From 281a7ed1c82d92bbf09c18ca1bbdff19d1bc0e05 Mon Sep 17 00:00:00 2001 From: Mateusz Małek <ieg3lwut8aippmr7tzhqyznn@noreply.damisa.net> Date: Tue, 08 Nov 2022 09:07:44 +0000 Subject: [PATCH] Match Apereo CAS behavior with regard to single log-out --- src/main/java/org/keycloak/protocol/cas/endpoints/AuthorizationEndpoint.java | 11 +++++++++++ 1 files changed, 11 insertions(+), 0 deletions(-) diff --git a/src/main/java/org/keycloak/protocol/cas/endpoints/AuthorizationEndpoint.java b/src/main/java/org/keycloak/protocol/cas/endpoints/AuthorizationEndpoint.java index 1526d21..d046247 100644 --- a/src/main/java/org/keycloak/protocol/cas/endpoints/AuthorizationEndpoint.java +++ b/src/main/java/org/keycloak/protocol/cas/endpoints/AuthorizationEndpoint.java @@ -35,6 +35,13 @@ public Response build() { MultivaluedMap<String, String> params = session.getContext().getUri().getQueryParameters(); String service = params.getFirst(CASLoginProtocol.SERVICE_PARAM); + + boolean isSaml11Request = false; + if (service == null && params.containsKey(CASLoginProtocol.TARGET_PARAM)) { + // SAML 1.1 authorization uses the TARGET parameter instead of service + service = params.getFirst(CASLoginProtocol.TARGET_PARAM); + isSaml11Request = true; + } boolean renew = params.containsKey(CASLoginProtocol.RENEW_PARAM); boolean gateway = params.containsKey(CASLoginProtocol.GATEWAY_PARAM); @@ -54,6 +61,10 @@ if (gateway) { authenticationSession.setClientNote(CASLoginProtocol.GATEWAY_PARAM, "true"); } + if (isSaml11Request) { + // Flag the session so we can return the ticket as "SAMLart" in the response + authenticationSession.setClientNote(CASLoginProtocol.TARGET_PARAM, "true"); + } this.event.event(EventType.LOGIN); return handleBrowserAuthenticationRequest(authenticationSession, new CASLoginProtocol(session, realm, session.getContext().getUri(), headers, event), gateway, false); -- Gitblit v1.9.1