modules/keycloak-protocol-cas

Updater Bot

2018-09-28 46ceedd9b640a4b6a6817eab4b04e512b3bd3b76

commit \| author \| age
7f7e0c	1	package org.keycloak.protocol.cas;
MP	2
57a6c1	3	import org.apache.http.HttpEntity;
MP	4	import org.jboss.logging.Logger;
7f7e0c	5	import org.keycloak.common.util.KeycloakUriBuilder;
MP	6	import org.keycloak.events.EventBuilder;
	7	import org.keycloak.events.EventType;
4a6620	8	import org.keycloak.forms.login.LoginFormsProvider;
7f7e0c	9	import org.keycloak.models.*;
MP	10	import org.keycloak.protocol.LoginProtocol;
57a6c1	11	import org.keycloak.protocol.cas.utils.LogoutHelper;
7f7e0c	12	import org.keycloak.services.managers.ClientSessionCode;
MP	13	import org.keycloak.services.managers.ResourceAdminManager;
f75caf	14	import org.keycloak.sessions.AuthenticationSessionModel;
7f7e0c	15
MP	16	import javax.ws.rs.core.HttpHeaders;
	17	import javax.ws.rs.core.Response;
	18	import javax.ws.rs.core.UriInfo;
57a6c1	19	import java.io.IOException;
7f7e0c	20	import java.net.URI;
MP	21
	22	public class CASLoginProtocol implements LoginProtocol {
57a6c1	23	private static final Logger logger = Logger.getLogger(CASLoginProtocol.class);
MP	24
7f7e0c	25	public static final String LOGIN_PROTOCOL = "cas";
MP	26
	27	public static final String SERVICE_PARAM = "service";
	28	public static final String RENEW_PARAM = "renew";
	29	public static final String GATEWAY_PARAM = "gateway";
	30	public static final String TICKET_PARAM = "ticket";
	31	public static final String FORMAT_PARAM = "format";
	32
	33	public static final String TICKET_RESPONSE_PARAM = "ticket";
	34
	35	public static final String SERVICE_TICKET_PREFIX = "ST-";
57a6c1	36	public static final String SESSION_SERVICE_TICKET = "service_ticket";
4a6620	37
MP	38	public static final String LOGOUT_REDIRECT_URI = "CAS_LOGOUT_REDIRECT_URI";
7f7e0c	39
MP	40	protected KeycloakSession session;
	41	protected RealmModel realm;
	42	protected UriInfo uriInfo;
	43	protected HttpHeaders headers;
	44	protected EventBuilder event;
	45
7124d2	46	public CASLoginProtocol(KeycloakSession session, RealmModel realm, UriInfo uriInfo, HttpHeaders headers, EventBuilder event) {
7f7e0c	47	this.session = session;
MP	48	this.realm = realm;
	49	this.uriInfo = uriInfo;
	50	this.headers = headers;
	51	this.event = event;
	52	}
	53
	54	public CASLoginProtocol() {
	55	}
	56
	57	@Override
	58	public CASLoginProtocol setSession(KeycloakSession session) {
	59	this.session = session;
	60	return this;
	61	}
	62
	63	@Override
	64	public CASLoginProtocol setRealm(RealmModel realm) {
	65	this.realm = realm;
	66	return this;
	67	}
	68
	69	@Override
	70	public CASLoginProtocol setUriInfo(UriInfo uriInfo) {
	71	this.uriInfo = uriInfo;
	72	return this;
	73	}
	74
	75	@Override
	76	public CASLoginProtocol setHttpHeaders(HttpHeaders headers) {
	77	this.headers = headers;
	78	return this;
	79	}
	80
	81	@Override
	82	public CASLoginProtocol setEventBuilder(EventBuilder event) {
	83	this.event = event;
	84	return this;
	85	}
	86
	87	@Override
b8d686	88	public Response authenticated(UserSessionModel userSession, ClientSessionContext clientSessionCtx) {
MP	89	AuthenticatedClientSessionModel clientSession = clientSessionCtx.getClientSession();
f75caf	90	ClientSessionCode<AuthenticatedClientSessionModel> accessCode = new ClientSessionCode<>(session, realm, clientSession);
7f7e0c	91
MP	92	String service = clientSession.getRedirectUri();
	93	//TODO validate service
5570d4	94
6638b8	95	String code = accessCode.getOrGenerateCode();
7f7e0c	96	KeycloakUriBuilder uriBuilder = KeycloakUriBuilder.fromUri(service);
5570d4	97	uriBuilder.queryParam(TICKET_RESPONSE_PARAM, SERVICE_TICKET_PREFIX + code);
7f7e0c	98
MP	99	URI redirectUri = uriBuilder.build();
	100
	101	Response.ResponseBuilder location = Response.status(302).location(redirectUri);
	102	return location.build();
	103	}
	104
	105	@Override
f75caf	106	public Response sendError(AuthenticationSessionModel authSession, Error error) {
7f7e0c	107	return Response.serverError().entity(error).build();
MP	108	}
	109
	110	@Override
f75caf	111	public void backchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
57a6c1	112	String logoutUrl = clientSession.getRedirectUri();
MP	113	String serviceTicket = clientSession.getNote(CASLoginProtocol.SESSION_SERVICE_TICKET);
	114	//check if session is fully authenticated (i.e. serviceValidate has been called)
	115	if (serviceTicket != null && !serviceTicket.isEmpty()) {
	116	sendSingleLogoutRequest(logoutUrl, serviceTicket);
	117	}
7f7e0c	118	ClientModel client = clientSession.getClient();
MP	119	new ResourceAdminManager(session).logoutClientSession(uriInfo.getRequestUri(), realm, client, clientSession);
	120	}
	121
57a6c1	122	private void sendSingleLogoutRequest(String logoutUrl, String serviceTicket) {
MP	123	HttpEntity requestEntity = LogoutHelper.buildSingleLogoutRequest(serviceTicket);
	124	try {
	125	LogoutHelper.postWithRedirect(session, logoutUrl, requestEntity);
	126	logger.debug("Sent CAS single logout for service " + logoutUrl);
	127	} catch (IOException e) {
	128	logger.warn("Failed to call CAS service for logout: " + logoutUrl, e);
	129	}
	130	}
	131
7f7e0c	132	@Override
f75caf	133	public Response frontchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
7f7e0c	134	// todo oidc redirect support
MP	135	throw new RuntimeException("NOT IMPLEMENTED");
	136	}
	137
	138	@Override
	139	public Response finishLogout(UserSessionModel userSession) {
4a6620	140	String redirectUri = userSession.getNote(CASLoginProtocol.LOGOUT_REDIRECT_URI);
MP	141
7f7e0c	142	event.event(EventType.LOGOUT);
MP	143	event.user(userSession.getUser()).session(userSession).success();
4a6620	144	LoginFormsProvider infoPage = session.getProvider(LoginFormsProvider.class).setSuccess("Logout successful");
MP	145	if (redirectUri != null) {
	146	infoPage.setAttribute("pageRedirectUri", redirectUri);
	147	} else {
	148	infoPage.setAttribute("skipLink", true);
	149	}
	150	return infoPage.createInfoPage();
7f7e0c	151	}
MP	152
	153	@Override
f75caf	154	public boolean requireReauthentication(UserSessionModel userSession, AuthenticationSessionModel authSession) {
MP	155	return "true".equals(authSession.getClientNote(CASLoginProtocol.RENEW_PARAM));
7f7e0c	156	}
MP	157
	158	@Override
	159	public void close() {
	160
	161	}
	162	}