From 755fd78fa0ee0f2a67417a119382c63e02c1091e Mon Sep 17 00:00:00 2001
From: Alexandre Rocha Wendling <alexandrerw@celepar.pr.gov.br>
Date: Tue, 16 Jul 2024 14:15:23 +0000
Subject: [PATCH] Proxy ticket service and proxy ticket validation Proxy endpoints improvements suggested by Jacek Kowalski Add ticket type to storage key Rename isreuse to isReusable Remove "parsing" of "codeUUID" that is String, not UUID Improve error reporting in CAS ticket validation
---
src/main/java/org/keycloak/protocol/cas/endpoints/AuthorizationEndpoint.java | 80 ++++++++++++++++++++-------------------
1 files changed, 41 insertions(+), 39 deletions(-)
diff --git a/src/main/java/org/keycloak/protocol/cas/endpoints/AuthorizationEndpoint.java b/src/main/java/org/keycloak/protocol/cas/endpoints/AuthorizationEndpoint.java
index 57b0da0..1dc2eef 100644
--- a/src/main/java/org/keycloak/protocol/cas/endpoints/AuthorizationEndpoint.java
+++ b/src/main/java/org/keycloak/protocol/cas/endpoints/AuthorizationEndpoint.java
@@ -1,40 +1,46 @@
package org.keycloak.protocol.cas.endpoints;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.core.MultivaluedMap;
+import jakarta.ws.rs.core.Response;
import org.jboss.logging.Logger;
import org.keycloak.events.Details;
import org.keycloak.events.Errors;
import org.keycloak.events.EventBuilder;
import org.keycloak.events.EventType;
import org.keycloak.models.ClientModel;
-import org.keycloak.models.ClientSessionModel;
-import org.keycloak.models.RealmModel;
+import org.keycloak.models.KeycloakSession;
import org.keycloak.protocol.AuthorizationEndpointBase;
import org.keycloak.protocol.cas.CASLoginProtocol;
import org.keycloak.protocol.oidc.utils.RedirectUtils;
import org.keycloak.services.ErrorPageException;
import org.keycloak.services.messages.Messages;
import org.keycloak.services.util.CacheControlUtil;
-
-import javax.ws.rs.GET;
-import javax.ws.rs.core.MultivaluedMap;
-import javax.ws.rs.core.Response;
+import org.keycloak.sessions.AuthenticationSessionModel;
public class AuthorizationEndpoint extends AuthorizationEndpointBase {
private static final Logger logger = Logger.getLogger(AuthorizationEndpoint.class);
private ClientModel client;
- private ClientSessionModel clientSession;
+ private AuthenticationSessionModel authenticationSession;
private String redirectUri;
- public AuthorizationEndpoint(RealmModel realm, EventBuilder event) {
- super(realm, event);
+ public AuthorizationEndpoint(KeycloakSession session, EventBuilder event) {
+ super(session, event);
event.event(EventType.LOGIN);
}
@GET
public Response build() {
- MultivaluedMap<String, String> params = uriInfo.getQueryParameters();
+ MultivaluedMap<String, String> params = session.getContext().getUri().getQueryParameters();
String service = params.getFirst(CASLoginProtocol.SERVICE_PARAM);
+
+ boolean isSaml11Request = false;
+ if (service == null && params.containsKey(CASLoginProtocol.TARGET_PARAM)) {
+ // SAML 1.1 authorization uses the TARGET parameter instead of service
+ service = params.getFirst(CASLoginProtocol.TARGET_PARAM);
+ isSaml11Request = true;
+ }
boolean renew = params.containsKey(CASLoginProtocol.RENEW_PARAM);
boolean gateway = params.containsKey(CASLoginProtocol.GATEWAY_PARAM);
@@ -42,53 +48,50 @@
checkRealm();
checkClient(service);
- createClientSession();
+ authenticationSession = createAuthenticationSession(client, null);
+ updateAuthenticationSession();
+
// So back button doesn't work
- CacheControlUtil.noBackButtonCacheControlHeader();
+ CacheControlUtil.noBackButtonCacheControlHeader(session);
if (renew) {
- clientSession.setNote(CASLoginProtocol.RENEW_PARAM, "true");
+ authenticationSession.setClientNote(CASLoginProtocol.RENEW_PARAM, "true");
+ }
+ if (gateway) {
+ authenticationSession.setClientNote(CASLoginProtocol.GATEWAY_PARAM, "true");
+ }
+ if (isSaml11Request) {
+ // Flag the session so we can return the ticket as "SAMLart" in the response
+ authenticationSession.setClientNote(CASLoginProtocol.TARGET_PARAM, "true");
}
this.event.event(EventType.LOGIN);
- return handleBrowserAuthenticationRequest(clientSession, new CASLoginProtocol(session, realm, uriInfo, headers, event), gateway, false);
- }
-
- private void checkSsl() {
- if (!uriInfo.getBaseUri().getScheme().equals("https") && realm.getSslRequired().isRequired(clientConnection)) {
- event.error(Errors.SSL_REQUIRED);
- throw new ErrorPageException(session, Messages.HTTPS_REQUIRED);
- }
- }
-
- private void checkRealm() {
- if (!realm.isEnabled()) {
- event.error(Errors.REALM_DISABLED);
- throw new ErrorPageException(session, Messages.REALM_NOT_ENABLED);
- }
+ return handleBrowserAuthenticationRequest(authenticationSession, new CASLoginProtocol(session, realm, session.getContext().getUri(), headers, event), gateway, false);
}
private void checkClient(String service) {
if (service == null) {
event.error(Errors.INVALID_REQUEST);
- throw new ErrorPageException(session, Messages.MISSING_PARAMETER, CASLoginProtocol.SERVICE_PARAM);
+ throw new ErrorPageException(session, Response.Status.BAD_REQUEST, Messages.MISSING_PARAMETER, CASLoginProtocol.SERVICE_PARAM);
}
- client = realm.getClients().stream()
+ event.detail(Details.REDIRECT_URI, service);
+
+ client = realm.getClientsStream()
.filter(c -> CASLoginProtocol.LOGIN_PROTOCOL.equals(c.getProtocol()))
- .filter(c -> RedirectUtils.verifyRedirectUri(uriInfo, service, realm, c) != null)
+ .filter(c -> RedirectUtils.verifyRedirectUri(session, service, c) != null)
.findFirst().orElse(null);
if (client == null) {
event.error(Errors.CLIENT_NOT_FOUND);
- throw new ErrorPageException(session, Messages.CLIENT_NOT_FOUND);
+ throw new ErrorPageException(session, Response.Status.BAD_REQUEST, Messages.CLIENT_NOT_FOUND);
}
if (!client.isEnabled()) {
event.error(Errors.CLIENT_DISABLED);
- throw new ErrorPageException(session, Messages.CLIENT_DISABLED);
+ throw new ErrorPageException(session, Response.Status.BAD_REQUEST, Messages.CLIENT_DISABLED);
}
- redirectUri = RedirectUtils.verifyRedirectUri(uriInfo, service, realm, client);
+ redirectUri = RedirectUtils.verifyRedirectUri(session, service, client);
event.client(client.getClientId());
event.detail(Details.REDIRECT_URI, redirectUri);
@@ -96,10 +99,9 @@
session.getContext().setClient(client);
}
- private void createClientSession() {
- clientSession = session.sessions().createClientSession(realm, client);
- clientSession.setAuthMethod(CASLoginProtocol.LOGIN_PROTOCOL);
- clientSession.setRedirectUri(redirectUri);
- clientSession.setAction(ClientSessionModel.Action.AUTHENTICATE.name());
+ private void updateAuthenticationSession() {
+ authenticationSession.setProtocol(CASLoginProtocol.LOGIN_PROTOCOL);
+ authenticationSession.setRedirectUri(redirectUri);
+ authenticationSession.setAction(AuthenticationSessionModel.Action.AUTHENTICATE.name());
}
}
--
Gitblit v1.9.1