modules/keycloak-protocol-cas

Matthias Piepkorn

2017-01-29 7124d21d6c61cd510d93a888f53802de910f4d64

commit \| author \| age
7f7e0c	1	package org.keycloak.protocol.cas.endpoints;
MP	2
	3	import org.jboss.logging.Logger;
	4	import org.keycloak.events.Details;
	5	import org.keycloak.events.Errors;
	6	import org.keycloak.events.EventBuilder;
	7	import org.keycloak.events.EventType;
	8	import org.keycloak.models.ClientModel;
	9	import org.keycloak.models.ClientSessionModel;
	10	import org.keycloak.models.RealmModel;
	11	import org.keycloak.protocol.AuthorizationEndpointBase;
	12	import org.keycloak.protocol.cas.CASLoginProtocol;
	13	import org.keycloak.protocol.oidc.utils.RedirectUtils;
	14	import org.keycloak.services.ErrorPageException;
	15	import org.keycloak.services.messages.Messages;
	16	import org.keycloak.services.util.CacheControlUtil;
	17
	18	import javax.ws.rs.GET;
	19	import javax.ws.rs.core.MultivaluedMap;
	20	import javax.ws.rs.core.Response;
	21
	22	public class AuthorizationEndpoint extends AuthorizationEndpointBase {
	23	private static final Logger logger = Logger.getLogger(AuthorizationEndpoint.class);
	24
	25	private ClientModel client;
	26	private ClientSessionModel clientSession;
	27	private String redirectUri;
	28
	29	public AuthorizationEndpoint(RealmModel realm, EventBuilder event) {
	30	super(realm, event);
	31	event.event(EventType.LOGIN);
	32	}
	33
	34	@GET
	35	public Response build() {
	36	MultivaluedMap<String, String> params = uriInfo.getQueryParameters();
	37	String service = params.getFirst(CASLoginProtocol.SERVICE_PARAM);
7124d2	38	boolean renew = params.containsKey(CASLoginProtocol.RENEW_PARAM);
MP	39	boolean gateway = params.containsKey(CASLoginProtocol.GATEWAY_PARAM);
7f7e0c	40
MP	41	checkSsl();
	42	checkRealm();
	43	checkClient(service);
	44
	45	createClientSession();
	46	// So back button doesn't work
	47	CacheControlUtil.noBackButtonCacheControlHeader();
	48
7124d2	49	if (renew) {
MP	50	clientSession.setNote(CASLoginProtocol.RENEW_PARAM, "true");
	51	}
	52
7f7e0c	53	this.event.event(EventType.LOGIN);
7124d2	54	return handleBrowserAuthenticationRequest(clientSession, new CASLoginProtocol(session, realm, uriInfo, headers, event), gateway, false);
7f7e0c	55	}
MP	56
	57	private void checkSsl() {
	58	if (!uriInfo.getBaseUri().getScheme().equals("https") && realm.getSslRequired().isRequired(clientConnection)) {
	59	event.error(Errors.SSL_REQUIRED);
	60	throw new ErrorPageException(session, Messages.HTTPS_REQUIRED);
	61	}
	62	}
	63
	64	private void checkRealm() {
	65	if (!realm.isEnabled()) {
	66	event.error(Errors.REALM_DISABLED);
	67	throw new ErrorPageException(session, Messages.REALM_NOT_ENABLED);
	68	}
	69	}
	70
	71	private void checkClient(String service) {
	72	if (service == null) {
	73	event.error(Errors.INVALID_REQUEST);
	74	throw new ErrorPageException(session, Messages.MISSING_PARAMETER, CASLoginProtocol.SERVICE_PARAM);
	75	}
	76
	77	client = realm.getClients().stream()
	78	.filter(c -> CASLoginProtocol.LOGIN_PROTOCOL.equals(c.getProtocol()))
	79	.filter(c -> RedirectUtils.verifyRedirectUri(uriInfo, service, realm, c) != null)
	80	.findFirst().orElse(null);
	81	if (client == null) {
	82	event.error(Errors.CLIENT_NOT_FOUND);
	83	throw new ErrorPageException(session, Messages.CLIENT_NOT_FOUND);
	84	}
	85
	86	if (!client.isEnabled()) {
	87	event.error(Errors.CLIENT_DISABLED);
	88	throw new ErrorPageException(session, Messages.CLIENT_DISABLED);
	89	}
	90
	91	redirectUri = RedirectUtils.verifyRedirectUri(uriInfo, service, realm, client);
	92
	93	event.client(client.getClientId());
	94	event.detail(Details.REDIRECT_URI, redirectUri);
	95
	96	session.getContext().setClient(client);
	97	}
	98
	99	private void createClientSession() {
	100	clientSession = session.sessions().createClientSession(realm, client);
	101	clientSession.setAuthMethod(CASLoginProtocol.LOGIN_PROTOCOL);
	102	clientSession.setRedirectUri(redirectUri);
	103	clientSession.setAction(ClientSessionModel.Action.AUTHENTICATE.name());
	104	}
	105	}