mirror of https://github.com/jacekkow/keycloak-protocol-cas
view | history | commit | commitdiff
Matthias Piepkorn
2017-02-05 5ba0b037031c3b1afc89a419d432c5f1d8748aa2
commit | author | age
7f7e0c 1 package org.keycloak.protocol.cas;
MP 2
57a6c1 3 import org.apache.http.HttpEntity;
MP 4 import org.jboss.logging.Logger;
7f7e0c 5 import org.keycloak.common.util.KeycloakUriBuilder;
MP 6 import org.keycloak.events.EventBuilder;
7 import org.keycloak.events.EventType;
8 import org.keycloak.models.*;
9 import org.keycloak.protocol.LoginProtocol;
57a6c1 10 import org.keycloak.protocol.cas.utils.LogoutHelper;
7f7e0c 11 import org.keycloak.services.managers.ClientSessionCode;
MP 12 import org.keycloak.services.managers.ResourceAdminManager;
13
14 import javax.ws.rs.core.HttpHeaders;
15 import javax.ws.rs.core.Response;
16 import javax.ws.rs.core.UriInfo;
57a6c1 17 import java.io.IOException;
7f7e0c 18 import java.net.URI;
MP 19
20 public class CASLoginProtocol implements LoginProtocol {
57a6c1 21     private static final Logger logger = Logger.getLogger(CASLoginProtocol.class);
MP 22
7f7e0c 23     public static final String LOGIN_PROTOCOL = "cas";
MP 24
25     public static final String SERVICE_PARAM = "service";
26     public static final String RENEW_PARAM = "renew";
27     public static final String GATEWAY_PARAM = "gateway";
28     public static final String TICKET_PARAM = "ticket";
29     public static final String FORMAT_PARAM = "format";
30
31     public static final String TICKET_RESPONSE_PARAM = "ticket";
32
33     public static final String SERVICE_TICKET_PREFIX = "ST-";
57a6c1 34     public static final String SESSION_SERVICE_TICKET = "service_ticket";
7f7e0c 35
MP 36     protected KeycloakSession session;
37     protected RealmModel realm;
38     protected UriInfo uriInfo;
39     protected HttpHeaders headers;
40     protected EventBuilder event;
41
7124d2 42     public CASLoginProtocol(KeycloakSession session, RealmModel realm, UriInfo uriInfo, HttpHeaders headers, EventBuilder event) {
7f7e0c 43         this.session = session;
MP 44         this.realm = realm;
45         this.uriInfo = uriInfo;
46         this.headers = headers;
47         this.event = event;
48     }
49
50     public CASLoginProtocol() {
51     }
52
53     @Override
54     public CASLoginProtocol setSession(KeycloakSession session) {
55         this.session = session;
56         return this;
57     }
58
59     @Override
60     public CASLoginProtocol setRealm(RealmModel realm) {
61         this.realm = realm;
62         return this;
63     }
64
65     @Override
66     public CASLoginProtocol setUriInfo(UriInfo uriInfo) {
67         this.uriInfo = uriInfo;
68         return this;
69     }
70
71     @Override
72     public CASLoginProtocol setHttpHeaders(HttpHeaders headers) {
73         this.headers = headers;
74         return this;
75     }
76
77     @Override
78     public CASLoginProtocol setEventBuilder(EventBuilder event) {
79         this.event = event;
80         return this;
81     }
82
83     @Override
84     public Response authenticated(UserSessionModel userSession, ClientSessionCode accessCode) {
85         ClientSessionModel clientSession = accessCode.getClientSession();
86
87         String service = clientSession.getRedirectUri();
88         //TODO validate service
89         accessCode.setAction(ClientSessionModel.Action.CODE_TO_TOKEN.name());
90         KeycloakUriBuilder uriBuilder = KeycloakUriBuilder.fromUri(service);
91         uriBuilder.queryParam(TICKET_RESPONSE_PARAM, SERVICE_TICKET_PREFIX + accessCode.getCode());
92
93         URI redirectUri = uriBuilder.build();
94
95         Response.ResponseBuilder location = Response.status(302).location(redirectUri);
96         return location.build();
97     }
98
99     @Override
100     public Response sendError(ClientSessionModel clientSession, Error error) {
101         return Response.serverError().entity(error).build();
102     }
103
104     @Override
105     public void backchannelLogout(UserSessionModel userSession, ClientSessionModel clientSession) {
57a6c1 106         String logoutUrl = clientSession.getRedirectUri();
MP 107         String serviceTicket = clientSession.getNote(CASLoginProtocol.SESSION_SERVICE_TICKET);
108         //check if session is fully authenticated (i.e. serviceValidate has been called)
109         if (serviceTicket != null && !serviceTicket.isEmpty()) {
110             sendSingleLogoutRequest(logoutUrl, serviceTicket);
111         }
7f7e0c 112         ClientModel client = clientSession.getClient();
MP 113         new ResourceAdminManager(session).logoutClientSession(uriInfo.getRequestUri(), realm, client, clientSession);
114     }
115
57a6c1 116     private void sendSingleLogoutRequest(String logoutUrl, String serviceTicket) {
MP 117         HttpEntity requestEntity = LogoutHelper.buildSingleLogoutRequest(serviceTicket);
118         try {
119             LogoutHelper.postWithRedirect(session, logoutUrl, requestEntity);
120             logger.debug("Sent CAS single logout for service " + logoutUrl);
121         } catch (IOException e) {
122             logger.warn("Failed to call CAS service for logout: " + logoutUrl, e);
123         }
124     }
125
7f7e0c 126     @Override
MP 127     public Response frontchannelLogout(UserSessionModel userSession, ClientSessionModel clientSession) {
128         // todo oidc redirect support
129         throw new RuntimeException("NOT IMPLEMENTED");
130     }
131
132     @Override
133     public Response finishLogout(UserSessionModel userSession) {
134         event.event(EventType.LOGOUT);
135         event.user(userSession.getUser()).session(userSession).success();
136         return Response.ok().build();
137     }
138
139     @Override
140     public boolean requireReauthentication(UserSessionModel userSession, ClientSessionModel clientSession) {
7124d2 141         return "true".equals(clientSession.getNote(CASLoginProtocol.RENEW_PARAM));
7f7e0c 142     }
MP 143
144     @Override
145     public void close() {
146
147     }
148 }