Chapter 2. Getting started

Procedure

1. Log into the Admin Console.
2. Click Clients in the menu.

3. In the client listing, click the app-authz-vanilla client application. The Client Settings page opens.

   Client Settings

   

4. Click the Installation tab.

5. From the Format Option item list, select Keycloak OIDC JSON.

   The adapter configuration is displayed in JSON format.

6. Click Download.

   Adapter configuration

   

7. Move the file keycloak.json to the app-authz-jee-vanilla/config directory.

8. Optionally, specify a redirection URL.

   By default, the policy enforcer responds with a 403 status code when the user lacks permission to access protected resources on the resource server. However, you can also specify a redirection URL for unauthorized users. To specify a redirection URL, edit the keycloak.json file that you updated and replace the policy-enforcer configuration with the following:

   "policy-enforcer": {
       "on-deny-redirect-to" : "/app-authz-vanilla/error.jsp"
   }

   This change specifies to the policy enforcer to redirect users to a /app-authz-vanilla/error.jsp page if a user does not have the necessary permissions to access a protected resource, rather than an unhelpful 403 Unauthorized message.

Procedure

1. Log in as alice using the password you specified for that user. The following page is displayed:

   Hello World Authz main page

   

   The default settings defined by Red Hat Single Sign-On when you enable authorization services for a client application provide a simple policy that always grants access to the resources protected by this policy.

2. Change the default permissions and policies and test how your application responds. You could also create new policies using the different policy types provided by Red Hat Single Sign-On.

   You have many options to test this application. For example, you can change the default policy by clicking the Authorization tab for the client, then Policies tab, then click the Default Policy in the list to allow you to change it as follows:

   // The default value is $evaluation.grant(),
   // let's see what happens when we change it to $evaluation.deny()
   $evaluation.deny();

3. Log out of the demo application and log in again.

   You can no longer access the application.

   

4. Correct that problem by changing the Logic to Negative using the item list below the policy code text area.

   That re-enables access to the application as we are negating the result of that policy, which is by default denying all requests for access. Again, before testing this change, be sure to log out and log in again.