Require and verify service parameter in proxyValidate endpoint

 integrationTest/suite.sh

@@ -58,6 +58,20 @@
$CURL "${keycloak_cas_url}/p3/serviceValidate?service=http://localhost&format=JSON&ticket=$ticket"
echo

# CAS 2.0 - proxy validation
echo "Testing CAS 2.0 - proxyValidate..."
ticket=$(get_ticket)
$CURL "${keycloak_cas_url}/proxyValidate?service=http://localhost&format=JSON&ticket=$ticket"
echo

echo "Testing CAS 2.0 - proxyValidate without service..."
ticket=$(get_ticket)
if $CURL "${keycloak_cas_url}/proxyValidate?format=JSON&ticket=$ticket"; then
    echo "Ticket was accepted without service parameter"
    exit 1
fi
echo

# SAML 1.1
echo "Testing SAML 1.1..."
ticket=$(get_ticket SAML)

 src/main/java/org/keycloak/protocol/cas/endpoints/AbstractValidateEndpoint.java

@@ -184,7 +184,8 @@

        if (client == null) {
            client = clientSession.getClient();
        } else {
        } else if (!prefix.equals(CASLoginProtocol.PROXY_TICKET_PREFIX)) {
            // Proxy tickets are issued from the proxying client's session for a (possibly) different target service
            if (!client.getClientId().equals(clientSession.getClient().getClientId())) {
                event.error(Errors.INVALID_CODE);
                throw new CASValidationException(CASErrorCode.INVALID_SERVICE, "Invalid service", Response.Status.BAD_REQUEST);

 src/main/java/org/keycloak/protocol/cas/endpoints/ProxyValidateEndpoint.java

@@ -27,6 +27,7 @@
    @NoCache
    public Response build() {
        MultivaluedMap<String, String> params = session.getContext().getUri().getQueryParameters();
        String service = params.getFirst(CASLoginProtocol.SERVICE_PARAM);
        String ticket = params.getFirst(CASLoginProtocol.TICKET_PARAM);
        String pgtUrl = params.getFirst(CASLoginProtocol.PGTURL_PARAM);
        boolean renew = params.containsKey(CASLoginProtocol.RENEW_PARAM);
@@ -45,6 +46,7 @@

            checkSsl();
            checkRealm();
            checkClient(service);
            checkTicket(ticket, prefix, renew);
            if (pgtUrl != null) createProxyGrant(pgtUrl);
            event.success();