Source:
public void testDenyScopeNotManagedByScopePolicy() throws Exception { ClientResource client = getClient(getRealm(), RESOURCE_SERVER_TEST); AuthorizationResource authorization = client.authorization(); JSPolicyRepresentation policy = new JSPolicyRepresentation(); policy.setName(KeycloakModelUtils.generateId()); policy.setCode("$evaluation.grant();"); authorization.policies().js().create(policy).close(); ResourceRepresentation resource = new ResourceRepresentation(); resource.setName(KeycloakModelUtils.generateId()); resource.addScope("sensors:view", "sensors:update", "sensors:delete"); try (Response response = authorization.resources().create(resource)) { resource = response.readEntity(ResourceRepresentation.class); } ScopePermissionRepresentation permission = new ScopePermissionRepresentation(); permission.setName(KeycloakModelUtils.generateId()); permission.addResource(resource.getId()); permission.addScope("sensors:view"); permission.addPolicy(policy.getName()); authorization.permissions().scope().create(permission).close(); String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken(); AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG); AuthorizationRequest request = new AuthorizationRequest(); request.addPermission(resource.getId(), "sensors:view"); AuthorizationResponse response = authzClient.authorization(accessToken).authorize(request); assertNotNull(response.getToken()); Collection<Permission> permissions = toAccessToken(response.getToken()).getAuthorization().getPermissions(); assertEquals(1, permissions.size()); for (Permission grantedPermission : permissions) { assertEquals(resource.getId(), grantedPermission.getResourceId()); assertEquals(1, grantedPermission.getScopes().size()); assertTrue(grantedPermission.getScopes().containsAll(Arrays.asList("sensors:view"))); } request = new AuthorizationRequest(); request.addPermission(resource.getId(), "sensors:update"); try { authzClient.authorization().authorize(request); fail("should fail, session invalidated"); } catch (AuthorizationDeniedException expected) { assertEquals(403, HttpResponseException.class.cast(expected.getCause()).getStatusCode()); } }

Target:
public void testDenyScopeNotManagedByScopePolicy() throws Exception { ClientResource client = getClient(getRealm(), RESOURCE_SERVER_TEST); AuthorizationResource authorization = client.authorization(); JSPolicyRepresentation policy = new JSPolicyRepresentation(); policy.setName(KeycloakModelUtils.generateId()); policy.setCode("$evaluation.grant();"); authorization.policies().js().create(policy).close(); ResourceRepresentation resource = new ResourceRepresentation(); resource.setName(KeycloakModelUtils.generateId()); resource.addScope("sensors:view", "sensors:update", "sensors:delete"); try (Response response = authorization.resources().create(resource)) { resource = response.readEntity(ResourceRepresentation.class); } ScopePermissionRepresentation permission = new ScopePermissionRepresentation(); permission.setName(KeycloakModelUtils.generateId()); permission.addResource(resource.getId()); permission.addScope("sensors:view"); permission.addPolicy(policy.getName()); authorization.permissions().scope().create(permission).close(); String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken(); AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG); AuthorizationRequest request = new AuthorizationRequest(); request.addPermission(resource.getId(), "sensors:view"); AuthorizationResponse response = authzClient.authorization(accessToken).authorize(request); assertNotNull(response.getToken()); Collection<Permission> permissions = toAccessToken(response.getToken()).getAuthorization().getPermissions(); assertEquals(1, permissions.size()); for (Permission grantedPermission : permissions) { assertEquals(resource.getId(), grantedPermission.getResourceId()); assertEquals(1, grantedPermission.getScopes().size()); assertThat(grantedPermission.getScopes(), hasItem("sensors:view")); } request = new AuthorizationRequest(); request.addPermission(resource.getId(), "sensors:update"); this.expectedException.expect(AuthorizationDeniedException.class); this.expectedException.expectCause(Matchers.allOf(Matchers.instanceOf(HttpResponseException.class), Matchers.hasProperty("statusCode", Matchers.is(403)))); this.expectedException.reportMissingExceptionWithMessage("should fail, session invalidated"); authzClient.authorization().authorize(request); }