From 71aa94e99fd15e67ca200820c722f7ec5a3a97ad Mon Sep 17 00:00:00 2001 From: Jacek Kowalski <Jacek@jacekk.info> Date: Tue, 03 Nov 2026 21:04:42 +0000 Subject: [PATCH] Require HTTPS for proxy granting ticket callback by default --- README.md | 13 +++++++++---- 1 files changed, 9 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 434751a..e0f0c1c 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,6 @@ The following features are **missing**: * SAML request/response [CAS 3.0 - optional] -* Proxy ticket service and proxy ticket validation [CAS 2.0] The following features are out of scope: * Long-Term Tickets - Remember-Me [CAS 3.0 - optional] @@ -30,10 +29,13 @@ ## Installation -Installation of a compatible plugin version is simple and can be done without a Keycloak server restart. +Quarkus is the default distribution method of Keycloak 17.0.0 and newer. For legacy installations using WildFly, please refer to the [old README](https://github.com/jacekkow/keycloak-protocol-cas/blob/16.1.1/README.md). 1. Download the latest release compatible with your Keycloak version from the [releases page](https://github.com/jacekkow/keycloak-protocol-cas/releases). -2. Copy the JAR file into the `standalone/deployments` directory in your Keycloak server's root. +2. Put the downloaded JAR file into the `providers/` directory inside Keycloak installation folder. If necessary, adjust the permissions/ownership so that the user Keycloak runs as is able to read this file. +3. Stop the Keycloak server. +4. (Re-)build the installation using `kc.sh build` command. +5. Start the Keycloak: `kc.sh start` Remember to update plugin artifact with each Keycloak server upgrade! @@ -43,7 +45,7 @@ As there is no client ID indication in protocol, the client will be identified by the redirect URIs configured in Keycloak. -Enter `https://your.keycloak.host/auth/realms/master/protocol/cas` as the CAS URL into your SP. +Enter `https://your.keycloak.host/realms/master/protocol/cas` as the CAS URL into your SP. This assumes that you use the default `master` realm - if not, modify the URL accordingly. Note that some client implementations require you to enter login and validate URLs, not CAS URL! @@ -52,6 +54,9 @@ In such case append `/login` to the CAS URL to get the "login URL". Similarly append `/serviceValidate` to get the "validate URL". +Proxy callback URLs (`pgtUrl`) must match the client's redirect URIs and use HTTPS. +Plain HTTP is accepted only if the realm's "Require SSL" setting allows it. + ## Disclaimer This plugin was implemented from scratch to comply to the official CAS protocol specification, -- Gitblit v1.10.0