mirror of https://github.com/jacekkow/keycloak-protocol-cas
| commit | author | age | ||
| 7f7e0c | 1 | package org.keycloak.protocol.cas; |
| MP | 2 | |
| 57a6c1 | 3 | import org.apache.http.HttpEntity; |
| MP | 4 | import org.jboss.logging.Logger; |
| 7f7e0c | 5 | import org.keycloak.common.util.KeycloakUriBuilder; |
| MP | 6 | import org.keycloak.events.EventBuilder; |
| 7 | import org.keycloak.events.EventType; | |
| 8 | import org.keycloak.models.*; | |
| 9 | import org.keycloak.protocol.LoginProtocol; | |
| 57a6c1 | 10 | import org.keycloak.protocol.cas.utils.LogoutHelper; |
| 7f7e0c | 11 | import org.keycloak.services.managers.ClientSessionCode; |
| MP | 12 | import org.keycloak.services.managers.ResourceAdminManager; |
| 13 | ||
| 14 | import javax.ws.rs.core.HttpHeaders; | |
| 15 | import javax.ws.rs.core.Response; | |
| 16 | import javax.ws.rs.core.UriInfo; | |
| 57a6c1 | 17 | import java.io.IOException; |
| 7f7e0c | 18 | import java.net.URI; |
| MP | 19 | |
| 20 | public class CASLoginProtocol implements LoginProtocol { | |
| 57a6c1 | 21 | private static final Logger logger = Logger.getLogger(CASLoginProtocol.class); |
| MP | 22 | |
| 7f7e0c | 23 | public static final String LOGIN_PROTOCOL = "cas"; |
| MP | 24 | |
| 25 | public static final String SERVICE_PARAM = "service"; | |
| 26 | public static final String RENEW_PARAM = "renew"; | |
| 27 | public static final String GATEWAY_PARAM = "gateway"; | |
| 28 | public static final String TICKET_PARAM = "ticket"; | |
| 29 | public static final String FORMAT_PARAM = "format"; | |
| 30 | ||
| 31 | public static final String TICKET_RESPONSE_PARAM = "ticket"; | |
| 32 | ||
| 33 | public static final String SERVICE_TICKET_PREFIX = "ST-"; | |
| 57a6c1 | 34 | public static final String SESSION_SERVICE_TICKET = "service_ticket"; |
| 7f7e0c | 35 | |
| MP | 36 | protected KeycloakSession session; |
| 37 | protected RealmModel realm; | |
| 38 | protected UriInfo uriInfo; | |
| 39 | protected HttpHeaders headers; | |
| 40 | protected EventBuilder event; | |
| 41 | ||
| 7124d2 | 42 | public CASLoginProtocol(KeycloakSession session, RealmModel realm, UriInfo uriInfo, HttpHeaders headers, EventBuilder event) { |
| 7f7e0c | 43 | this.session = session; |
| MP | 44 | this.realm = realm; |
| 45 | this.uriInfo = uriInfo; | |
| 46 | this.headers = headers; | |
| 47 | this.event = event; | |
| 48 | } | |
| 49 | ||
| 50 | public CASLoginProtocol() { | |
| 51 | } | |
| 52 | ||
| 53 | @Override | |
| 54 | public CASLoginProtocol setSession(KeycloakSession session) { | |
| 55 | this.session = session; | |
| 56 | return this; | |
| 57 | } | |
| 58 | ||
| 59 | @Override | |
| 60 | public CASLoginProtocol setRealm(RealmModel realm) { | |
| 61 | this.realm = realm; | |
| 62 | return this; | |
| 63 | } | |
| 64 | ||
| 65 | @Override | |
| 66 | public CASLoginProtocol setUriInfo(UriInfo uriInfo) { | |
| 67 | this.uriInfo = uriInfo; | |
| 68 | return this; | |
| 69 | } | |
| 70 | ||
| 71 | @Override | |
| 72 | public CASLoginProtocol setHttpHeaders(HttpHeaders headers) { | |
| 73 | this.headers = headers; | |
| 74 | return this; | |
| 75 | } | |
| 76 | ||
| 77 | @Override | |
| 78 | public CASLoginProtocol setEventBuilder(EventBuilder event) { | |
| 79 | this.event = event; | |
| 80 | return this; | |
| 81 | } | |
| 82 | ||
| 83 | @Override | |
| 84 | public Response authenticated(UserSessionModel userSession, ClientSessionCode accessCode) { | |
| 85 | ClientSessionModel clientSession = accessCode.getClientSession(); | |
| 86 | ||
| 87 | String service = clientSession.getRedirectUri(); | |
| 88 | //TODO validate service | |
| 89 | accessCode.setAction(ClientSessionModel.Action.CODE_TO_TOKEN.name()); | |
| 90 | KeycloakUriBuilder uriBuilder = KeycloakUriBuilder.fromUri(service); | |
| 91 | uriBuilder.queryParam(TICKET_RESPONSE_PARAM, SERVICE_TICKET_PREFIX + accessCode.getCode()); | |
| 92 | ||
| 93 | URI redirectUri = uriBuilder.build(); | |
| 94 | ||
| 95 | Response.ResponseBuilder location = Response.status(302).location(redirectUri); | |
| 96 | return location.build(); | |
| 97 | } | |
| 98 | ||
| 99 | @Override | |
| 100 | public Response sendError(ClientSessionModel clientSession, Error error) { | |
| 101 | return Response.serverError().entity(error).build(); | |
| 102 | } | |
| 103 | ||
| 104 | @Override | |
| 105 | public void backchannelLogout(UserSessionModel userSession, ClientSessionModel clientSession) { | |
| 57a6c1 | 106 | String logoutUrl = clientSession.getRedirectUri(); |
| MP | 107 | String serviceTicket = clientSession.getNote(CASLoginProtocol.SESSION_SERVICE_TICKET); |
| 108 | //check if session is fully authenticated (i.e. serviceValidate has been called) | |
| 109 | if (serviceTicket != null && !serviceTicket.isEmpty()) { | |
| 110 | sendSingleLogoutRequest(logoutUrl, serviceTicket); | |
| 111 | } | |
| 7f7e0c | 112 | ClientModel client = clientSession.getClient(); |
| MP | 113 | new ResourceAdminManager(session).logoutClientSession(uriInfo.getRequestUri(), realm, client, clientSession); |
| 114 | } | |
| 115 | ||
| 57a6c1 | 116 | private void sendSingleLogoutRequest(String logoutUrl, String serviceTicket) { |
| MP | 117 | HttpEntity requestEntity = LogoutHelper.buildSingleLogoutRequest(serviceTicket); |
| 118 | try { | |
| 119 | LogoutHelper.postWithRedirect(session, logoutUrl, requestEntity); | |
| 120 | logger.debug("Sent CAS single logout for service " + logoutUrl); | |
| 121 | } catch (IOException e) { | |
| 122 | logger.warn("Failed to call CAS service for logout: " + logoutUrl, e); | |
| 123 | } | |
| 124 | } | |
| 125 | ||
| 7f7e0c | 126 | @Override |
| MP | 127 | public Response frontchannelLogout(UserSessionModel userSession, ClientSessionModel clientSession) { |
| 128 | // todo oidc redirect support | |
| 129 | throw new RuntimeException("NOT IMPLEMENTED"); | |
| 130 | } | |
| 131 | ||
| 132 | @Override | |
| 133 | public Response finishLogout(UserSessionModel userSession) { | |
| 134 | event.event(EventType.LOGOUT); | |
| 135 | event.user(userSession.getUser()).session(userSession).success(); | |
| 136 | return Response.ok().build(); | |
| 137 | } | |
| 138 | ||
| 139 | @Override | |
| 140 | public boolean requireReauthentication(UserSessionModel userSession, ClientSessionModel clientSession) { | |
| 7124d2 | 141 | return "true".equals(clientSession.getNote(CASLoginProtocol.RENEW_PARAM)); |
| 7f7e0c | 142 | } |
| MP | 143 | |
| 144 | @Override | |
| 145 | public void close() { | |
| 146 | ||
| 147 | } | |
| 148 | } | |
