mirror of https://github.com/jacekkow/keycloak-protocol-cas

Matthias Piepkorn
2018-06-17 b8d686069c3249e4bd11eb5eef95f5bd51ea58fb
commit | author | age
7f7e0c 1 package org.keycloak.protocol.cas;
MP 2
57a6c1 3 import org.apache.http.HttpEntity;
MP 4 import org.jboss.logging.Logger;
7f7e0c 5 import org.keycloak.common.util.KeycloakUriBuilder;
MP 6 import org.keycloak.events.EventBuilder;
7 import org.keycloak.events.EventType;
4a6620 8 import org.keycloak.forms.login.LoginFormsProvider;
7f7e0c 9 import org.keycloak.models.*;
MP 10 import org.keycloak.protocol.LoginProtocol;
57a6c1 11 import org.keycloak.protocol.cas.utils.LogoutHelper;
7f7e0c 12 import org.keycloak.services.managers.ClientSessionCode;
MP 13 import org.keycloak.services.managers.ResourceAdminManager;
f75caf 14 import org.keycloak.sessions.AuthenticationSessionModel;
7f7e0c 15
MP 16 import javax.ws.rs.core.HttpHeaders;
17 import javax.ws.rs.core.Response;
18 import javax.ws.rs.core.UriInfo;
57a6c1 19 import java.io.IOException;
7f7e0c 20 import java.net.URI;
MP 21
22 public class CASLoginProtocol implements LoginProtocol {
57a6c1 23     private static final Logger logger = Logger.getLogger(CASLoginProtocol.class);
MP 24
7f7e0c 25     public static final String LOGIN_PROTOCOL = "cas";
MP 26
27     public static final String SERVICE_PARAM = "service";
28     public static final String RENEW_PARAM = "renew";
29     public static final String GATEWAY_PARAM = "gateway";
30     public static final String TICKET_PARAM = "ticket";
31     public static final String FORMAT_PARAM = "format";
32
33     public static final String TICKET_RESPONSE_PARAM = "ticket";
34
35     public static final String SERVICE_TICKET_PREFIX = "ST-";
57a6c1 36     public static final String SESSION_SERVICE_TICKET = "service_ticket";
4a6620 37
MP 38     public static final String LOGOUT_REDIRECT_URI = "CAS_LOGOUT_REDIRECT_URI";
7f7e0c 39
MP 40     protected KeycloakSession session;
41     protected RealmModel realm;
42     protected UriInfo uriInfo;
43     protected HttpHeaders headers;
44     protected EventBuilder event;
45
7124d2 46     public CASLoginProtocol(KeycloakSession session, RealmModel realm, UriInfo uriInfo, HttpHeaders headers, EventBuilder event) {
7f7e0c 47         this.session = session;
MP 48         this.realm = realm;
49         this.uriInfo = uriInfo;
50         this.headers = headers;
51         this.event = event;
52     }
53
54     public CASLoginProtocol() {
55     }
56
57     @Override
58     public CASLoginProtocol setSession(KeycloakSession session) {
59         this.session = session;
60         return this;
61     }
62
63     @Override
64     public CASLoginProtocol setRealm(RealmModel realm) {
65         this.realm = realm;
66         return this;
67     }
68
69     @Override
70     public CASLoginProtocol setUriInfo(UriInfo uriInfo) {
71         this.uriInfo = uriInfo;
72         return this;
73     }
74
75     @Override
76     public CASLoginProtocol setHttpHeaders(HttpHeaders headers) {
77         this.headers = headers;
78         return this;
79     }
80
81     @Override
82     public CASLoginProtocol setEventBuilder(EventBuilder event) {
83         this.event = event;
84         return this;
85     }
86
87     @Override
b8d686 88     public Response authenticated(UserSessionModel userSession, ClientSessionContext clientSessionCtx) {
MP 89         AuthenticatedClientSessionModel clientSession = clientSessionCtx.getClientSession();
f75caf 90         ClientSessionCode<AuthenticatedClientSessionModel> accessCode = new ClientSessionCode<>(session, realm, clientSession);
7f7e0c 91
MP 92         String service = clientSession.getRedirectUri();
93         //TODO validate service
5570d4 94
6638b8 95         String code = accessCode.getOrGenerateCode();
7f7e0c 96         KeycloakUriBuilder uriBuilder = KeycloakUriBuilder.fromUri(service);
5570d4 97         uriBuilder.queryParam(TICKET_RESPONSE_PARAM, SERVICE_TICKET_PREFIX + code);
7f7e0c 98
MP 99         URI redirectUri = uriBuilder.build();
100
101         Response.ResponseBuilder location = Response.status(302).location(redirectUri);
102         return location.build();
103     }
104
105     @Override
f75caf 106     public Response sendError(AuthenticationSessionModel authSession, Error error) {
7f7e0c 107         return Response.serverError().entity(error).build();
MP 108     }
109
110     @Override
f75caf 111     public void backchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
57a6c1 112         String logoutUrl = clientSession.getRedirectUri();
MP 113         String serviceTicket = clientSession.getNote(CASLoginProtocol.SESSION_SERVICE_TICKET);
114         //check if session is fully authenticated (i.e. serviceValidate has been called)
115         if (serviceTicket != null && !serviceTicket.isEmpty()) {
116             sendSingleLogoutRequest(logoutUrl, serviceTicket);
117         }
7f7e0c 118         ClientModel client = clientSession.getClient();
MP 119         new ResourceAdminManager(session).logoutClientSession(uriInfo.getRequestUri(), realm, client, clientSession);
120     }
121
57a6c1 122     private void sendSingleLogoutRequest(String logoutUrl, String serviceTicket) {
MP 123         HttpEntity requestEntity = LogoutHelper.buildSingleLogoutRequest(serviceTicket);
124         try {
125             LogoutHelper.postWithRedirect(session, logoutUrl, requestEntity);
126             logger.debug("Sent CAS single logout for service " + logoutUrl);
127         } catch (IOException e) {
128             logger.warn("Failed to call CAS service for logout: " + logoutUrl, e);
129         }
130     }
131
7f7e0c 132     @Override
f75caf 133     public Response frontchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
7f7e0c 134         // todo oidc redirect support
MP 135         throw new RuntimeException("NOT IMPLEMENTED");
136     }
137
138     @Override
139     public Response finishLogout(UserSessionModel userSession) {
4a6620 140         String redirectUri = userSession.getNote(CASLoginProtocol.LOGOUT_REDIRECT_URI);
MP 141
7f7e0c 142         event.event(EventType.LOGOUT);
MP 143         event.user(userSession.getUser()).session(userSession).success();
4a6620 144         LoginFormsProvider infoPage = session.getProvider(LoginFormsProvider.class).setSuccess("Logout successful");
MP 145         if (redirectUri != null) {
146             infoPage.setAttribute("pageRedirectUri", redirectUri);
147         } else {
148             infoPage.setAttribute("skipLink", true);
149         }
150         return infoPage.createInfoPage();
7f7e0c 151     }
MP 152
153     @Override
f75caf 154     public boolean requireReauthentication(UserSessionModel userSession, AuthenticationSessionModel authSession) {
MP 155         return "true".equals(authSession.getClientNote(CASLoginProtocol.RENEW_PARAM));
7f7e0c 156     }
MP 157
158     @Override
159     public void close() {
160
161     }
162 }