KeycloakEnvironmentInitializationFilter extends MultiUserEnvironmentInitializationFilter { @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws IOException, ServletException { try { super.doFilter(request, response, filterChain); } catch (MachineTokenJwtException mte) { filterChain.doFilter(request, response); } catch (JwtException e) { sendError(response, SC_UNAUTHORIZED, e.getMessage()); return; } } @Inject  KeycloakEnvironmentInitializationFilter(
      SessionStore sessionStore,
      JwtParser jwtParser,
      KeycloakUserManager userManager,
      KeycloakProfileRetriever keycloakProfileRetriever,
      RequestTokenExtractor tokenExtractor,
      PermissionChecker permissionChecker,
      KeycloakSettings settings); @Override void init(FilterConfig filterConfig); @Override void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain); @Override Subject extractSubject(String token); @Override void destroy();  }
@Test public void shouldSkipRequestsWithMachineTokens() throws Exception { when(tokenExtractor.getToken(any(HttpServletRequest.class))).thenReturn("not_null_token"); when(jwtParser.parseClaimsJws(anyString())).thenThrow(MachineTokenJwtException.class); filter.doFilter(request, response, chain); verify(chain).doFilter(eq(request), eq(response)); verifyNoMoreInteractions(userManager); }
@Test public void shouldThrowExceptionWhenNoEmailExistsAndUserDoesNotAlreadyExist() throws Exception { Map<String, Object> claimParams = new HashMap<>(); claimParams.put("preferred_username", "username"); Claims claims = new DefaultClaims(claimParams).setSubject("id2"); DefaultJws<Claims> jws = new DefaultJws<>(new DefaultJwsHeader(), claims, ""); when(tokenExtractor.getToken(any(HttpServletRequest.class))).thenReturn("token2"); when(jwtParser.parseClaimsJws(anyString())).thenReturn(jws); when(userManager.getById(anyString())).thenThrow(NotFoundException.class); filter.doFilter(request, response, chain); verify(response) .sendError( eq(401), eq("Unable to authenticate user because email address is not set in keycloak profile")); }
@Test public void shouldRetrieveTheEmailWhenItIsNotInJwtToken() throws Exception { Map<String, Object> claimParams = new HashMap<>(); claimParams.put("preferred_username", "username"); Claims claims = new DefaultClaims(claimParams).setSubject("id"); DefaultJws<Claims> jws = new DefaultJws<>(new DefaultJwsHeader(), claims, ""); UserImpl user = new UserImpl("id", "test@test.com", "username"); keycloakSettingsMap.put(KeycloakConstants.USERNAME_CLAIM_SETTING, "preferred_username"); when(tokenExtractor.getToken(any(HttpServletRequest.class))).thenReturn("token"); when(jwtParser.parseClaimsJws(anyString())).thenReturn(jws); when(userManager.getById(anyString())).thenThrow(NotFoundException.class); when(userManager.getOrCreateUser(anyString(), anyString(), anyString())).thenReturn(user); keycloakAttributes.put("email", "test@test.com"); try { filter.doFilter(request, response, chain); } catch (Exception e) { e.printStackTrace(); throw e; } verify(userManager).getOrCreateUser("id", "test@test.com", "username"); }