mirror of https://github.com/jacekkow/keycloak-protocol-cas
| commit | author | age | ||
| 33112b | 1 | #!/bin/bash |
| MP | 2 | set -e |
| 3 | ||
| de93e7 | 4 | keycloak_cas_url='http://localhost:8080/realms/master/protocol/cas' |
| 33112b | 5 | action_pattern='action="([^"]+)"' |
| MP | 6 | |
| 7 | get_ticket() { | |
| 3882f0 | 8 | local cookie_options="-b /tmp/cookies" |
| 9ed066 | 9 | local ticket_pattern='Location: .*\?ticket=(ST-[-A-Za-z0-9_.=]+)' |
| DR | 10 | local client_url_param=service |
| 11 | ||
| 3882f0 | 12 | if [ "$1" == "save_cookies" ]; then |
| JK | 13 | cookie_options="${cookie_options} -c /tmp/cookies" |
| 9ed066 | 14 | elif [ "$1" == "SAML" ]; then |
| DR | 15 | ticket_pattern='Location: .*\?SAMLart=(ST-[-A-Za-z0-9_.=]+)' |
| 16 | client_url_param=TARGET | |
| 3882f0 | 17 | fi |
| JK | 18 | |
| 9ed066 | 19 | local login_response=$(curl --fail --silent -c /tmp/cookies "${keycloak_cas_url}/login?${client_url_param}=http://localhost") |
| 3882f0 | 20 | if [[ ! ($login_response =~ $action_pattern) ]] ; then |
| 33112b | 21 | echo "Could not parse login form in response" |
| 3882f0 | 22 | echo "${login_response}" |
| 33112b | 23 | exit 1 |
| MP | 24 | fi |
| 25 | ||
| 3882f0 | 26 | local login_url=${BASH_REMATCH[1]//&/&} |
| JK | 27 | local redirect_response=$(curl --fail --silent -D - $cookie_options --data 'username=admin&password=admin' "$login_url") |
| 28 | if [[ ! ($redirect_response =~ $ticket_pattern) ]] ; then | |
| 33112b | 29 | echo "No service ticket found in response" |
| 3882f0 | 30 | echo "${redirect_response}" |
| 33112b | 31 | exit 1 |
| MP | 32 | fi |
| 33 | ||
| 3882f0 | 34 | echo "${BASH_REMATCH[1]}" |
| 33112b | 35 | } |
| MP | 36 | |
| 3882f0 | 37 | # CAS 1.0 |
| JK | 38 | ticket=$(get_ticket) |
| 39 | curl --fail --silent "${keycloak_cas_url}/validate?service=http://localhost&ticket=$ticket" | |
| 33112b | 40 | echo |
| MP | 41 | |
| 3882f0 | 42 | # CAS 2.0 |
| JK | 43 | ticket=$(get_ticket) |
| 44 | curl --fail --silent "${keycloak_cas_url}/serviceValidate?service=http://localhost&format=XML&ticket=$ticket" | |
| 33112b | 45 | echo |
| MP | 46 | |
| 3882f0 | 47 | ticket=$(get_ticket) |
| JK | 48 | curl --fail --silent "${keycloak_cas_url}/serviceValidate?service=http://localhost&format=JSON&ticket=$ticket" |
| 33112b | 49 | echo |
| MP | 50 | |
| 3882f0 | 51 | # CAS 3.0 |
| JK | 52 | ticket=$(get_ticket save_cookies) |
| 53 | curl --fail --silent "${keycloak_cas_url}/p3/serviceValidate?service=http://localhost&format=JSON&ticket=$ticket" | |
| 33112b | 54 | echo |
| 3882f0 | 55 | |
| 9ed066 | 56 | # SAML 1.1 |
| DR | 57 | ticket=$(get_ticket SAML) |
| 58 | timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ") | |
| 59 | saml_template=$(dirname "$0")/samlValidateTemplate.xml | |
| 60 | sed -e "s/CAS_TICKET/$ticket/g" -e "s/TIMESTAMP/$timestamp/g" "$saml_template" \ | |
| 61 | | curl --fail --silent -X POST -H "Content-Type: text/xml" \ | |
| 62 | -H "SOAPAction: http://www.oasis-open.org/committees/security" \ | |
| 63 | --data-binary @- "${keycloak_cas_url}/samlValidate?TARGET=http://localhost" | |
| 64 | echo | |
| 65 | ||
| 3882f0 | 66 | # CAS, gateway option |
| JK | 67 | get_ticket save_cookies |
| 68 | login_response=$(curl --fail --silent -D - -b /tmp/cookies "${keycloak_cas_url}/login?service=http://localhost&gateway=true") | |
| 69 | if echo "${login_response}" | grep '^Location: http://localhost\?ticket='; then | |
| 70 | echo "Gateway option did not redirect back to service with ticket" | |
| 71 | echo "${login_response}" | |
| 72 | exit 1 | |
| 73 | fi | |
| 74 | ||
| 75 | login_response=$(curl --fail --silent -D - "${keycloak_cas_url}/login?service=http://localhost&gateway=true") | |
| 76 | if echo "${login_response}" | grep '^Location: http://localhost$'; then | |
| 77 | echo "Gateway option did not redirect back to service without ticket" | |
| 78 | echo "${login_response}" | |
| 79 | exit 1 | |
| 80 | fi | |
