mirror of https://github.com/jacekkow/keycloak-protocol-cas
view | history | commit | commitdiff
Jacek Kowalski
2023-11-24 8560e4a392962f6b1bdd40f444f091f6a36cdbd4
commit | author | age
7f7e0c 1 package org.keycloak.protocol.cas.endpoints;
MP 2
fdb9f6 3 import jakarta.ws.rs.GET;
JK 4 import jakarta.ws.rs.core.MultivaluedMap;
5 import jakarta.ws.rs.core.Response;
7f7e0c 6 import org.jboss.logging.Logger;
MP 7 import org.keycloak.events.Details;
8 import org.keycloak.events.Errors;
9 import org.keycloak.events.EventBuilder;
10 import org.keycloak.events.EventType;
11 import org.keycloak.models.ClientModel;
58cce9 12 import org.keycloak.models.KeycloakSession;
7f7e0c 13 import org.keycloak.protocol.AuthorizationEndpointBase;
MP 14 import org.keycloak.protocol.cas.CASLoginProtocol;
15 import org.keycloak.protocol.oidc.utils.RedirectUtils;
16 import org.keycloak.services.ErrorPageException;
17 import org.keycloak.services.messages.Messages;
18 import org.keycloak.services.util.CacheControlUtil;
f75caf 19 import org.keycloak.sessions.AuthenticationSessionModel;
7f7e0c 20
MP 21 public class AuthorizationEndpoint extends AuthorizationEndpointBase {
22     private static final Logger logger = Logger.getLogger(AuthorizationEndpoint.class);
23
24     private ClientModel client;
f75caf 25     private AuthenticationSessionModel authenticationSession;
7f7e0c 26     private String redirectUri;
MP 27
58cce9 28     public AuthorizationEndpoint(KeycloakSession session, EventBuilder event) {
G 29         super(session, event);
7f7e0c 30         event.event(EventType.LOGIN);
MP 31     }
32
33     @GET
34     public Response build() {
dee145 35         MultivaluedMap<String, String> params = session.getContext().getUri().getQueryParameters();
7f7e0c 36         String service = params.getFirst(CASLoginProtocol.SERVICE_PARAM);
891484 37
DR 38         boolean isSaml11Request = false;
39         if (service == null && params.containsKey(CASLoginProtocol.TARGET_PARAM)) {
40             // SAML 1.1 authorization uses the TARGET parameter instead of service
41             service = params.getFirst(CASLoginProtocol.TARGET_PARAM);
42             isSaml11Request = true;
43         }
7124d2 44         boolean renew = params.containsKey(CASLoginProtocol.RENEW_PARAM);
MP 45         boolean gateway = params.containsKey(CASLoginProtocol.GATEWAY_PARAM);
7f7e0c 46
MP 47         checkSsl();
48         checkRealm();
49         checkClient(service);
50
6638b8 51         authenticationSession = createAuthenticationSession(client, null);
f75caf 52         updateAuthenticationSession();
MP 53
7f7e0c 54         // So back button doesn't work
58cce9 55         CacheControlUtil.noBackButtonCacheControlHeader(session);
7f7e0c 56
7124d2 57         if (renew) {
f75caf 58             authenticationSession.setClientNote(CASLoginProtocol.RENEW_PARAM, "true");
7124d2 59         }
3882f0 60         if (gateway) {
JK 61             authenticationSession.setClientNote(CASLoginProtocol.GATEWAY_PARAM, "true");
62         }
891484 63         if (isSaml11Request) {
DR 64             // Flag the session so we can return the ticket as "SAMLart" in the response
65             authenticationSession.setClientNote(CASLoginProtocol.TARGET_PARAM, "true");
66         }
7124d2 67
7f7e0c 68         this.event.event(EventType.LOGIN);
dee145 69         return handleBrowserAuthenticationRequest(authenticationSession, new CASLoginProtocol(session, realm, session.getContext().getUri(), headers, event), gateway, false);
7f7e0c 70     }
MP 71
72     private void checkClient(String service) {
73         if (service == null) {
74             event.error(Errors.INVALID_REQUEST);
6638b8 75             throw new ErrorPageException(session, Response.Status.BAD_REQUEST, Messages.MISSING_PARAMETER, CASLoginProtocol.SERVICE_PARAM);
7f7e0c 76         }
MP 77
b88dc3 78         event.detail(Details.REDIRECT_URI, service);
AP 79
ea9555 80         client = realm.getClientsStream()
7f7e0c 81                 .filter(c -> CASLoginProtocol.LOGIN_PROTOCOL.equals(c.getProtocol()))
019db5 82                 .filter(c -> RedirectUtils.verifyRedirectUri(session, service, c) != null)
7f7e0c 83                 .findFirst().orElse(null);
MP 84         if (client == null) {
85             event.error(Errors.CLIENT_NOT_FOUND);
6638b8 86             throw new ErrorPageException(session, Response.Status.BAD_REQUEST, Messages.CLIENT_NOT_FOUND);
7f7e0c 87         }
MP 88
89         if (!client.isEnabled()) {
90             event.error(Errors.CLIENT_DISABLED);
6638b8 91             throw new ErrorPageException(session, Response.Status.BAD_REQUEST, Messages.CLIENT_DISABLED);
7f7e0c 92         }
MP 93
019db5 94         redirectUri = RedirectUtils.verifyRedirectUri(session, service, client);
7f7e0c 95
MP 96         event.client(client.getClientId());
97         event.detail(Details.REDIRECT_URI, redirectUri);
98
99         session.getContext().setClient(client);
100     }
101
f75caf 102     private void updateAuthenticationSession() {
MP 103         authenticationSession.setProtocol(CASLoginProtocol.LOGIN_PROTOCOL);
104         authenticationSession.setRedirectUri(redirectUri);
105         authenticationSession.setAction(AuthenticationSessionModel.Action.AUTHENTICATE.name());
7f7e0c 106     }
MP 107 }