modules/keycloak-protocol-cas

github-actions

2022-03-23 9e4259e792eb25a23713d7a70a2d194d552371a1

commit \| author \| age
7f7e0c	1	package org.keycloak.protocol.cas;
MP	2
57a6c1	3	import org.apache.http.HttpEntity;
MP	4	import org.jboss.logging.Logger;
7f7e0c	5	import org.keycloak.common.util.KeycloakUriBuilder;
c140ce	6	import org.keycloak.common.util.Time;
7f7e0c	7	import org.keycloak.events.EventBuilder;
MP	8	import org.keycloak.events.EventType;
4a6620	9	import org.keycloak.forms.login.LoginFormsProvider;
7f7e0c	10	import org.keycloak.models.*;
MP	11	import org.keycloak.protocol.LoginProtocol;
57a6c1	12	import org.keycloak.protocol.cas.utils.LogoutHelper;
c140ce	13	import org.keycloak.protocol.oidc.utils.OAuth2Code;
MP	14	import org.keycloak.protocol.oidc.utils.OAuth2CodeParser;
3882f0	15	import org.keycloak.services.ErrorPage;
7f7e0c	16	import org.keycloak.services.managers.ResourceAdminManager;
f75caf	17	import org.keycloak.sessions.AuthenticationSessionModel;
7f7e0c	18
MP	19	import javax.ws.rs.core.HttpHeaders;
	20	import javax.ws.rs.core.Response;
	21	import javax.ws.rs.core.UriInfo;
57a6c1	22	import java.io.IOException;
7f7e0c	23	import java.net.URI;
c140ce	24	import java.util.UUID;
7f7e0c	25
MP	26	public class CASLoginProtocol implements LoginProtocol {
57a6c1	27	private static final Logger logger = Logger.getLogger(CASLoginProtocol.class);
MP	28
7f7e0c	29	public static final String LOGIN_PROTOCOL = "cas";
MP	30
	31	public static final String SERVICE_PARAM = "service";
74023a	32	public static final String TARGET_PARAM = "TARGET";
7f7e0c	33	public static final String RENEW_PARAM = "renew";
MP	34	public static final String GATEWAY_PARAM = "gateway";
	35	public static final String TICKET_PARAM = "ticket";
	36	public static final String FORMAT_PARAM = "format";
	37
	38	public static final String TICKET_RESPONSE_PARAM = "ticket";
	39
	40	public static final String SERVICE_TICKET_PREFIX = "ST-";
57a6c1	41	public static final String SESSION_SERVICE_TICKET = "service_ticket";
4a6620	42
MP	43	public static final String LOGOUT_REDIRECT_URI = "CAS_LOGOUT_REDIRECT_URI";
7f7e0c	44
MP	45	protected KeycloakSession session;
	46	protected RealmModel realm;
	47	protected UriInfo uriInfo;
	48	protected HttpHeaders headers;
	49	protected EventBuilder event;
	50
7124d2	51	public CASLoginProtocol(KeycloakSession session, RealmModel realm, UriInfo uriInfo, HttpHeaders headers, EventBuilder event) {
7f7e0c	52	this.session = session;
MP	53	this.realm = realm;
	54	this.uriInfo = uriInfo;
	55	this.headers = headers;
	56	this.event = event;
	57	}
	58
	59	public CASLoginProtocol() {
	60	}
	61
	62	@Override
	63	public CASLoginProtocol setSession(KeycloakSession session) {
	64	this.session = session;
	65	return this;
	66	}
	67
	68	@Override
	69	public CASLoginProtocol setRealm(RealmModel realm) {
	70	this.realm = realm;
	71	return this;
	72	}
	73
	74	@Override
	75	public CASLoginProtocol setUriInfo(UriInfo uriInfo) {
	76	this.uriInfo = uriInfo;
	77	return this;
	78	}
	79
	80	@Override
	81	public CASLoginProtocol setHttpHeaders(HttpHeaders headers) {
	82	this.headers = headers;
	83	return this;
	84	}
	85
	86	@Override
	87	public CASLoginProtocol setEventBuilder(EventBuilder event) {
	88	this.event = event;
	89	return this;
	90	}
	91
	92	@Override
c140ce	93	public Response authenticated(AuthenticationSessionModel authSession, UserSessionModel userSession, ClientSessionContext clientSessionCtx) {
b8d686	94	AuthenticatedClientSessionModel clientSession = clientSessionCtx.getClientSession();
7f7e0c	95
c140ce	96	String service = authSession.getRedirectUri();
7f7e0c	97	//TODO validate service
5570d4	98
c140ce	99	OAuth2Code codeData = new OAuth2Code(UUID.randomUUID(),
MP	100	Time.currentTime() + userSession.getRealm().getAccessCodeLifespan(),
	101	null, null, authSession.getRedirectUri(), null, null);
	102	String code = OAuth2CodeParser.persistCode(session, clientSession, codeData);
	103
7f7e0c	104	KeycloakUriBuilder uriBuilder = KeycloakUriBuilder.fromUri(service);
5570d4	105	uriBuilder.queryParam(TICKET_RESPONSE_PARAM, SERVICE_TICKET_PREFIX + code);
7f7e0c	106
MP	107	URI redirectUri = uriBuilder.build();
	108
	109	Response.ResponseBuilder location = Response.status(302).location(redirectUri);
	110	return location.build();
	111	}
	112
	113	@Override
f75caf	114	public Response sendError(AuthenticationSessionModel authSession, Error error) {
3882f0	115	if (authSession.getClientNotes().containsKey(CASLoginProtocol.GATEWAY_PARAM)) {
JK	116	if (error == Error.PASSIVE_INTERACTION_REQUIRED \|\| error == Error.PASSIVE_LOGIN_REQUIRED) {
	117	return Response.status(302).location(URI.create(authSession.getRedirectUri())).build();
	118	}
	119	}
	120	return ErrorPage.error(session, authSession, Response.Status.INTERNAL_SERVER_ERROR, error.name());
7f7e0c	121	}
MP	122
	123	@Override
0ec410	124	public Response backchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
57a6c1	125	String logoutUrl = clientSession.getRedirectUri();
MP	126	String serviceTicket = clientSession.getNote(CASLoginProtocol.SESSION_SERVICE_TICKET);
	127	//check if session is fully authenticated (i.e. serviceValidate has been called)
	128	if (serviceTicket != null && !serviceTicket.isEmpty()) {
	129	sendSingleLogoutRequest(logoutUrl, serviceTicket);
	130	}
7f7e0c	131	ClientModel client = clientSession.getClient();
019db5	132	new ResourceAdminManager(session).logoutClientSession(realm, client, clientSession);
0ec410	133	return Response.ok().build();
7f7e0c	134	}
MP	135
57a6c1	136	private void sendSingleLogoutRequest(String logoutUrl, String serviceTicket) {
MP	137	HttpEntity requestEntity = LogoutHelper.buildSingleLogoutRequest(serviceTicket);
	138	try {
	139	LogoutHelper.postWithRedirect(session, logoutUrl, requestEntity);
	140	logger.debug("Sent CAS single logout for service " + logoutUrl);
	141	} catch (IOException e) {
	142	logger.warn("Failed to call CAS service for logout: " + logoutUrl, e);
	143	}
	144	}
	145
7f7e0c	146	@Override
f75caf	147	public Response frontchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
7f7e0c	148	// todo oidc redirect support
MP	149	throw new RuntimeException("NOT IMPLEMENTED");
	150	}
	151
	152	@Override
	153	public Response finishLogout(UserSessionModel userSession) {
4a6620	154	String redirectUri = userSession.getNote(CASLoginProtocol.LOGOUT_REDIRECT_URI);
MP	155
7f7e0c	156	event.event(EventType.LOGOUT);
MP	157	event.user(userSession.getUser()).session(userSession).success();
cbb2f2	158
4a6620	159	if (redirectUri != null) {
cbb2f2	160	return Response.status(302).location(URI.create(redirectUri)).build();
4a6620	161	} else {
cbb2f2	162	LoginFormsProvider infoPage = session.getProvider(LoginFormsProvider.class).setSuccess("Logout successful");
4a6620	163	infoPage.setAttribute("skipLink", true);
cbb2f2	164	return infoPage.createInfoPage();
4a6620	165	}
7f7e0c	166	}
MP	167
	168	@Override
f75caf	169	public boolean requireReauthentication(UserSessionModel userSession, AuthenticationSessionModel authSession) {
MP	170	return "true".equals(authSession.getClientNote(CASLoginProtocol.RENEW_PARAM));
7f7e0c	171	}
MP	172
	173	@Override
	174	public void close() {
	175
	176	}
	177	}