modules/keycloak-protocol-cas

Jacek Kowalski

2019-11-18 019db5713e105f989255b99171d4bcf793f7f5ec

commit \| author \| age
7f7e0c	1	package org.keycloak.protocol.cas;
MP	2
57a6c1	3	import org.apache.http.HttpEntity;
MP	4	import org.jboss.logging.Logger;
7f7e0c	5	import org.keycloak.common.util.KeycloakUriBuilder;
c140ce	6	import org.keycloak.common.util.Time;
7f7e0c	7	import org.keycloak.events.EventBuilder;
MP	8	import org.keycloak.events.EventType;
4a6620	9	import org.keycloak.forms.login.LoginFormsProvider;
7f7e0c	10	import org.keycloak.models.*;
MP	11	import org.keycloak.protocol.LoginProtocol;
57a6c1	12	import org.keycloak.protocol.cas.utils.LogoutHelper;
c140ce	13	import org.keycloak.protocol.oidc.utils.OAuth2Code;
MP	14	import org.keycloak.protocol.oidc.utils.OAuth2CodeParser;
7f7e0c	15	import org.keycloak.services.managers.ResourceAdminManager;
f75caf	16	import org.keycloak.sessions.AuthenticationSessionModel;
7f7e0c	17
MP	18	import javax.ws.rs.core.HttpHeaders;
	19	import javax.ws.rs.core.Response;
	20	import javax.ws.rs.core.UriInfo;
57a6c1	21	import java.io.IOException;
7f7e0c	22	import java.net.URI;
c140ce	23	import java.util.UUID;
7f7e0c	24
MP	25	public class CASLoginProtocol implements LoginProtocol {
57a6c1	26	private static final Logger logger = Logger.getLogger(CASLoginProtocol.class);
MP	27
7f7e0c	28	public static final String LOGIN_PROTOCOL = "cas";
MP	29
	30	public static final String SERVICE_PARAM = "service";
74023a	31	public static final String TARGET_PARAM = "TARGET";
7f7e0c	32	public static final String RENEW_PARAM = "renew";
MP	33	public static final String GATEWAY_PARAM = "gateway";
	34	public static final String TICKET_PARAM = "ticket";
	35	public static final String FORMAT_PARAM = "format";
	36
	37	public static final String TICKET_RESPONSE_PARAM = "ticket";
	38
	39	public static final String SERVICE_TICKET_PREFIX = "ST-";
57a6c1	40	public static final String SESSION_SERVICE_TICKET = "service_ticket";
4a6620	41
MP	42	public static final String LOGOUT_REDIRECT_URI = "CAS_LOGOUT_REDIRECT_URI";
7f7e0c	43
MP	44	protected KeycloakSession session;
	45	protected RealmModel realm;
	46	protected UriInfo uriInfo;
	47	protected HttpHeaders headers;
	48	protected EventBuilder event;
	49
7124d2	50	public CASLoginProtocol(KeycloakSession session, RealmModel realm, UriInfo uriInfo, HttpHeaders headers, EventBuilder event) {
7f7e0c	51	this.session = session;
MP	52	this.realm = realm;
	53	this.uriInfo = uriInfo;
	54	this.headers = headers;
	55	this.event = event;
	56	}
	57
	58	public CASLoginProtocol() {
	59	}
	60
	61	@Override
	62	public CASLoginProtocol setSession(KeycloakSession session) {
	63	this.session = session;
	64	return this;
	65	}
	66
	67	@Override
	68	public CASLoginProtocol setRealm(RealmModel realm) {
	69	this.realm = realm;
	70	return this;
	71	}
	72
	73	@Override
	74	public CASLoginProtocol setUriInfo(UriInfo uriInfo) {
	75	this.uriInfo = uriInfo;
	76	return this;
	77	}
	78
	79	@Override
	80	public CASLoginProtocol setHttpHeaders(HttpHeaders headers) {
	81	this.headers = headers;
	82	return this;
	83	}
	84
	85	@Override
	86	public CASLoginProtocol setEventBuilder(EventBuilder event) {
	87	this.event = event;
	88	return this;
	89	}
	90
	91	@Override
c140ce	92	public Response authenticated(AuthenticationSessionModel authSession, UserSessionModel userSession, ClientSessionContext clientSessionCtx) {
b8d686	93	AuthenticatedClientSessionModel clientSession = clientSessionCtx.getClientSession();
7f7e0c	94
c140ce	95	String service = authSession.getRedirectUri();
7f7e0c	96	//TODO validate service
5570d4	97
c140ce	98	OAuth2Code codeData = new OAuth2Code(UUID.randomUUID(),
MP	99	Time.currentTime() + userSession.getRealm().getAccessCodeLifespan(),
	100	null, null, authSession.getRedirectUri(), null, null);
	101	String code = OAuth2CodeParser.persistCode(session, clientSession, codeData);
	102
7f7e0c	103	KeycloakUriBuilder uriBuilder = KeycloakUriBuilder.fromUri(service);
5570d4	104	uriBuilder.queryParam(TICKET_RESPONSE_PARAM, SERVICE_TICKET_PREFIX + code);
7f7e0c	105
MP	106	URI redirectUri = uriBuilder.build();
	107
	108	Response.ResponseBuilder location = Response.status(302).location(redirectUri);
	109	return location.build();
	110	}
	111
	112	@Override
f75caf	113	public Response sendError(AuthenticationSessionModel authSession, Error error) {
7f7e0c	114	return Response.serverError().entity(error).build();
MP	115	}
	116
	117	@Override
f75caf	118	public void backchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
57a6c1	119	String logoutUrl = clientSession.getRedirectUri();
MP	120	String serviceTicket = clientSession.getNote(CASLoginProtocol.SESSION_SERVICE_TICKET);
	121	//check if session is fully authenticated (i.e. serviceValidate has been called)
	122	if (serviceTicket != null && !serviceTicket.isEmpty()) {
	123	sendSingleLogoutRequest(logoutUrl, serviceTicket);
	124	}
7f7e0c	125	ClientModel client = clientSession.getClient();
019db5	126	new ResourceAdminManager(session).logoutClientSession(realm, client, clientSession);
7f7e0c	127	}
MP	128
57a6c1	129	private void sendSingleLogoutRequest(String logoutUrl, String serviceTicket) {
MP	130	HttpEntity requestEntity = LogoutHelper.buildSingleLogoutRequest(serviceTicket);
	131	try {
	132	LogoutHelper.postWithRedirect(session, logoutUrl, requestEntity);
	133	logger.debug("Sent CAS single logout for service " + logoutUrl);
	134	} catch (IOException e) {
	135	logger.warn("Failed to call CAS service for logout: " + logoutUrl, e);
	136	}
	137	}
	138
7f7e0c	139	@Override
f75caf	140	public Response frontchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
7f7e0c	141	// todo oidc redirect support
MP	142	throw new RuntimeException("NOT IMPLEMENTED");
	143	}
	144
	145	@Override
	146	public Response finishLogout(UserSessionModel userSession) {
4a6620	147	String redirectUri = userSession.getNote(CASLoginProtocol.LOGOUT_REDIRECT_URI);
MP	148
7f7e0c	149	event.event(EventType.LOGOUT);
MP	150	event.user(userSession.getUser()).session(userSession).success();
cbb2f2	151
4a6620	152	if (redirectUri != null) {
cbb2f2	153	return Response.status(302).location(URI.create(redirectUri)).build();
4a6620	154	} else {
cbb2f2	155	LoginFormsProvider infoPage = session.getProvider(LoginFormsProvider.class).setSuccess("Logout successful");
4a6620	156	infoPage.setAttribute("skipLink", true);
cbb2f2	157	return infoPage.createInfoPage();
4a6620	158	}
7f7e0c	159	}
MP	160
	161	@Override
f75caf	162	public boolean requireReauthentication(UserSessionModel userSession, AuthenticationSessionModel authSession) {
MP	163	return "true".equals(authSession.getClientNote(CASLoginProtocol.RENEW_PARAM));
7f7e0c	164	}
MP	165
	166	@Override
	167	public void close() {
	168
	169	}
	170	}