modules/keycloak-protocol-cas

Matthias Piepkorn

2017-01-29 57a6c100075987e88523d0334ccc444e0b652e55

commit \| author \| age
7f7e0c	1	package org.keycloak.protocol.cas;
MP	2
57a6c1	3	import org.apache.http.HttpEntity;
MP	4	import org.jboss.logging.Logger;
7f7e0c	5	import org.keycloak.common.util.KeycloakUriBuilder;
MP	6	import org.keycloak.events.EventBuilder;
	7	import org.keycloak.events.EventType;
	8	import org.keycloak.models.*;
	9	import org.keycloak.protocol.LoginProtocol;
57a6c1	10	import org.keycloak.protocol.cas.utils.LogoutHelper;
7f7e0c	11	import org.keycloak.services.managers.ClientSessionCode;
MP	12	import org.keycloak.services.managers.ResourceAdminManager;
	13
	14	import javax.ws.rs.core.HttpHeaders;
	15	import javax.ws.rs.core.Response;
	16	import javax.ws.rs.core.UriInfo;
57a6c1	17	import java.io.IOException;
7f7e0c	18	import java.net.URI;
MP	19
	20	public class CASLoginProtocol implements LoginProtocol {
57a6c1	21	private static final Logger logger = Logger.getLogger(CASLoginProtocol.class);
MP	22
7f7e0c	23	public static final String LOGIN_PROTOCOL = "cas";
MP	24
	25	public static final String SERVICE_PARAM = "service";
	26	public static final String RENEW_PARAM = "renew";
	27	public static final String GATEWAY_PARAM = "gateway";
	28	public static final String TICKET_PARAM = "ticket";
	29	public static final String FORMAT_PARAM = "format";
	30
	31	public static final String TICKET_RESPONSE_PARAM = "ticket";
	32
	33	public static final String SERVICE_TICKET_PREFIX = "ST-";
57a6c1	34	public static final String SESSION_SERVICE_TICKET = "service_ticket";
7f7e0c	35
MP	36	protected KeycloakSession session;
	37	protected RealmModel realm;
	38	protected UriInfo uriInfo;
	39	protected HttpHeaders headers;
	40	protected EventBuilder event;
	41
7124d2	42	public CASLoginProtocol(KeycloakSession session, RealmModel realm, UriInfo uriInfo, HttpHeaders headers, EventBuilder event) {
7f7e0c	43	this.session = session;
MP	44	this.realm = realm;
	45	this.uriInfo = uriInfo;
	46	this.headers = headers;
	47	this.event = event;
	48	}
	49
	50	public CASLoginProtocol() {
	51	}
	52
	53	@Override
	54	public CASLoginProtocol setSession(KeycloakSession session) {
	55	this.session = session;
	56	return this;
	57	}
	58
	59	@Override
	60	public CASLoginProtocol setRealm(RealmModel realm) {
	61	this.realm = realm;
	62	return this;
	63	}
	64
	65	@Override
	66	public CASLoginProtocol setUriInfo(UriInfo uriInfo) {
	67	this.uriInfo = uriInfo;
	68	return this;
	69	}
	70
	71	@Override
	72	public CASLoginProtocol setHttpHeaders(HttpHeaders headers) {
	73	this.headers = headers;
	74	return this;
	75	}
	76
	77	@Override
	78	public CASLoginProtocol setEventBuilder(EventBuilder event) {
	79	this.event = event;
	80	return this;
	81	}
	82
	83	@Override
	84	public Response authenticated(UserSessionModel userSession, ClientSessionCode accessCode) {
	85	ClientSessionModel clientSession = accessCode.getClientSession();
	86
	87	String service = clientSession.getRedirectUri();
	88	//TODO validate service
	89	accessCode.setAction(ClientSessionModel.Action.CODE_TO_TOKEN.name());
	90	KeycloakUriBuilder uriBuilder = KeycloakUriBuilder.fromUri(service);
	91	uriBuilder.queryParam(TICKET_RESPONSE_PARAM, SERVICE_TICKET_PREFIX + accessCode.getCode());
	92
	93	URI redirectUri = uriBuilder.build();
	94
	95	Response.ResponseBuilder location = Response.status(302).location(redirectUri);
	96	return location.build();
	97	}
	98
	99	@Override
	100	public Response sendError(ClientSessionModel clientSession, Error error) {
	101	return Response.serverError().entity(error).build();
	102	}
	103
	104	@Override
	105	public void backchannelLogout(UserSessionModel userSession, ClientSessionModel clientSession) {
57a6c1	106	String logoutUrl = clientSession.getRedirectUri();
MP	107	String serviceTicket = clientSession.getNote(CASLoginProtocol.SESSION_SERVICE_TICKET);
	108	//check if session is fully authenticated (i.e. serviceValidate has been called)
	109	if (serviceTicket != null && !serviceTicket.isEmpty()) {
	110	sendSingleLogoutRequest(logoutUrl, serviceTicket);
	111	}
7f7e0c	112	ClientModel client = clientSession.getClient();
MP	113	new ResourceAdminManager(session).logoutClientSession(uriInfo.getRequestUri(), realm, client, clientSession);
	114	}
	115
57a6c1	116	private void sendSingleLogoutRequest(String logoutUrl, String serviceTicket) {
MP	117	HttpEntity requestEntity = LogoutHelper.buildSingleLogoutRequest(serviceTicket);
	118	try {
	119	LogoutHelper.postWithRedirect(session, logoutUrl, requestEntity);
	120	logger.debug("Sent CAS single logout for service " + logoutUrl);
	121	} catch (IOException e) {
	122	logger.warn("Failed to call CAS service for logout: " + logoutUrl, e);
	123	}
	124	}
	125
7f7e0c	126	@Override
MP	127	public Response frontchannelLogout(UserSessionModel userSession, ClientSessionModel clientSession) {
	128	// todo oidc redirect support
	129	throw new RuntimeException("NOT IMPLEMENTED");
	130	}
	131
	132	@Override
	133	public Response finishLogout(UserSessionModel userSession) {
	134	event.event(EventType.LOGOUT);
	135	event.user(userSession.getUser()).session(userSession).success();
	136	return Response.ok().build();
	137	}
	138
	139	@Override
	140	public boolean requireReauthentication(UserSessionModel userSession, ClientSessionModel clientSession) {
7124d2	141	return "true".equals(clientSession.getNote(CASLoginProtocol.RENEW_PARAM));
7f7e0c	142	}
MP	143
	144	@Override
	145	public void close() {
	146
	147	}
	148	}