mirror of https://github.com/jacekkow/keycloak-protocol-cas
| commit | author | age | ||
| 7f7e0c | 1 | package org.keycloak.protocol.cas.endpoints; |
| MP | 2 | |
| 3 | import org.jboss.logging.Logger; | |
| 4 | import org.keycloak.events.Details; | |
| 5 | import org.keycloak.events.Errors; | |
| 6 | import org.keycloak.events.EventBuilder; | |
| 7 | import org.keycloak.events.EventType; | |
| 8 | import org.keycloak.models.ClientModel; | |
| 9 | import org.keycloak.models.ClientSessionModel; | |
| 10 | import org.keycloak.models.RealmModel; | |
| 11 | import org.keycloak.protocol.AuthorizationEndpointBase; | |
| 12 | import org.keycloak.protocol.cas.CASLoginProtocol; | |
| 13 | import org.keycloak.protocol.oidc.utils.RedirectUtils; | |
| 14 | import org.keycloak.services.ErrorPageException; | |
| 15 | import org.keycloak.services.messages.Messages; | |
| 16 | import org.keycloak.services.util.CacheControlUtil; | |
| 17 | ||
| 18 | import javax.ws.rs.GET; | |
| 19 | import javax.ws.rs.core.MultivaluedMap; | |
| 20 | import javax.ws.rs.core.Response; | |
| 21 | ||
| 22 | public class AuthorizationEndpoint extends AuthorizationEndpointBase { | |
| 23 | private static final Logger logger = Logger.getLogger(AuthorizationEndpoint.class); | |
| 24 | ||
| 25 | private ClientModel client; | |
| 26 | private ClientSessionModel clientSession; | |
| 27 | private String redirectUri; | |
| 28 | ||
| 29 | public AuthorizationEndpoint(RealmModel realm, EventBuilder event) { | |
| 30 | super(realm, event); | |
| 31 | event.event(EventType.LOGIN); | |
| 32 | } | |
| 33 | ||
| 34 | @GET | |
| 35 | public Response build() { | |
| 36 | MultivaluedMap<String, String> params = uriInfo.getQueryParameters(); | |
| 37 | String service = params.getFirst(CASLoginProtocol.SERVICE_PARAM); | |
| 7124d2 | 38 | boolean renew = params.containsKey(CASLoginProtocol.RENEW_PARAM); |
| MP | 39 | boolean gateway = params.containsKey(CASLoginProtocol.GATEWAY_PARAM); |
| 7f7e0c | 40 | |
| MP | 41 | checkSsl(); |
| 42 | checkRealm(); | |
| 43 | checkClient(service); | |
| 44 | ||
| 45 | createClientSession(); | |
| 46 | // So back button doesn't work | |
| 47 | CacheControlUtil.noBackButtonCacheControlHeader(); | |
| 48 | ||
| 7124d2 | 49 | if (renew) { |
| MP | 50 | clientSession.setNote(CASLoginProtocol.RENEW_PARAM, "true"); |
| 51 | } | |
| 52 | ||
| 7f7e0c | 53 | this.event.event(EventType.LOGIN); |
| 7124d2 | 54 | return handleBrowserAuthenticationRequest(clientSession, new CASLoginProtocol(session, realm, uriInfo, headers, event), gateway, false); |
| 7f7e0c | 55 | } |
| MP | 56 | |
| 57 | private void checkSsl() { | |
| 58 | if (!uriInfo.getBaseUri().getScheme().equals("https") && realm.getSslRequired().isRequired(clientConnection)) { | |
| 59 | event.error(Errors.SSL_REQUIRED); | |
| 60 | throw new ErrorPageException(session, Messages.HTTPS_REQUIRED); | |
| 61 | } | |
| 62 | } | |
| 63 | ||
| 64 | private void checkRealm() { | |
| 65 | if (!realm.isEnabled()) { | |
| 66 | event.error(Errors.REALM_DISABLED); | |
| 67 | throw new ErrorPageException(session, Messages.REALM_NOT_ENABLED); | |
| 68 | } | |
| 69 | } | |
| 70 | ||
| 71 | private void checkClient(String service) { | |
| 72 | if (service == null) { | |
| 73 | event.error(Errors.INVALID_REQUEST); | |
| 74 | throw new ErrorPageException(session, Messages.MISSING_PARAMETER, CASLoginProtocol.SERVICE_PARAM); | |
| 75 | } | |
| 76 | ||
| 77 | client = realm.getClients().stream() | |
| 78 | .filter(c -> CASLoginProtocol.LOGIN_PROTOCOL.equals(c.getProtocol())) | |
| 79 | .filter(c -> RedirectUtils.verifyRedirectUri(uriInfo, service, realm, c) != null) | |
| 80 | .findFirst().orElse(null); | |
| 81 | if (client == null) { | |
| 82 | event.error(Errors.CLIENT_NOT_FOUND); | |
| 83 | throw new ErrorPageException(session, Messages.CLIENT_NOT_FOUND); | |
| 84 | } | |
| 85 | ||
| 86 | if (!client.isEnabled()) { | |
| 87 | event.error(Errors.CLIENT_DISABLED); | |
| 88 | throw new ErrorPageException(session, Messages.CLIENT_DISABLED); | |
| 89 | } | |
| 90 | ||
| 91 | redirectUri = RedirectUtils.verifyRedirectUri(uriInfo, service, realm, client); | |
| 92 | ||
| 93 | event.client(client.getClientId()); | |
| 94 | event.detail(Details.REDIRECT_URI, redirectUri); | |
| 95 | ||
| 96 | session.getContext().setClient(client); | |
| 97 | } | |
| 98 | ||
| 99 | private void createClientSession() { | |
| 100 | clientSession = session.sessions().createClientSession(realm, client); | |
| 101 | clientSession.setAuthMethod(CASLoginProtocol.LOGIN_PROTOCOL); | |
| 102 | clientSession.setRedirectUri(redirectUri); | |
| 103 | clientSession.setAction(ClientSessionModel.Action.AUTHENTICATE.name()); | |
| 104 | } | |
| 105 | } | |
