modules/keycloak-protocol-cas

Matthias Piepkorn

2017-11-14 1cf376b3768c36548320e52b0d08391d75833af0

commit \| author \| age
7f7e0c	1	package org.keycloak.protocol.cas;
MP	2
57a6c1	3	import org.apache.http.HttpEntity;
MP	4	import org.jboss.logging.Logger;
7f7e0c	5	import org.keycloak.common.util.KeycloakUriBuilder;
MP	6	import org.keycloak.events.EventBuilder;
	7	import org.keycloak.events.EventType;
4a6620	8	import org.keycloak.forms.login.LoginFormsProvider;
7f7e0c	9	import org.keycloak.models.*;
MP	10	import org.keycloak.protocol.LoginProtocol;
57a6c1	11	import org.keycloak.protocol.cas.utils.LogoutHelper;
7f7e0c	12	import org.keycloak.services.managers.ClientSessionCode;
MP	13	import org.keycloak.services.managers.ResourceAdminManager;
f75caf	14	import org.keycloak.sessions.AuthenticationSessionModel;
MP	15	import org.keycloak.sessions.CommonClientSessionModel;
7f7e0c	16
MP	17	import javax.ws.rs.core.HttpHeaders;
	18	import javax.ws.rs.core.Response;
	19	import javax.ws.rs.core.UriInfo;
57a6c1	20	import java.io.IOException;
5570d4	21	import java.lang.reflect.Method;
7f7e0c	22	import java.net.URI;
MP	23
	24	public class CASLoginProtocol implements LoginProtocol {
57a6c1	25	private static final Logger logger = Logger.getLogger(CASLoginProtocol.class);
MP	26
7f7e0c	27	public static final String LOGIN_PROTOCOL = "cas";
MP	28
	29	public static final String SERVICE_PARAM = "service";
	30	public static final String RENEW_PARAM = "renew";
	31	public static final String GATEWAY_PARAM = "gateway";
	32	public static final String TICKET_PARAM = "ticket";
	33	public static final String FORMAT_PARAM = "format";
	34
	35	public static final String TICKET_RESPONSE_PARAM = "ticket";
	36
	37	public static final String SERVICE_TICKET_PREFIX = "ST-";
57a6c1	38	public static final String SESSION_SERVICE_TICKET = "service_ticket";
4a6620	39
MP	40	public static final String LOGOUT_REDIRECT_URI = "CAS_LOGOUT_REDIRECT_URI";
7f7e0c	41
MP	42	protected KeycloakSession session;
	43	protected RealmModel realm;
	44	protected UriInfo uriInfo;
	45	protected HttpHeaders headers;
	46	protected EventBuilder event;
	47
7124d2	48	public CASLoginProtocol(KeycloakSession session, RealmModel realm, UriInfo uriInfo, HttpHeaders headers, EventBuilder event) {
7f7e0c	49	this.session = session;
MP	50	this.realm = realm;
	51	this.uriInfo = uriInfo;
	52	this.headers = headers;
	53	this.event = event;
	54	}
	55
	56	public CASLoginProtocol() {
	57	}
	58
	59	@Override
	60	public CASLoginProtocol setSession(KeycloakSession session) {
	61	this.session = session;
	62	return this;
	63	}
	64
	65	@Override
	66	public CASLoginProtocol setRealm(RealmModel realm) {
	67	this.realm = realm;
	68	return this;
	69	}
	70
	71	@Override
	72	public CASLoginProtocol setUriInfo(UriInfo uriInfo) {
	73	this.uriInfo = uriInfo;
	74	return this;
	75	}
	76
	77	@Override
	78	public CASLoginProtocol setHttpHeaders(HttpHeaders headers) {
	79	this.headers = headers;
	80	return this;
	81	}
	82
	83	@Override
	84	public CASLoginProtocol setEventBuilder(EventBuilder event) {
	85	this.event = event;
	86	return this;
	87	}
	88
	89	@Override
f75caf	90	public Response authenticated(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
MP	91	ClientSessionCode<AuthenticatedClientSessionModel> accessCode = new ClientSessionCode<>(session, realm, clientSession);
7f7e0c	92
MP	93	String service = clientSession.getRedirectUri();
	94	//TODO validate service
5570d4	95
MP	96	String code;
	97	try {
	98	// Keycloak >3.4 branch: Method getCode was renamed to getOrGenerateCode, CODE_TO_TOKEN was removed
	99	Method getOrGenerateCode = ClientSessionCode.class.getMethod("getOrGenerateCode");
	100	code = (String) getOrGenerateCode.invoke(accessCode);
	101	} catch (ReflectiveOperationException e) {
	102	// Keycloak <=3.3 branch
	103	accessCode.setAction(CommonClientSessionModel.Action.CODE_TO_TOKEN.name());
	104	code = accessCode.getCode();
	105	}
7f7e0c	106	KeycloakUriBuilder uriBuilder = KeycloakUriBuilder.fromUri(service);
5570d4	107	uriBuilder.queryParam(TICKET_RESPONSE_PARAM, SERVICE_TICKET_PREFIX + code);
7f7e0c	108
MP	109	URI redirectUri = uriBuilder.build();
	110
	111	Response.ResponseBuilder location = Response.status(302).location(redirectUri);
	112	return location.build();
	113	}
	114
	115	@Override
f75caf	116	public Response sendError(AuthenticationSessionModel authSession, Error error) {
7f7e0c	117	return Response.serverError().entity(error).build();
MP	118	}
	119
	120	@Override
f75caf	121	public void backchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
57a6c1	122	String logoutUrl = clientSession.getRedirectUri();
MP	123	String serviceTicket = clientSession.getNote(CASLoginProtocol.SESSION_SERVICE_TICKET);
	124	//check if session is fully authenticated (i.e. serviceValidate has been called)
	125	if (serviceTicket != null && !serviceTicket.isEmpty()) {
	126	sendSingleLogoutRequest(logoutUrl, serviceTicket);
	127	}
7f7e0c	128	ClientModel client = clientSession.getClient();
MP	129	new ResourceAdminManager(session).logoutClientSession(uriInfo.getRequestUri(), realm, client, clientSession);
	130	}
	131
57a6c1	132	private void sendSingleLogoutRequest(String logoutUrl, String serviceTicket) {
MP	133	HttpEntity requestEntity = LogoutHelper.buildSingleLogoutRequest(serviceTicket);
	134	try {
	135	LogoutHelper.postWithRedirect(session, logoutUrl, requestEntity);
	136	logger.debug("Sent CAS single logout for service " + logoutUrl);
	137	} catch (IOException e) {
	138	logger.warn("Failed to call CAS service for logout: " + logoutUrl, e);
	139	}
	140	}
	141
7f7e0c	142	@Override
f75caf	143	public Response frontchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
7f7e0c	144	// todo oidc redirect support
MP	145	throw new RuntimeException("NOT IMPLEMENTED");
	146	}
	147
	148	@Override
	149	public Response finishLogout(UserSessionModel userSession) {
4a6620	150	String redirectUri = userSession.getNote(CASLoginProtocol.LOGOUT_REDIRECT_URI);
MP	151
7f7e0c	152	event.event(EventType.LOGOUT);
MP	153	event.user(userSession.getUser()).session(userSession).success();
4a6620	154	LoginFormsProvider infoPage = session.getProvider(LoginFormsProvider.class).setSuccess("Logout successful");
MP	155	if (redirectUri != null) {
	156	infoPage.setAttribute("pageRedirectUri", redirectUri);
	157	} else {
	158	infoPage.setAttribute("skipLink", true);
	159	}
	160	return infoPage.createInfoPage();
7f7e0c	161	}
MP	162
	163	@Override
f75caf	164	public boolean requireReauthentication(UserSessionModel userSession, AuthenticationSessionModel authSession) {
MP	165	return "true".equals(authSession.getClientNote(CASLoginProtocol.RENEW_PARAM));
7f7e0c	166	}
MP	167
	168	@Override
	169	public void close() {
	170
	171	}
	172	}