrokerTest {

@InjectRealm(ref = "consumer", lifecycle = LifeCycle.METHOD,
config = UiLocalesDisabledConsumerRealmConfig.class)
ManagedRealm consumerRealm;

@Override
protected void loginUser() {
oauth.openLoginForm();

logInWithBroker();

webDriver.waiting().until(d -> webDriver.getCurrentUrl().contains("/realms/" + PROVIDER_REALM + "/"));
assertThat(UI_LOCALES_PARAM + " should NOT be part of the url",
webDriver.getCurrentUrl(), not(containsString(UI_LOCALES_PARAM + "=" + ENGLISH.toLanguageTag())));

logInAsUserInIDPForFirstTime();
updateAccountInformation();
assertUserCreatedInConsumerRealm();
}

static class UiLocalesDisabledConsumerRealmConfig implements RealmConfig {
@Override
public RealmBuilder configure(RealmBuilder realm) {
return configureConsumerRealm(realm,
createOidcIdentityProvider()
.attribute("uiLocales", "false"));
}
}
}
48 changes: 48 additions & 0 deletions ...s/base/src/test/java/org/keycloak/tests/broker/oidc/KcOidcBrokerUiLocalesEnabledTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
package org.keycloak.tests.broker.oidc;

import org.keycloak.testframework.annotations.InjectRealm;
import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
import org.keycloak.testframework.injection.LifeCycle;
import org.keycloak.testframework.realm.ManagedRealm;
import org.keycloak.testframework.realm.RealmBuilder;
import org.keycloak.testframework.realm.RealmConfig;
import org.keycloak.tests.broker.AbstractKcOidcBrokerTest;

import static java.util.Locale.ENGLISH;

import static org.keycloak.OAuth2Constants.UI_LOCALES_PARAM;

import static org.hamcrest.CoreMatchers.containsString;
import static org.hamcrest.MatcherAssert.assertThat;

@KeycloakIntegrationTest
public class KcOidcBrokerUiLocalesEnabledTest extends AbstractKcOidcBrokerTest {

@InjectRealm(ref = "consumer", lifecycle = LifeCycle.METHOD,
config = UiLocalesEnabledConsumerRealmConfig.class)
ManagedRealm consumerRealm;

@Override
protected void loginUser() {
oauth.openLoginForm();

logInWithBroker();

webDriver.waiting().until(d -> webDriver.getCurrentUrl().contains("/realms/" + PROVIDER_REALM + "/"));
assertThat(UI_LOCALES_PARAM + "=" + ENGLISH.toLanguageTag() + " should be part of the url",
webDriver.getCurrentUrl(), containsString(UI_LOCALES_PARAM + "=" + ENGLISH.toLanguageTag()));

logInAsUserInIDPForFirstTime();
updateAccountInformation();
assertUserCreatedInConsumerRealm();
}

static class UiLocalesEnabledConsumerRealmConfig implements RealmConfig {
@Override
public RealmBuilder configure(RealmBuilder realm) {
return configureConsumerRealm(realm,
createOidcIdentityProvider()
.attribute("uiLocales", "true"));
}
}
}
Loading
Loading
0