@Test public void changePassword() { changePasswordPage.open(); loginPage.login("test-user@localhost", "password"); changePasswordPage.changePassword("", "new-password", "new-password"); Assert.assertTrue(profilePage.isError()); changePasswordPage.changePassword("password", "new-password", "new-password2"); Assert.assertTrue(profilePage.isError()); changePasswordPage.changePassword("password", "new-password", "new-password"); Assert.assertTrue(profilePage.isSuccess()); changePasswordPage.logout(); loginPage.open(); loginPage.login("test-user@localhost", "password"); Assert.assertEquals("Invalid username or password.", loginPage.getError()); loginPage.open(); loginPage.login("test-user@localhost", "new-password"); Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType()); }
@Test public void changePassword() { changePasswordPage.open(); loginPage.login("test-user@localhost", "password"); Event event = events .expectLogin() .client("account") .detail(Details.REDIRECT_URI, ACCOUNT_REDIRECT + "?path=password") .assertEvent(); String sessionId = event.getSessionId(); String userId = event.getUserId(); changePasswordPage.changePassword("", "new-password", "new-password"); Assert.assertEquals("Please specify password.", profilePage.getError()); changePasswordPage.changePassword("password", "new-password", "new-password2"); Assert.assertEquals("Password confirmation doesn't match.", profilePage.getError()); changePasswordPage.changePassword("password", "new-password", "new-password"); Assert.assertEquals("Your password has been updated.", profilePage.getSuccess()); events.expectAccount(EventType.UPDATE_PASSWORD).assertEvent(); changePasswordPage.logout(); events .expectLogout(sessionId) .detail(Details.REDIRECT_URI, changePasswordPage.getPath()) .assertEvent(); loginPage.open(); loginPage.login("test-user@localhost", "password"); Assert.assertEquals("Invalid username or password.", loginPage.getError()); events .expectLogin() .session((String) null) .error("invalid_user_credentials") .removeDetail(Details.CONSENT) .assertEvent(); loginPage.open(); loginPage.login("test-user@localhost", "new-password"); Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType()); events.expectLogin().assertEvent(); }
@Test public void registerUserMissingPassword() { loginPage.open(); loginPage.clickRegister(); registerPage.assertCurrent(); registerPage.register( "firstName", "lastName", "registerUserMissingPassword@email", "registerUserMissingPassword", null, null); registerPage.assertCurrent(); assertEquals("Please specify password.", registerPage.getError()); events .expectRegister("registerUserMissingPassword", "registerUserMissingPassword@email") .removeDetail(Details.USERNAME) .removeDetail(Details.EMAIL) .user((String) null) .error("invalid_registration") .assertEvent(); }
@Test public void registerExistingUser() { loginPage.open(); loginPage.clickRegister(); registerPage.assertCurrent(); registerPage.register( "firstName", "lastName", "registerExistingUser@email", "test-user@localhost", "password", "password"); registerPage.assertCurrent(); assertEquals("Username already exists.", registerPage.getError()); // assert form keeps form fields on error assertEquals("firstName", registerPage.getFirstName()); assertEquals("lastName", registerPage.getLastName()); assertEquals("registerExistingUser@email", registerPage.getEmail()); assertEquals("", registerPage.getUsername()); assertEquals("", registerPage.getPassword()); assertEquals("", registerPage.getPasswordConfirm()); events .expectRegister("test-user@localhost", "registerExistingUser@email") .removeDetail(Details.EMAIL) .user((String) null) .error("username_in_use") .assertEvent(); }
@Test public void loginSuccess() { loginPage.open(); loginPage.login("test-user@localhost", "password"); Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType()); }
@Test public void registerUserSuccess_emailAsUsername() { configureRelamRegistrationEmailAsUsername(true); try { loginPage.open(); loginPage.clickRegister(); registerPage.assertCurrent(); registerPage.registerWithEmailAsUsername( "firstName", "lastName", "registerUserSuccessE@email", "password", "password"); assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType()); String userId = events .expectRegister("registerUserSuccessE@email", "registerUserSuccessE@email") .assertEvent() .getUserId(); events .expectLogin() .detail("username", "registerusersuccesse@email") .user(userId) .assertEvent(); UserModel user = getUser(userId); Assert.assertNotNull(user); Assert.assertNotNull(user.getCreatedTimestamp()); // test that timestamp is current with 10s tollerance Assert.assertTrue((System.currentTimeMillis() - user.getCreatedTimestamp()) < 10000); } finally { configureRelamRegistrationEmailAsUsername(false); } }
@Test public void registerUserManyErrors() { loginPage.open(); loginPage.clickRegister(); registerPage.assertCurrent(); registerPage.register(null, null, null, null, null, null); registerPage.assertCurrent(); assertEquals( "Please specify username.\n" + "Please specify first name.\n" + "Please specify last name.\n" + "Please specify email.\n" + "Please specify password.", registerPage.getError()); events .expectRegister(null, "registerUserMissingUsername@email") .removeDetail(Details.USERNAME) .removeDetail(Details.EMAIL) .error("invalid_registration") .assertEvent(); }
@Test public void resetPasswordWrongEmail() throws IOException, MessagingException, InterruptedException { loginPage.open(); loginPage.resetPassword(); resetPasswordPage.assertCurrent(); resetPasswordPage.changePassword("invalid"); resetPasswordPage.assertCurrent(); Assert.assertEquals( "You should receive an email shortly with further instructions.", resetPasswordPage.getSuccessMessage()); Thread.sleep(1000); Assert.assertEquals(0, greenMail.getReceivedMessages().length); events .expectRequiredAction(EventType.SEND_RESET_PASSWORD) .user((String) null) .session((String) null) .detail(Details.USERNAME, "invalid") .removeDetail(Details.EMAIL) .removeDetail(Details.CODE_ID) .error("user_not_found") .assertEvent(); }
@Test public void registerUserMissingOrInvalidEmail_emailAsUsername() { configureRelamRegistrationEmailAsUsername(true); try { loginPage.open(); loginPage.clickRegister(); registerPage.assertCurrent(); registerPage.registerWithEmailAsUsername( "firstName", "lastName", null, "password", "password"); registerPage.assertCurrent(); assertEquals("Please specify email.", registerPage.getError()); events .expectRegister(null, null) .removeDetail("username") .removeDetail("email") .error("invalid_registration") .assertEvent(); registerPage.registerWithEmailAsUsername( "firstName", "lastName", "registerUserInvalidEmailemail", "password", "password"); registerPage.assertCurrent(); assertEquals("Invalid email address.", registerPage.getError()); events .expectRegister("registerUserInvalidEmailemail", "registerUserInvalidEmailemail") .error("invalid_registration") .assertEvent(); } finally { configureRelamRegistrationEmailAsUsername(false); } }
@Test public void registerUserSuccess() { loginPage.open(); loginPage.clickRegister(); registerPage.assertCurrent(); registerPage.register( "firstName", "lastName", "registerUserSuccess@email", "registerUserSuccess", "password", "password"); assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType()); String userId = events .expectRegister("registerUserSuccess", "registerUserSuccess@email") .assertEvent() .getUserId(); events.expectLogin().detail("username", "registerusersuccess").user(userId).assertEvent(); UserModel user = getUser(userId); Assert.assertNotNull(user); Assert.assertNotNull(user.getCreatedTimestamp()); // test that timestamp is current with 10s tollerance Assert.assertTrue((System.currentTimeMillis() - user.getCreatedTimestamp()) < 10000); // test user info is set from form assertEquals("registerusersuccess", user.getUsername()); assertEquals("registerusersuccess@email", user.getEmail()); assertEquals("firstName", user.getFirstName()); assertEquals("lastName", user.getLastName()); }
@Test public void registerUserInvalidPasswordConfirm() { loginPage.open(); loginPage.clickRegister(); registerPage.assertCurrent(); registerPage.register( "firstName", "lastName", "registerUserInvalidPasswordConfirm@email", "registerUserInvalidPasswordConfirm", "password", "invalid"); registerPage.assertCurrent(); assertEquals("Password confirmation doesn't match.", registerPage.getError()); // assert form keeps form fields on error assertEquals("firstName", registerPage.getFirstName()); assertEquals("lastName", registerPage.getLastName()); assertEquals("registerUserInvalidPasswordConfirm@email", registerPage.getEmail()); assertEquals("registerUserInvalidPasswordConfirm", registerPage.getUsername()); assertEquals("", registerPage.getPassword()); assertEquals("", registerPage.getPasswordConfirm()); events .expectRegister( "registerUserInvalidPasswordConfirm", "registerUserInvalidPasswordConfirm@email") .removeDetail(Details.USERNAME) .removeDetail(Details.EMAIL) .user((String) null) .error("invalid_registration") .assertEvent(); }
private void loginSuccessAndLogout(String username, String password) { loginPage.open(); loginPage.login(username, password); Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType()); Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE)); oauth.openLogout(); }
@Test public void loginInvalidPassword() { loginPage.open(); loginPage.login("test-user@localhost", "invalid"); loginPage.assertCurrent(); Assert.assertEquals("Invalid username or password.", loginPage.getError()); }
@Test public void loginInvalidUsername() { loginPage.open(); loginPage.login("invalid", "password"); loginPage.assertCurrent(); Assert.assertEquals("Invalid username or password.", loginPage.getError()); }
@Test public void loginWithHotpSuccess() throws Exception { loginPage.open(); loginPage.login("test-user@localhost", "password"); Assert.assertTrue(loginTotpPage.isCurrent()); loginTotpPage.login(otp.generateHOTP("hotpSecret", counter++)); Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType()); events.expectLogin().assertEvent(); }
@Test public void resetPasswordCancel() throws IOException, MessagingException { loginPage.open(); loginPage.resetPassword(); resetPasswordPage.assertCurrent(); resetPasswordPage.changePassword("login-test"); resetPasswordPage.assertCurrent(); events .expectRequiredAction(EventType.SEND_RESET_PASSWORD) .user(userId) .detail(Details.USERNAME, "login-test") .detail(Details.EMAIL, "*****@*****.**") .assertEvent() .getSessionId(); resetPasswordPage.backToLogin(); Assert.assertTrue(loginPage.isCurrent()); loginPage.login("login-test", "password"); events.expectLogin().user(userId).detail(Details.USERNAME, "login-test").assertEvent(); Assert.assertEquals(1, greenMail.getReceivedMessages().length); MimeMessage message = greenMail.getReceivedMessages()[0]; String body = (String) message.getContent(); String changePasswordUrl = MailUtil.getLink(body); driver.navigate().to(changePasswordUrl.trim()); events .expect(EventType.RESET_PASSWORD_ERROR) .client((String) null) .user((String) null) .error("invalid_code") .clearDetails() .assertEvent(); Assert.assertTrue(errorPage.isCurrent()); Assert.assertEquals( "Unknown code, please login again through your application.", errorPage.getError()); }
@Test public void registerUserMissingEmail() { loginPage.open(); loginPage.clickRegister(); registerPage.assertCurrent(); registerPage.register( "firstName", "lastName", null, "registerUserMissingEmail", "password", "password"); registerPage.assertCurrent(); assertEquals("Please specify email.", registerPage.getError()); events .expectRegister("registerUserMissingEmail", null) .removeDetail("email") .error("invalid_registration") .assertEvent(); }
@Test public void loginWithHotpInvalidPassword() throws Exception { loginPage.open(); loginPage.login("test-user@localhost", "invalid"); Assert.assertTrue(loginPage.isCurrent()); Assert.assertEquals("Invalid username or password.", loginPage.getError()); events .expectLogin() .error("invalid_user_credentials") .session((String) null) .removeDetail(Details.CONSENT) .assertEvent(); }
@Test public void sessions() { loginPage.open(); loginPage.clickRegister(); registerPage.register( "view", "sessions", "view-sessions@localhost", "view-sessions", "password", "password"); Event registerEvent = events.expectRegister("view-sessions", "view-sessions@localhost").assertEvent(); String userId = registerEvent.getUserId(); events.expectLogin().user(userId).detail(Details.USERNAME, "view-sessions").assertEvent(); sessionsPage.open(); Assert.assertTrue(sessionsPage.isCurrent()); List<List<String>> sessions = sessionsPage.getSessions(); Assert.assertEquals(1, sessions.size()); Assert.assertEquals("127.0.0.1", sessions.get(0).get(0)); // Create second session WebDriver driver2 = WebRule.createWebDriver(); try { OAuthClient oauth2 = new OAuthClient(driver2); oauth2.state("mystate"); oauth2.doLogin("view-sessions", "password"); Event login2Event = events.expectLogin().user(userId).detail(Details.USERNAME, "view-sessions").assertEvent(); sessionsPage.open(); sessions = sessionsPage.getSessions(); Assert.assertEquals(2, sessions.size()); sessionsPage.logoutAll(); events.expectLogout(registerEvent.getSessionId()); events.expectLogout(login2Event.getSessionId()); } finally { driver2.close(); } }
@Test public void registerUserInvalidEmail() { loginPage.open(); loginPage.clickRegister(); registerPage.assertCurrent(); registerPage.register( "firstName", "lastName", "registerUserInvalidEmailemail", "registerUserInvalidEmail", "password", "password"); registerPage.assertCurrent(); assertEquals("registerUserInvalidEmailemail", registerPage.getEmail()); assertEquals("Invalid email address.", registerPage.getError()); events .expectRegister("registerUserInvalidEmail", "registerUserInvalidEmailemail") .error("invalid_registration") .assertEvent(); }
@Test public void loginWithHotpFailure() throws Exception { loginPage.open(); loginPage.login("test-user@localhost", "password"); Assert.assertTrue(loginTotpPage.isCurrent()); loginTotpPage.login("123456"); loginTotpPage.assertCurrent(); Assert.assertEquals("Invalid authenticator code.", loginPage.getError()); // loginPage.assertCurrent(); // Invalid authenticator code. // Assert.assertEquals("Invalid username or password.", loginPage.getError()); events .expectLogin() .error("invalid_user_credentials") .session((String) null) .removeDetail(Details.CONSENT) .assertEvent(); }
@Test public void registerExistingUser_emailAsUsername() { configureRelamRegistrationEmailAsUsername(true); try { loginPage.open(); loginPage.clickRegister(); registerPage.assertCurrent(); registerPage.registerWithEmailAsUsername( "firstName", "lastName", "test-user@localhost", "password", "password"); registerPage.assertCurrent(); assertEquals("Email already exists.", registerPage.getError()); events .expectRegister("test-user@localhost", "test-user@localhost") .user((String) null) .error("email_in_use") .assertEvent(); } finally { configureRelamRegistrationEmailAsUsername(false); } }
@Test public void registerPasswordPolicy() { keycloakRule.configure( new KeycloakRule.KeycloakSetup() { @Override public void config( RealmManager manager, RealmModel adminstrationRealm, RealmModel appRealm) { appRealm.setPasswordPolicy(new PasswordPolicy("length")); } }); try { loginPage.open(); loginPage.clickRegister(); registerPage.assertCurrent(); registerPage.register( "firstName", "lastName", "registerPasswordPolicy@email", "registerPasswordPolicy", "pass", "pass"); registerPage.assertCurrent(); assertEquals("Invalid password: minimum length 8.", registerPage.getError()); events .expectRegister("registerPasswordPolicy", "registerPasswordPolicy@email") .removeDetail(Details.USERNAME) .removeDetail(Details.EMAIL) .user((String) null) .error("invalid_registration") .assertEvent(); registerPage.register( "firstName", "lastName", "registerPasswordPolicy@email", "registerPasswordPolicy", "password", "password"); assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType()); String userId = events .expectRegister("registerPasswordPolicy", "registerPasswordPolicy@email") .assertEvent() .getUserId(); events .expectLogin() .user(userId) .detail(Details.USERNAME, "registerpasswordpolicy") .assertEvent(); } finally { keycloakRule.configure( new KeycloakRule.KeycloakSetup() { @Override public void config( RealmManager manager, RealmModel adminstrationRealm, RealmModel appRealm) { appRealm.setPasswordPolicy(new PasswordPolicy(null)); } }); } }
@Test public void resetPasswordWithPasswordPolicy() throws IOException, MessagingException { keycloakRule.update( new KeycloakRule.KeycloakSetup() { @Override public void config( RealmManager manager, RealmModel adminstrationRealm, RealmModel appRealm) { appRealm.setPasswordPolicy(new PasswordPolicy("length")); } }); loginPage.open(); loginPage.resetPassword(); resetPasswordPage.assertCurrent(); resetPasswordPage.changePassword("login-test"); resetPasswordPage.assertCurrent(); Assert.assertEquals( "You should receive an email shortly with further instructions.", resetPasswordPage.getSuccessMessage()); Assert.assertEquals(1, greenMail.getReceivedMessages().length); MimeMessage message = greenMail.getReceivedMessages()[0]; String body = (String) message.getContent(); String changePasswordUrl = MailUtil.getLink(body); String sessionId = events .expectRequiredAction(EventType.SEND_RESET_PASSWORD) .user(userId) .detail(Details.USERNAME, "login-test") .detail(Details.EMAIL, "*****@*****.**") .assertEvent() .getSessionId(); driver.navigate().to(changePasswordUrl.trim()); updatePasswordPage.assertCurrent(); updatePasswordPage.changePassword("invalid", "invalid"); Assert.assertEquals("Invalid password: minimum length 8", resetPasswordPage.getErrorMessage()); updatePasswordPage.changePassword( "resetPasswordWithPasswordPolicy", "resetPasswordWithPasswordPolicy"); events .expectRequiredAction(EventType.UPDATE_PASSWORD) .user(userId) .session(sessionId) .detail(Details.USERNAME, "login-test") .assertEvent(); Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType()); events .expectLogin() .user(userId) .detail(Details.USERNAME, "login-test") .session(sessionId) .assertEvent(); oauth.openLogout(); events.expectLogout(sessionId).user(userId).session(sessionId).assertEvent(); loginPage.open(); loginPage.login("login-test", "resetPasswordWithPasswordPolicy"); Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType()); events.expectLogin().user(userId).detail(Details.USERNAME, "login-test").assertEvent(); }
private void resetPassword(String username) throws IOException, MessagingException { loginPage.open(); loginPage.resetPassword(); resetPasswordPage.assertCurrent(); resetPasswordPage.changePassword(username); resetPasswordPage.assertCurrent(); String sessionId = events .expectRequiredAction(EventType.SEND_RESET_PASSWORD) .user(userId) .detail(Details.USERNAME, username) .detail(Details.EMAIL, "*****@*****.**") .assertEvent() .getSessionId(); Assert.assertEquals( "You should receive an email shortly with further instructions.", resetPasswordPage.getSuccessMessage()); Assert.assertEquals(1, greenMail.getReceivedMessages().length); MimeMessage message = greenMail.getReceivedMessages()[0]; String body = (String) message.getContent(); String changePasswordUrl = MailUtil.getLink(body); driver.navigate().to(changePasswordUrl.trim()); updatePasswordPage.assertCurrent(); updatePasswordPage.changePassword("resetPassword", "resetPassword"); events .expectRequiredAction(EventType.UPDATE_PASSWORD) .user(userId) .session(sessionId) .detail(Details.USERNAME, username) .assertEvent(); Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType()); events .expectLogin() .user(userId) .detail(Details.USERNAME, username) .session(sessionId) .assertEvent(); oauth.openLogout(); events.expectLogout(sessionId).user(userId).session(sessionId).assertEvent(); loginPage.open(); loginPage.login("login-test", "resetPassword"); events.expectLogin().user(userId).detail(Details.USERNAME, "login-test").assertEvent(); Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType()); }
@Test public void viewLog() { keycloakRule.update( new KeycloakSetup() { @Override public void config( RealmManager manager, RealmModel adminstrationRealm, RealmModel appRealm) { appRealm.setEventsEnabled(true); } }); try { List<Event> expectedEvents = new LinkedList<Event>(); loginPage.open(); loginPage.clickRegister(); registerPage.register( "view", "log", "view-log@localhost", "view-log", "password", "password"); expectedEvents.add(events.poll()); expectedEvents.add(events.poll()); profilePage.open(); profilePage.updateProfile("view", "log2", "view-log@localhost"); expectedEvents.add(events.poll()); logPage.open(); Assert.assertTrue(logPage.isCurrent()); List<List<String>> actualEvents = logPage.getEvents(); Assert.assertEquals(expectedEvents.size(), actualEvents.size()); for (Event e : expectedEvents) { boolean match = false; for (List<String> a : logPage.getEvents()) { if (e.getType().toString().replace('_', ' ').toLowerCase().equals(a.get(1)) && e.getIpAddress().equals(a.get(2)) && e.getClientId().equals(a.get(3))) { match = true; break; } } if (!match) { Assert.fail("Event not found " + e.getType()); } } } finally { keycloakRule.update( new KeycloakSetup() { @Override public void config( RealmManager manager, RealmModel adminstrationRealm, RealmModel appRealm) { appRealm.setEventsEnabled(false); } }); } }