mirror of https://github.com/jacekkow/keycloak-protocol-cas
view | history | commit | commitdiff
Jacek Kowalski
2024-06-21 fb26284c00e09e656732eb7ca4570afd052e0067
commit | author | age
74023a 1 package org.keycloak.protocol.cas.endpoints;
EH 2
fdb9f6 3 import jakarta.ws.rs.core.Response;
74023a 4 import org.jboss.logging.Logger;
b88dc3 5 import org.keycloak.events.Details;
74023a 6 import org.keycloak.events.Errors;
EH 7 import org.keycloak.events.EventBuilder;
5d7080 8 import org.keycloak.common.util.Time;
74023a 9 import org.keycloak.models.*;
EH 10 import org.keycloak.protocol.ProtocolMapper;
11 import org.keycloak.protocol.cas.CASLoginProtocol;
12 import org.keycloak.protocol.cas.mappers.CASAttributeMapper;
13 import org.keycloak.protocol.cas.representations.CASErrorCode;
14 import org.keycloak.protocol.cas.utils.CASValidationException;
5d7080 15 import org.keycloak.protocol.oidc.utils.OAuth2Code;
74023a 16 import org.keycloak.protocol.oidc.utils.RedirectUtils;
EH 17 import org.keycloak.services.managers.AuthenticationManager;
5d7080 18 import org.keycloak.services.managers.UserSessionCrossDCManager;
74023a 19 import org.keycloak.services.util.DefaultClientSessionContext;
EH 20
21 import java.util.HashMap;
22 import java.util.Map;
23 import java.util.Set;
5d7080 24 import java.util.UUID;
ARW 25 import java.util.regex.Pattern;
ea9555 26 import java.util.stream.Collectors;
5d7080 27 import org.apache.http.client.utils.URIBuilder;
ARW 28 import org.apache.http.client.methods.HttpGet;
29 import org.apache.http.HttpResponse;
30 import org.apache.http.impl.client.HttpClientBuilder;
74023a 31
EH 32 public abstract class AbstractValidateEndpoint {
33     protected final Logger logger = Logger.getLogger(getClass());
5d7080 34     private static final Pattern DOT = Pattern.compile("\\.");
74023a 35     protected KeycloakSession session;
EH 36     protected RealmModel realm;
37     protected EventBuilder event;
38     protected ClientModel client;
39     protected AuthenticatedClientSessionModel clientSession;
5d7080 40     protected String pgtIou;
74023a 41
ceed8f 42     public AbstractValidateEndpoint(KeycloakSession session, RealmModel realm, EventBuilder event) {
JK 43         this.session = session;
74023a 44         this.realm = realm;
EH 45         this.event = event;
46     }
47
48     protected void checkSsl() {
ceed8f 49         if (!session.getContext().getUri().getBaseUri().getScheme().equals("https") && realm.getSslRequired().isRequired(session.getContext().getConnection())) {
74023a 50             throw new CASValidationException(CASErrorCode.INVALID_REQUEST, "HTTPS required", Response.Status.FORBIDDEN);
EH 51         }
52     }
53
54     protected void checkRealm() {
55         if (!realm.isEnabled()) {
56             throw new CASValidationException(CASErrorCode.INTERNAL_ERROR, "Realm not enabled", Response.Status.FORBIDDEN);
57         }
58     }
59
60     protected void checkClient(String service) {
61         if (service == null) {
62             event.error(Errors.INVALID_REQUEST);
63             throw new CASValidationException(CASErrorCode.INVALID_REQUEST, "Missing parameter: " + CASLoginProtocol.SERVICE_PARAM, Response.Status.BAD_REQUEST);
64         }
65
b88dc3 66         event.detail(Details.REDIRECT_URI, service);
AP 67
ea9555 68         client = realm.getClientsStream()
74023a 69                 .filter(c -> CASLoginProtocol.LOGIN_PROTOCOL.equals(c.getProtocol()))
019db5 70                 .filter(c -> RedirectUtils.verifyRedirectUri(session, service, c) != null)
74023a 71                 .findFirst().orElse(null);
EH 72         if (client == null) {
73             event.error(Errors.CLIENT_NOT_FOUND);
74             throw new CASValidationException(CASErrorCode.INVALID_SERVICE, "Client not found", Response.Status.BAD_REQUEST);
75         }
76
77         if (!client.isEnabled()) {
78             event.error(Errors.CLIENT_DISABLED);
79             throw new CASValidationException(CASErrorCode.INVALID_SERVICE, "Client disabled", Response.Status.BAD_REQUEST);
80         }
81
82         event.client(client.getClientId());
83
84         session.getContext().setClient(client);
85     }
86
5d7080 87     protected void checkTicket(String ticket, String prefix, boolean requireReauth) {
74023a 88         if (ticket == null) {
EH 89             event.error(Errors.INVALID_CODE);
90             throw new CASValidationException(CASErrorCode.INVALID_REQUEST, "Missing parameter: " + CASLoginProtocol.TICKET_PARAM, Response.Status.BAD_REQUEST);
91         }
5d7080 92
ARW 93         if (!ticket.startsWith(prefix)) {
74023a 94             event.error(Errors.INVALID_CODE);
EH 95             throw new CASValidationException(CASErrorCode.INVALID_TICKET_SPEC, "Malformed service ticket", Response.Status.BAD_REQUEST);
96         }
97
508897 98         boolean isReusable = ticket.startsWith(CASLoginProtocol.PROXY_GRANTING_TICKET_PREFIX);
74023a 99
5d7080 100         String[] parsed = DOT.split(ticket.substring(prefix.length()), 3);
ARW 101         if (parsed.length != 3) {
74023a 102             event.error(Errors.INVALID_CODE);
5d7080 103             throw new CASValidationException(CASErrorCode.INVALID_TICKET_SPEC, "Invalid format of the code", Response.Status.BAD_REQUEST);
ARW 104         }
74023a 105
d270da 106         String codeUUID = parsed[0];
5d7080 107         String userSessionId = parsed[1];
ARW 108         String clientUUID = parsed[2];
109
110         event.detail(Details.CODE_ID, userSessionId);
111         event.session(userSessionId);
112
113         // Retrieve UserSession
114         UserSessionModel userSession = new UserSessionCrossDCManager(session).getUserSessionWithClient(realm, userSessionId, clientUUID);
115         if (userSession == null) {
116             // Needed to track if code is invalid
117             userSession = session.sessions().getUserSession(realm, userSessionId);
118             if (userSession == null) {
119                 event.error(Errors.USER_SESSION_NOT_FOUND);
fb2628 120                 throw new CASValidationException(CASErrorCode.INVALID_TICKET, "Code not valid", Response.Status.BAD_REQUEST);
74023a 121             }
5d7080 122         }
74023a 123
5d7080 124         clientSession = userSession.getAuthenticatedClientSessionByClient(clientUUID);
ARW 125         if (clientSession == null) {
fb2628 126             event.error(Errors.INVALID_CODE);
74023a 127             throw new CASValidationException(CASErrorCode.INVALID_TICKET, "Code not valid", Response.Status.BAD_REQUEST);
EH 128         }
129
5d7080 130         SingleUseObjectProvider codeStore = session.singleUseObjects();
508897 131         Map<String, String> codeDataSerialized = isReusable ? codeStore.get(prefix + codeUUID) : codeStore.remove(prefix + codeUUID);
74023a 132
5d7080 133         // Either code not available
ARW 134         if (codeDataSerialized == null) {
fb2628 135             event.error(Errors.INVALID_CODE);
JK 136             throw new CASValidationException(CASErrorCode.INVALID_TICKET, "Code not valid", Response.Status.BAD_REQUEST);
5d7080 137         }
ARW 138
139         OAuth2Code codeData = OAuth2Code.deserializeCode(codeDataSerialized);
140
141         String persistedUserSessionId = codeData.getUserSessionId();
142         if (!userSessionId.equals(persistedUserSessionId)) {
fb2628 143             event.error(Errors.INVALID_CODE);
JK 144             throw new CASValidationException(CASErrorCode.INVALID_TICKET, "Code not valid", Response.Status.BAD_REQUEST);
5d7080 145         }
ARW 146
147         // Finally doublecheck if code is not expired
148         int currentTime = Time.currentTime();
149         if (currentTime > codeData.getExpiration()) {
74023a 150             event.error(Errors.EXPIRED_CODE);
EH 151             throw new CASValidationException(CASErrorCode.INVALID_TICKET, "Code is expired", Response.Status.BAD_REQUEST);
152         }
153
5d7080 154         clientSession.setNote(prefix, ticket);
74023a 155
EH 156         if (requireReauth && AuthenticationManager.isSSOAuthentication(clientSession)) {
157             event.error(Errors.SESSION_EXPIRED);
158             throw new CASValidationException(CASErrorCode.INVALID_TICKET, "Interactive authentication was requested but not performed", Response.Status.BAD_REQUEST);
159         }
160
161         UserModel user = userSession.getUser();
162         if (user == null) {
163             event.error(Errors.USER_NOT_FOUND);
164             throw new CASValidationException(CASErrorCode.INVALID_TICKET, "User not found", Response.Status.BAD_REQUEST);
165         }
166         if (!user.isEnabled()) {
167             event.error(Errors.USER_DISABLED);
168             throw new CASValidationException(CASErrorCode.INVALID_TICKET, "User disabled", Response.Status.BAD_REQUEST);
169         }
170
171         event.user(userSession.getUser());
172         event.session(userSession.getId());
173
5d7080 174         if (client == null) {
ARW 175             client = clientSession.getClient();
176         } else {
177             if (!client.getClientId().equals(clientSession.getClient().getClientId())) {
178                 event.error(Errors.INVALID_CODE);
fb2628 179                 throw new CASValidationException(CASErrorCode.INVALID_SERVICE, "Invalid service", Response.Status.BAD_REQUEST);
5d7080 180             }
74023a 181         }
EH 182
183         if (!AuthenticationManager.isSessionValid(realm, userSession)) {
184             event.error(Errors.USER_SESSION_NOT_FOUND);
185             throw new CASValidationException(CASErrorCode.INVALID_TICKET, "Session not active", Response.Status.BAD_REQUEST);
5d7080 186         }
ARW 187
188     }
189
190     protected void createProxyGrant(String pgtUrl) {
191         if ( RedirectUtils.verifyRedirectUri(session, pgtUrl, client) == null ) {
192             event.error(Errors.INVALID_REQUEST);
193             throw new CASValidationException(CASErrorCode.INVALID_PROXY_CALLBACK, "Proxy callback is invalid", Response.Status.BAD_REQUEST);
194         }
195
196         String pgtIou = getPGTIOU();
197         String pgtId  = getPGT(session, clientSession, pgtUrl);
198
199         try {
200             HttpResponse response = HttpClientBuilder.create().build().execute(
201                 new HttpGet(new URIBuilder(pgtUrl).setParameter("pgtIou",pgtIou).setParameter("pgtId",pgtId).build())
202             );
203
204             if (response.getStatusLine().getStatusCode() != 200) {
205                 throw new Exception();
206             }
207
208             this.pgtIou = pgtIou;
209         } catch (Exception e) {
210             event.error(Errors.INVALID_REQUEST);
fb2628 211             throw new CASValidationException(CASErrorCode.PROXY_CALLBACK_ERROR, "Proxy callback returned an error", Response.Status.BAD_REQUEST);
74023a 212         }
EH 213     }
214
215     protected Map<String, Object> getUserAttributes() {
216         UserSessionModel userSession = clientSession.getUserSession();
217         // CAS protocol does not support scopes, so pass null scopeParam
8379a3 218         ClientSessionContext clientSessionCtx = DefaultClientSessionContext.fromClientSessionAndScopeParameter(clientSession, null, session);
74023a 219
ea9555 220         Set<ProtocolMapperModel> mappings = clientSessionCtx.getProtocolMappersStream().collect(Collectors.toSet());
74023a 221         KeycloakSessionFactory sessionFactory = session.getKeycloakSessionFactory();
EH 222         Map<String, Object> attributes = new HashMap<>();
223         for (ProtocolMapperModel mapping : mappings) {
224             ProtocolMapper mapper = (ProtocolMapper) sessionFactory.getProviderFactory(ProtocolMapper.class, mapping.getProtocolMapper());
225             if (mapper instanceof CASAttributeMapper) {
226                 ((CASAttributeMapper) mapper).setAttribute(attributes, mapping, userSession, session, clientSessionCtx);
227             }
228         }
229         return attributes;
230     }
5d7080 231
ARW 232     protected String getPGTIOU()
233     {
234         return CASLoginProtocol.PROXY_GRANTING_TICKET_IOU_PREFIX + UUID.randomUUID().toString();
235     }
236
237     protected String getPGT(KeycloakSession session, AuthenticatedClientSessionModel clientSession, String pgtUrl)
238     {
239         return persistedTicket(pgtUrl, CASLoginProtocol.PROXY_GRANTING_TICKET_PREFIX);
240     }
241
242     protected String getPT(KeycloakSession session, AuthenticatedClientSessionModel clientSession, String targetService)
243     {
244         return persistedTicket(targetService, CASLoginProtocol.PROXY_TICKET_PREFIX);
245     }
246
247     protected String getST(String redirectUri)
248     {
249         return persistedTicket(redirectUri, CASLoginProtocol.SERVICE_TICKET_PREFIX);
250     }
251
252     public static String getST(KeycloakSession session, AuthenticatedClientSessionModel clientSession, String redirectUri)
253     {
254         ValidateEndpoint vp = new ValidateEndpoint(session,null,null);
255         vp.clientSession = clientSession;
256         return vp.getST(redirectUri);
257     }
258
259     protected String persistedTicket(String redirectUriParam, String prefix)
260     {
261         String key = UUID.randomUUID().toString();
262         UserSessionModel userSession = clientSession.getUserSession();
263         OAuth2Code codeData = new OAuth2Code(key, Time.currentTime() + userSession.getRealm().getAccessCodeLifespan(), null, null, redirectUriParam, null, null, userSession.getId());
264         session.singleUseObjects().put(prefix + key, clientSession.getUserSession().getRealm().getAccessCodeLifespan(), codeData.serializeCode());
265         return prefix + key + "." + clientSession.getUserSession().getId() + "." + clientSession.getClient().getId();
266     }
74023a 267 }