modules/keycloak-protocol-cas

github-actions

2023-11-24 7a0fd4f18b8be71e41383349dd2a5117b56e9560

commit \| author \| age
7f7e0c	1	package org.keycloak.protocol.cas.endpoints;
MP	2
fdb9f6	3	import jakarta.ws.rs.GET;
JK	4	import jakarta.ws.rs.core.MultivaluedMap;
	5	import jakarta.ws.rs.core.Response;
7f7e0c	6	import org.jboss.logging.Logger;
MP	7	import org.keycloak.events.Details;
	8	import org.keycloak.events.Errors;
	9	import org.keycloak.events.EventBuilder;
	10	import org.keycloak.events.EventType;
	11	import org.keycloak.models.ClientModel;
58cce9	12	import org.keycloak.models.KeycloakSession;
7f7e0c	13	import org.keycloak.protocol.AuthorizationEndpointBase;
MP	14	import org.keycloak.protocol.cas.CASLoginProtocol;
	15	import org.keycloak.protocol.oidc.utils.RedirectUtils;
	16	import org.keycloak.services.ErrorPageException;
	17	import org.keycloak.services.messages.Messages;
	18	import org.keycloak.services.util.CacheControlUtil;
f75caf	19	import org.keycloak.sessions.AuthenticationSessionModel;
7f7e0c	20
MP	21	public class AuthorizationEndpoint extends AuthorizationEndpointBase {
	22	private static final Logger logger = Logger.getLogger(AuthorizationEndpoint.class);
	23
	24	private ClientModel client;
f75caf	25	private AuthenticationSessionModel authenticationSession;
7f7e0c	26	private String redirectUri;
MP	27
58cce9	28	public AuthorizationEndpoint(KeycloakSession session, EventBuilder event) {
G	29	super(session, event);
7f7e0c	30	event.event(EventType.LOGIN);
MP	31	}
	32
	33	@GET
	34	public Response build() {
dee145	35	MultivaluedMap<String, String> params = session.getContext().getUri().getQueryParameters();
7f7e0c	36	String service = params.getFirst(CASLoginProtocol.SERVICE_PARAM);
891484	37
DR	38	boolean isSaml11Request = false;
	39	if (service == null && params.containsKey(CASLoginProtocol.TARGET_PARAM)) {
	40	// SAML 1.1 authorization uses the TARGET parameter instead of service
	41	service = params.getFirst(CASLoginProtocol.TARGET_PARAM);
	42	isSaml11Request = true;
	43	}
7124d2	44	boolean renew = params.containsKey(CASLoginProtocol.RENEW_PARAM);
MP	45	boolean gateway = params.containsKey(CASLoginProtocol.GATEWAY_PARAM);
7f7e0c	46
MP	47	checkSsl();
	48	checkRealm();
	49	checkClient(service);
	50
6638b8	51	authenticationSession = createAuthenticationSession(client, null);
f75caf	52	updateAuthenticationSession();
MP	53
7f7e0c	54	// So back button doesn't work
58cce9	55	CacheControlUtil.noBackButtonCacheControlHeader(session);
7f7e0c	56
7124d2	57	if (renew) {
f75caf	58	authenticationSession.setClientNote(CASLoginProtocol.RENEW_PARAM, "true");
7124d2	59	}
3882f0	60	if (gateway) {
JK	61	authenticationSession.setClientNote(CASLoginProtocol.GATEWAY_PARAM, "true");
	62	}
891484	63	if (isSaml11Request) {
DR	64	// Flag the session so we can return the ticket as "SAMLart" in the response
	65	authenticationSession.setClientNote(CASLoginProtocol.TARGET_PARAM, "true");
	66	}
7124d2	67
7f7e0c	68	this.event.event(EventType.LOGIN);
dee145	69	return handleBrowserAuthenticationRequest(authenticationSession, new CASLoginProtocol(session, realm, session.getContext().getUri(), headers, event), gateway, false);
7f7e0c	70	}
MP	71
	72	private void checkClient(String service) {
	73	if (service == null) {
	74	event.error(Errors.INVALID_REQUEST);
6638b8	75	throw new ErrorPageException(session, Response.Status.BAD_REQUEST, Messages.MISSING_PARAMETER, CASLoginProtocol.SERVICE_PARAM);
7f7e0c	76	}
MP	77
b88dc3	78	event.detail(Details.REDIRECT_URI, service);
AP	79
ea9555	80	client = realm.getClientsStream()
7f7e0c	81	.filter(c -> CASLoginProtocol.LOGIN_PROTOCOL.equals(c.getProtocol()))
019db5	82	.filter(c -> RedirectUtils.verifyRedirectUri(session, service, c) != null)
7f7e0c	83	.findFirst().orElse(null);
MP	84	if (client == null) {
	85	event.error(Errors.CLIENT_NOT_FOUND);
6638b8	86	throw new ErrorPageException(session, Response.Status.BAD_REQUEST, Messages.CLIENT_NOT_FOUND);
7f7e0c	87	}
MP	88
	89	if (!client.isEnabled()) {
	90	event.error(Errors.CLIENT_DISABLED);
6638b8	91	throw new ErrorPageException(session, Response.Status.BAD_REQUEST, Messages.CLIENT_DISABLED);
7f7e0c	92	}
MP	93
019db5	94	redirectUri = RedirectUtils.verifyRedirectUri(session, service, client);
7f7e0c	95
MP	96	event.client(client.getClientId());
	97	event.detail(Details.REDIRECT_URI, redirectUri);
	98
	99	session.getContext().setClient(client);
	100	}
	101
f75caf	102	private void updateAuthenticationSession() {
MP	103	authenticationSession.setProtocol(CASLoginProtocol.LOGIN_PROTOCOL);
	104	authenticationSession.setRedirectUri(redirectUri);
	105	authenticationSession.setAction(AuthenticationSessionModel.Action.AUTHENTICATE.name());
7f7e0c	106	}
MP	107	}