From 755fd78fa0ee0f2a67417a119382c63e02c1091e Mon Sep 17 00:00:00 2001
From: Alexandre Rocha Wendling <alexandrerw@celepar.pr.gov.br>
Date: Tue, 16 Jul 2024 14:15:23 +0000
Subject: [PATCH] Proxy ticket service and proxy ticket validation Proxy endpoints improvements suggested by Jacek Kowalski Add ticket type to storage key Rename isreuse to isReusable Remove "parsing" of "codeUUID" that is String, not UUID Improve error reporting in CAS ticket validation
---
src/main/java/org/keycloak/protocol/cas/CASLoginProtocol.java | 109 +++++++++++++++++++++++++++++++++++++++++++-----------
1 files changed, 86 insertions(+), 23 deletions(-)
diff --git a/src/main/java/org/keycloak/protocol/cas/CASLoginProtocol.java b/src/main/java/org/keycloak/protocol/cas/CASLoginProtocol.java
index 10c9b5d..52dc060 100644
--- a/src/main/java/org/keycloak/protocol/cas/CASLoginProtocol.java
+++ b/src/main/java/org/keycloak/protocol/cas/CASLoginProtocol.java
@@ -1,45 +1,64 @@
package org.keycloak.protocol.cas;
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.UriInfo;
+import org.apache.http.HttpEntity;
+import org.jboss.logging.Logger;
import org.keycloak.common.util.KeycloakUriBuilder;
+import org.keycloak.events.Details;
import org.keycloak.events.EventBuilder;
import org.keycloak.events.EventType;
+import org.keycloak.forms.login.LoginFormsProvider;
import org.keycloak.models.*;
import org.keycloak.protocol.LoginProtocol;
-import org.keycloak.services.managers.ClientSessionCode;
+import org.keycloak.protocol.cas.endpoints.AbstractValidateEndpoint;
+import org.keycloak.protocol.cas.utils.LogoutHelper;
+import org.keycloak.services.ErrorPage;
import org.keycloak.services.managers.ResourceAdminManager;
+import org.keycloak.sessions.AuthenticationSessionModel;
-import javax.ws.rs.core.HttpHeaders;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.UriInfo;
+import java.io.IOException;
import java.net.URI;
public class CASLoginProtocol implements LoginProtocol {
+ private static final Logger logger = Logger.getLogger(CASLoginProtocol.class);
+
public static final String LOGIN_PROTOCOL = "cas";
public static final String SERVICE_PARAM = "service";
+ public static final String TARGET_PARAM = "TARGET";
public static final String RENEW_PARAM = "renew";
public static final String GATEWAY_PARAM = "gateway";
public static final String TICKET_PARAM = "ticket";
public static final String FORMAT_PARAM = "format";
+ public static final String PGTURL_PARAM = "pgtUrl";
+ public static final String TARGET_SERVICE_PARAM = "targetService";
+ public static final String PGT_PARAM = "pgt";
public static final String TICKET_RESPONSE_PARAM = "ticket";
+ public static final String SAMLART_RESPONSE_PARAM = "SAMLart";
public static final String SERVICE_TICKET_PREFIX = "ST-";
+ public static final String PROXY_GRANTING_TICKET_IOU_PREFIX = "PGTIOU-";
+ public static final String PROXY_GRANTING_TICKET_PREFIX = "PGT-";
+ public static final String PROXY_TICKET_PREFIX = "PT-";
+ public static final String SESSION_SERVICE_TICKET = "service_ticket";
+
+ public static final String LOGOUT_REDIRECT_URI = "CAS_LOGOUT_REDIRECT_URI";
protected KeycloakSession session;
protected RealmModel realm;
protected UriInfo uriInfo;
protected HttpHeaders headers;
protected EventBuilder event;
- private boolean requireReauth;
- public CASLoginProtocol(KeycloakSession session, RealmModel realm, UriInfo uriInfo, HttpHeaders headers, EventBuilder event, boolean requireReauth) {
+ public CASLoginProtocol(KeycloakSession session, RealmModel realm, UriInfo uriInfo, HttpHeaders headers, EventBuilder event) {
this.session = session;
this.realm = realm;
this.uriInfo = uriInfo;
this.headers = headers;
this.event = event;
- this.requireReauth = requireReauth;
}
public CASLoginProtocol() {
@@ -76,14 +95,22 @@
}
@Override
- public Response authenticated(UserSessionModel userSession, ClientSessionCode accessCode) {
- ClientSessionModel clientSession = accessCode.getClientSession();
+ public Response authenticated(AuthenticationSessionModel authSession, UserSessionModel userSession, ClientSessionContext clientSessionCtx) {
+ AuthenticatedClientSessionModel clientSession = clientSessionCtx.getClientSession();
- String service = clientSession.getRedirectUri();
+ String service = authSession.getRedirectUri();
//TODO validate service
- accessCode.setAction(ClientSessionModel.Action.CODE_TO_TOKEN.name());
+
KeycloakUriBuilder uriBuilder = KeycloakUriBuilder.fromUri(service);
- uriBuilder.queryParam(TICKET_RESPONSE_PARAM, SERVICE_TICKET_PREFIX + accessCode.getCode());
+
+ String loginTicket = AbstractValidateEndpoint.getST(session, clientSession, service);
+
+ if (authSession.getClientNotes().containsKey(CASLoginProtocol.TARGET_PARAM)) {
+ // This was a SAML 1.1 auth request so return the ticket ID as "SAMLart" instead of "ticket"
+ uriBuilder.queryParam(SAMLART_RESPONSE_PARAM, loginTicket);
+ } else {
+ uriBuilder.queryParam(TICKET_RESPONSE_PARAM, loginTicket);
+ }
URI redirectUri = uriBuilder.build();
@@ -92,32 +119,68 @@
}
@Override
- public Response sendError(ClientSessionModel clientSession, Error error) {
- return Response.serverError().entity(error).build();
+ public Response sendError(AuthenticationSessionModel authSession, Error error) {
+ if (authSession.getClientNotes().containsKey(CASLoginProtocol.GATEWAY_PARAM)) {
+ if (error == Error.PASSIVE_INTERACTION_REQUIRED || error == Error.PASSIVE_LOGIN_REQUIRED) {
+ return Response.status(302).location(URI.create(authSession.getRedirectUri())).build();
+ }
+ }
+ return ErrorPage.error(session, authSession, Response.Status.INTERNAL_SERVER_ERROR, error.name());
}
@Override
- public void backchannelLogout(UserSessionModel userSession, ClientSessionModel clientSession) {
+ public Response backchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
+ String logoutUrl = clientSession.getRedirectUri();
+ String serviceTicket = clientSession.getNote(CASLoginProtocol.SESSION_SERVICE_TICKET);
+ //check if session is fully authenticated (i.e. serviceValidate has been called)
+ if (serviceTicket != null && !serviceTicket.isEmpty()) {
+ sendSingleLogoutRequest(logoutUrl, serviceTicket);
+ }
ClientModel client = clientSession.getClient();
- new ResourceAdminManager(session).logoutClientSession(uriInfo.getRequestUri(), realm, client, clientSession);
+ return new ResourceAdminManager(session).logoutClientSession(realm, client, clientSession);
+ }
+
+ private void sendSingleLogoutRequest(String logoutUrl, String serviceTicket) {
+ try {
+ HttpEntity requestEntity = LogoutHelper.buildSingleLogoutRequest(serviceTicket);
+ LogoutHelper.postWithRedirect(session, logoutUrl, requestEntity);
+ logger.debug("Sent CAS single logout for service " + logoutUrl);
+ } catch (IOException e) {
+ logger.warn("Failed to call CAS service for logout: " + logoutUrl, e);
+ }
}
@Override
- public Response frontchannelLogout(UserSessionModel userSession, ClientSessionModel clientSession) {
+ public Response frontchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
// todo oidc redirect support
throw new RuntimeException("NOT IMPLEMENTED");
}
@Override
- public Response finishLogout(UserSessionModel userSession) {
- event.event(EventType.LOGOUT);
- event.user(userSession.getUser()).session(userSession).success();
- return Response.ok().build();
+ public Response finishBrowserLogout(UserSessionModel userSession, AuthenticationSessionModel logoutSession) {
+ String redirectUri = userSession.getNote(CASLoginProtocol.LOGOUT_REDIRECT_URI);
+
+ event.event(EventType.LOGOUT)
+ .user(userSession.getUser())
+ .session(userSession)
+ .detail(Details.USERNAME, userSession.getUser().getUsername());
+
+ if (redirectUri != null) {
+ event.detail(Details.REDIRECT_URI, redirectUri);
+ event.success();
+ return Response.status(302).location(URI.create(redirectUri)).build();
+ }
+
+ event.success();
+
+ LoginFormsProvider infoPage = session.getProvider(LoginFormsProvider.class).setSuccess("Logout successful");
+ infoPage.setAttribute("skipLink", true);
+ return infoPage.createInfoPage();
}
@Override
- public boolean requireReauthentication(UserSessionModel userSession, ClientSessionModel clientSession) {
- return requireReauth;
+ public boolean requireReauthentication(UserSessionModel userSession, AuthenticationSessionModel authSession) {
+ return "true".equals(authSession.getClientNote(CASLoginProtocol.RENEW_PARAM));
}
@Override
--
Gitblit v1.9.1