modules/keycloak-protocol-cas

matthiasp

2017-09-18 97fc5ea8d44b25210560c6251a2786e96a9a4e0c

commit \| author \| age
7f7e0c	1	package org.keycloak.protocol.cas;
MP	2
57a6c1	3	import org.apache.http.HttpEntity;
MP	4	import org.jboss.logging.Logger;
7f7e0c	5	import org.keycloak.common.util.KeycloakUriBuilder;
MP	6	import org.keycloak.events.EventBuilder;
	7	import org.keycloak.events.EventType;
4a6620	8	import org.keycloak.forms.login.LoginFormsProvider;
7f7e0c	9	import org.keycloak.models.*;
MP	10	import org.keycloak.protocol.LoginProtocol;
57a6c1	11	import org.keycloak.protocol.cas.utils.LogoutHelper;
7f7e0c	12	import org.keycloak.services.managers.ClientSessionCode;
MP	13	import org.keycloak.services.managers.ResourceAdminManager;
f75caf	14	import org.keycloak.sessions.AuthenticationSessionModel;
MP	15	import org.keycloak.sessions.CommonClientSessionModel;
7f7e0c	16
MP	17	import javax.ws.rs.core.HttpHeaders;
	18	import javax.ws.rs.core.Response;
	19	import javax.ws.rs.core.UriInfo;
57a6c1	20	import java.io.IOException;
7f7e0c	21	import java.net.URI;
MP	22
	23	public class CASLoginProtocol implements LoginProtocol {
57a6c1	24	private static final Logger logger = Logger.getLogger(CASLoginProtocol.class);
MP	25
7f7e0c	26	public static final String LOGIN_PROTOCOL = "cas";
MP	27
	28	public static final String SERVICE_PARAM = "service";
	29	public static final String RENEW_PARAM = "renew";
	30	public static final String GATEWAY_PARAM = "gateway";
	31	public static final String TICKET_PARAM = "ticket";
	32	public static final String FORMAT_PARAM = "format";
	33
	34	public static final String TICKET_RESPONSE_PARAM = "ticket";
	35
	36	public static final String SERVICE_TICKET_PREFIX = "ST-";
57a6c1	37	public static final String SESSION_SERVICE_TICKET = "service_ticket";
4a6620	38
MP	39	public static final String LOGOUT_REDIRECT_URI = "CAS_LOGOUT_REDIRECT_URI";
7f7e0c	40
MP	41	protected KeycloakSession session;
	42	protected RealmModel realm;
	43	protected UriInfo uriInfo;
	44	protected HttpHeaders headers;
	45	protected EventBuilder event;
	46
7124d2	47	public CASLoginProtocol(KeycloakSession session, RealmModel realm, UriInfo uriInfo, HttpHeaders headers, EventBuilder event) {
7f7e0c	48	this.session = session;
MP	49	this.realm = realm;
	50	this.uriInfo = uriInfo;
	51	this.headers = headers;
	52	this.event = event;
	53	}
	54
	55	public CASLoginProtocol() {
	56	}
	57
	58	@Override
	59	public CASLoginProtocol setSession(KeycloakSession session) {
	60	this.session = session;
	61	return this;
	62	}
	63
	64	@Override
	65	public CASLoginProtocol setRealm(RealmModel realm) {
	66	this.realm = realm;
	67	return this;
	68	}
	69
	70	@Override
	71	public CASLoginProtocol setUriInfo(UriInfo uriInfo) {
	72	this.uriInfo = uriInfo;
	73	return this;
	74	}
	75
	76	@Override
	77	public CASLoginProtocol setHttpHeaders(HttpHeaders headers) {
	78	this.headers = headers;
	79	return this;
	80	}
	81
	82	@Override
	83	public CASLoginProtocol setEventBuilder(EventBuilder event) {
	84	this.event = event;
	85	return this;
	86	}
	87
	88	@Override
f75caf	89	public Response authenticated(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
MP	90	ClientSessionCode<AuthenticatedClientSessionModel> accessCode = new ClientSessionCode<>(session, realm, clientSession);
7f7e0c	91
MP	92	String service = clientSession.getRedirectUri();
	93	//TODO validate service
f75caf	94	accessCode.setAction(CommonClientSessionModel.Action.CODE_TO_TOKEN.name());
7f7e0c	95	KeycloakUriBuilder uriBuilder = KeycloakUriBuilder.fromUri(service);
MP	96	uriBuilder.queryParam(TICKET_RESPONSE_PARAM, SERVICE_TICKET_PREFIX + accessCode.getCode());
	97
	98	URI redirectUri = uriBuilder.build();
	99
	100	Response.ResponseBuilder location = Response.status(302).location(redirectUri);
	101	return location.build();
	102	}
	103
	104	@Override
f75caf	105	public Response sendError(AuthenticationSessionModel authSession, Error error) {
7f7e0c	106	return Response.serverError().entity(error).build();
MP	107	}
	108
	109	@Override
f75caf	110	public void backchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
57a6c1	111	String logoutUrl = clientSession.getRedirectUri();
MP	112	String serviceTicket = clientSession.getNote(CASLoginProtocol.SESSION_SERVICE_TICKET);
	113	//check if session is fully authenticated (i.e. serviceValidate has been called)
	114	if (serviceTicket != null && !serviceTicket.isEmpty()) {
	115	sendSingleLogoutRequest(logoutUrl, serviceTicket);
	116	}
7f7e0c	117	ClientModel client = clientSession.getClient();
MP	118	new ResourceAdminManager(session).logoutClientSession(uriInfo.getRequestUri(), realm, client, clientSession);
	119	}
	120
57a6c1	121	private void sendSingleLogoutRequest(String logoutUrl, String serviceTicket) {
MP	122	HttpEntity requestEntity = LogoutHelper.buildSingleLogoutRequest(serviceTicket);
	123	try {
	124	LogoutHelper.postWithRedirect(session, logoutUrl, requestEntity);
	125	logger.debug("Sent CAS single logout for service " + logoutUrl);
	126	} catch (IOException e) {
	127	logger.warn("Failed to call CAS service for logout: " + logoutUrl, e);
	128	}
	129	}
	130
7f7e0c	131	@Override
f75caf	132	public Response frontchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
7f7e0c	133	// todo oidc redirect support
MP	134	throw new RuntimeException("NOT IMPLEMENTED");
	135	}
	136
	137	@Override
	138	public Response finishLogout(UserSessionModel userSession) {
4a6620	139	String redirectUri = userSession.getNote(CASLoginProtocol.LOGOUT_REDIRECT_URI);
MP	140
7f7e0c	141	event.event(EventType.LOGOUT);
MP	142	event.user(userSession.getUser()).session(userSession).success();
4a6620	143	LoginFormsProvider infoPage = session.getProvider(LoginFormsProvider.class).setSuccess("Logout successful");
MP	144	if (redirectUri != null) {
	145	infoPage.setAttribute("pageRedirectUri", redirectUri);
	146	} else {
	147	infoPage.setAttribute("skipLink", true);
	148	}
	149	return infoPage.createInfoPage();
7f7e0c	150	}
MP	151
	152	@Override
f75caf	153	public boolean requireReauthentication(UserSessionModel userSession, AuthenticationSessionModel authSession) {
MP	154	return "true".equals(authSession.getClientNote(CASLoginProtocol.RENEW_PARAM));
7f7e0c	155	}
MP	156
	157	@Override
	158	public void close() {
	159
	160	}
	161	}