mirror of https://github.com/jacekkow/keycloak-protocol-cas

Updater Bot
2020-05-01 7224325967dae3bccb4a113f4a44da4b5965c56e
commit | author | age
7f7e0c 1 package org.keycloak.protocol.cas;
MP 2
57a6c1 3 import org.apache.http.HttpEntity;
MP 4 import org.jboss.logging.Logger;
7f7e0c 5 import org.keycloak.common.util.KeycloakUriBuilder;
c140ce 6 import org.keycloak.common.util.Time;
7f7e0c 7 import org.keycloak.events.EventBuilder;
MP 8 import org.keycloak.events.EventType;
4a6620 9 import org.keycloak.forms.login.LoginFormsProvider;
7f7e0c 10 import org.keycloak.models.*;
MP 11 import org.keycloak.protocol.LoginProtocol;
57a6c1 12 import org.keycloak.protocol.cas.utils.LogoutHelper;
c140ce 13 import org.keycloak.protocol.oidc.utils.OAuth2Code;
MP 14 import org.keycloak.protocol.oidc.utils.OAuth2CodeParser;
7f7e0c 15 import org.keycloak.services.managers.ResourceAdminManager;
f75caf 16 import org.keycloak.sessions.AuthenticationSessionModel;
7f7e0c 17
MP 18 import javax.ws.rs.core.HttpHeaders;
19 import javax.ws.rs.core.Response;
20 import javax.ws.rs.core.UriInfo;
57a6c1 21 import java.io.IOException;
7f7e0c 22 import java.net.URI;
c140ce 23 import java.util.UUID;
7f7e0c 24
MP 25 public class CASLoginProtocol implements LoginProtocol {
57a6c1 26     private static final Logger logger = Logger.getLogger(CASLoginProtocol.class);
MP 27
7f7e0c 28     public static final String LOGIN_PROTOCOL = "cas";
MP 29
30     public static final String SERVICE_PARAM = "service";
74023a 31     public static final String TARGET_PARAM = "TARGET";
7f7e0c 32     public static final String RENEW_PARAM = "renew";
MP 33     public static final String GATEWAY_PARAM = "gateway";
34     public static final String TICKET_PARAM = "ticket";
35     public static final String FORMAT_PARAM = "format";
36
37     public static final String TICKET_RESPONSE_PARAM = "ticket";
38
39     public static final String SERVICE_TICKET_PREFIX = "ST-";
57a6c1 40     public static final String SESSION_SERVICE_TICKET = "service_ticket";
4a6620 41
MP 42     public static final String LOGOUT_REDIRECT_URI = "CAS_LOGOUT_REDIRECT_URI";
7f7e0c 43
MP 44     protected KeycloakSession session;
45     protected RealmModel realm;
46     protected UriInfo uriInfo;
47     protected HttpHeaders headers;
48     protected EventBuilder event;
49
7124d2 50     public CASLoginProtocol(KeycloakSession session, RealmModel realm, UriInfo uriInfo, HttpHeaders headers, EventBuilder event) {
7f7e0c 51         this.session = session;
MP 52         this.realm = realm;
53         this.uriInfo = uriInfo;
54         this.headers = headers;
55         this.event = event;
56     }
57
58     public CASLoginProtocol() {
59     }
60
61     @Override
62     public CASLoginProtocol setSession(KeycloakSession session) {
63         this.session = session;
64         return this;
65     }
66
67     @Override
68     public CASLoginProtocol setRealm(RealmModel realm) {
69         this.realm = realm;
70         return this;
71     }
72
73     @Override
74     public CASLoginProtocol setUriInfo(UriInfo uriInfo) {
75         this.uriInfo = uriInfo;
76         return this;
77     }
78
79     @Override
80     public CASLoginProtocol setHttpHeaders(HttpHeaders headers) {
81         this.headers = headers;
82         return this;
83     }
84
85     @Override
86     public CASLoginProtocol setEventBuilder(EventBuilder event) {
87         this.event = event;
88         return this;
89     }
90
91     @Override
c140ce 92     public Response authenticated(AuthenticationSessionModel authSession, UserSessionModel userSession, ClientSessionContext clientSessionCtx) {
b8d686 93         AuthenticatedClientSessionModel clientSession = clientSessionCtx.getClientSession();
7f7e0c 94
c140ce 95         String service = authSession.getRedirectUri();
7f7e0c 96         //TODO validate service
5570d4 97
c140ce 98         OAuth2Code codeData = new OAuth2Code(UUID.randomUUID(),
MP 99                 Time.currentTime() + userSession.getRealm().getAccessCodeLifespan(),
100                 null, null, authSession.getRedirectUri(), null, null);
101         String code = OAuth2CodeParser.persistCode(session, clientSession, codeData);
102
7f7e0c 103         KeycloakUriBuilder uriBuilder = KeycloakUriBuilder.fromUri(service);
5570d4 104         uriBuilder.queryParam(TICKET_RESPONSE_PARAM, SERVICE_TICKET_PREFIX + code);
7f7e0c 105
MP 106         URI redirectUri = uriBuilder.build();
107
108         Response.ResponseBuilder location = Response.status(302).location(redirectUri);
109         return location.build();
110     }
111
112     @Override
f75caf 113     public Response sendError(AuthenticationSessionModel authSession, Error error) {
7f7e0c 114         return Response.serverError().entity(error).build();
MP 115     }
116
117     @Override
f75caf 118     public void backchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
57a6c1 119         String logoutUrl = clientSession.getRedirectUri();
MP 120         String serviceTicket = clientSession.getNote(CASLoginProtocol.SESSION_SERVICE_TICKET);
121         //check if session is fully authenticated (i.e. serviceValidate has been called)
122         if (serviceTicket != null && !serviceTicket.isEmpty()) {
123             sendSingleLogoutRequest(logoutUrl, serviceTicket);
124         }
7f7e0c 125         ClientModel client = clientSession.getClient();
019db5 126         new ResourceAdminManager(session).logoutClientSession(realm, client, clientSession);
7f7e0c 127     }
MP 128
57a6c1 129     private void sendSingleLogoutRequest(String logoutUrl, String serviceTicket) {
MP 130         HttpEntity requestEntity = LogoutHelper.buildSingleLogoutRequest(serviceTicket);
131         try {
132             LogoutHelper.postWithRedirect(session, logoutUrl, requestEntity);
133             logger.debug("Sent CAS single logout for service " + logoutUrl);
134         } catch (IOException e) {
135             logger.warn("Failed to call CAS service for logout: " + logoutUrl, e);
136         }
137     }
138
7f7e0c 139     @Override
f75caf 140     public Response frontchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
7f7e0c 141         // todo oidc redirect support
MP 142         throw new RuntimeException("NOT IMPLEMENTED");
143     }
144
145     @Override
146     public Response finishLogout(UserSessionModel userSession) {
4a6620 147         String redirectUri = userSession.getNote(CASLoginProtocol.LOGOUT_REDIRECT_URI);
MP 148
7f7e0c 149         event.event(EventType.LOGOUT);
MP 150         event.user(userSession.getUser()).session(userSession).success();
cbb2f2 151
4a6620 152         if (redirectUri != null) {
cbb2f2 153             return Response.status(302).location(URI.create(redirectUri)).build();
4a6620 154         } else {
cbb2f2 155             LoginFormsProvider infoPage = session.getProvider(LoginFormsProvider.class).setSuccess("Logout successful");
4a6620 156             infoPage.setAttribute("skipLink", true);
cbb2f2 157             return infoPage.createInfoPage();
4a6620 158         }
7f7e0c 159     }
MP 160
161     @Override
f75caf 162     public boolean requireReauthentication(UserSessionModel userSession, AuthenticationSessionModel authSession) {
MP 163         return "true".equals(authSession.getClientNote(CASLoginProtocol.RENEW_PARAM));
7f7e0c 164     }
MP 165
166     @Override
167     public void close() {
168
169     }
170 }