From 755fd78fa0ee0f2a67417a119382c63e02c1091e Mon Sep 17 00:00:00 2001
From: Alexandre Rocha Wendling <alexandrerw@celepar.pr.gov.br>
Date: Tue, 16 Jul 2024 14:15:23 +0000
Subject: [PATCH] Proxy ticket service and proxy ticket validation Proxy endpoints improvements suggested by Jacek Kowalski Add ticket type to storage key Rename isreuse to isReusable Remove "parsing" of "codeUUID" that is String, not UUID Improve error reporting in CAS ticket validation
---
src/main/java/org/keycloak/protocol/cas/endpoints/ValidateEndpoint.java | 173 +++++++--------------------------------------------------
1 files changed, 21 insertions(+), 152 deletions(-)
diff --git a/src/main/java/org/keycloak/protocol/cas/endpoints/ValidateEndpoint.java b/src/main/java/org/keycloak/protocol/cas/endpoints/ValidateEndpoint.java
index 5727b50..a3c14a4 100644
--- a/src/main/java/org/keycloak/protocol/cas/endpoints/ValidateEndpoint.java
+++ b/src/main/java/org/keycloak/protocol/cas/endpoints/ValidateEndpoint.java
@@ -1,64 +1,34 @@
package org.keycloak.protocol.cas.endpoints;
-import org.jboss.logging.Logger;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MultivaluedMap;
+import jakarta.ws.rs.core.Response;
import org.jboss.resteasy.annotations.cache.NoCache;
-import org.jboss.resteasy.spi.HttpRequest;
-import org.keycloak.OAuthErrorException;
-import org.keycloak.common.ClientConnection;
-import org.keycloak.events.Details;
-import org.keycloak.events.Errors;
import org.keycloak.events.EventBuilder;
import org.keycloak.events.EventType;
-import org.keycloak.models.*;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
import org.keycloak.protocol.cas.CASLoginProtocol;
-import org.keycloak.protocol.oidc.utils.RedirectUtils;
-import org.keycloak.services.ErrorPageException;
-import org.keycloak.services.ErrorResponseException;
-import org.keycloak.services.managers.AuthenticationManager;
-import org.keycloak.services.managers.ClientSessionCode;
-import org.keycloak.services.messages.Messages;
+import org.keycloak.protocol.cas.utils.CASValidationException;
-import javax.ws.rs.GET;
-import javax.ws.rs.core.*;
-
-public class ValidateEndpoint {
- protected static final Logger logger = Logger.getLogger(org.keycloak.protocol.oidc.endpoints.LogoutEndpoint.class);
+public class ValidateEndpoint extends AbstractValidateEndpoint {
private static final String RESPONSE_OK = "yes\n";
private static final String RESPONSE_FAILED = "no\n";
- @Context
- protected KeycloakSession session;
-
- @Context
- protected ClientConnection clientConnection;
-
- @Context
- protected HttpRequest request;
-
- @Context
- protected HttpHeaders headers;
-
- @Context
- protected UriInfo uriInfo;
-
- protected RealmModel realm;
- protected EventBuilder event;
- protected ClientModel client;
- protected ClientSessionModel clientSession;
-
- public ValidateEndpoint(RealmModel realm, EventBuilder event) {
- this.realm = realm;
- this.event = event;
+ public ValidateEndpoint(KeycloakSession session, RealmModel realm, EventBuilder event) {
+ super(session, realm, event);
}
@GET
@NoCache
public Response build() {
- MultivaluedMap<String, String> params = uriInfo.getQueryParameters();
+ MultivaluedMap<String, String> params = session.getContext().getUri().getQueryParameters();
String service = params.getFirst(CASLoginProtocol.SERVICE_PARAM);
+ String pgtUrl = params.getFirst(CASLoginProtocol.PGTURL_PARAM);
String ticket = params.getFirst(CASLoginProtocol.TICKET_PARAM);
- boolean renew = "true".equalsIgnoreCase(params.getFirst(CASLoginProtocol.RENEW_PARAM));
+ boolean renew = params.containsKey(CASLoginProtocol.RENEW_PARAM);
event.event(EventType.CODE_TO_TOKEN);
@@ -67,125 +37,24 @@
checkRealm();
checkClient(service);
- checkTicket(ticket, renew);
+ checkTicket(ticket, CASLoginProtocol.SERVICE_TICKET_PREFIX, renew);
+
+ if (pgtUrl != null) createProxyGrant(pgtUrl);
event.success();
return successResponse();
- } catch (ErrorResponseException e) {
+ } catch (CASValidationException e) {
return errorResponse(e);
}
}
protected Response successResponse() {
- return Response.ok(RESPONSE_OK).type(MediaType.TEXT_PLAIN).build();
+ String response = RESPONSE_OK + clientSession.getUserSession().getUser().getUsername() + "\n";
+ return Response.ok(response).type(MediaType.TEXT_PLAIN).build();
}
- protected Response errorResponse(ErrorResponseException e) {
- return Response.status(Response.Status.UNAUTHORIZED).entity(RESPONSE_FAILED).type(MediaType.TEXT_PLAIN).build();
+ protected Response errorResponse(CASValidationException e) {
+ return Response.status(e.getStatus()).entity(RESPONSE_FAILED).type(MediaType.TEXT_PLAIN).build();
}
- private void checkSsl() {
- if (!uriInfo.getBaseUri().getScheme().equals("https") && realm.getSslRequired().isRequired(clientConnection)) {
- throw new ErrorResponseException(OAuthErrorException.INVALID_REQUEST, "HTTPS required", Response.Status.FORBIDDEN);
- }
- }
-
- private void checkRealm() {
- if (!realm.isEnabled()) {
- throw new ErrorResponseException("access_denied", "Realm not enabled", Response.Status.FORBIDDEN);
- }
- }
-
- private void checkClient(String service) {
- if (service == null) {
- event.error(Errors.INVALID_REQUEST);
- throw new ErrorPageException(session, Messages.MISSING_PARAMETER, CASLoginProtocol.SERVICE_PARAM);
- }
-
- client = realm.getClients().stream()
- .filter(c -> CASLoginProtocol.LOGIN_PROTOCOL.equals(c.getProtocol()))
- .filter(c -> RedirectUtils.verifyRedirectUri(uriInfo, service, realm, c) != null)
- .findFirst().orElse(null);
- if (client == null) {
- event.error(Errors.CLIENT_NOT_FOUND);
- throw new ErrorPageException(session, Messages.CLIENT_NOT_FOUND);
- }
-
- if (!client.isEnabled()) {
- event.error(Errors.CLIENT_DISABLED);
- throw new ErrorPageException(session, Messages.CLIENT_DISABLED);
- }
-
- if (client.isBearerOnly()) {
- event.error(Errors.NOT_ALLOWED);
- throw new ErrorPageException(session, Messages.BEARER_ONLY);
- }
-
- event.client(client.getClientId());
-
- session.getContext().setClient(client);
- }
-
- private void checkTicket(String ticket, boolean requireReauth) {
- if (ticket == null || !ticket.startsWith(CASLoginProtocol.SERVICE_TICKET_PREFIX)) {
- event.error(Errors.INVALID_CODE);
- throw new ErrorResponseException(OAuthErrorException.INVALID_REQUEST, "Missing or invalid parameter: " + CASLoginProtocol.TICKET_PARAM, Response.Status.BAD_REQUEST);
- }
-
- String code = ticket.substring(CASLoginProtocol.SERVICE_TICKET_PREFIX.length());
-
- ClientSessionCode.ParseResult parseResult = ClientSessionCode.parseResult(code, session, realm);
- if (parseResult.isClientSessionNotFound() || parseResult.isIllegalHash()) {
- String[] parts = code.split("\\.");
- if (parts.length == 2) {
- event.detail(Details.CODE_ID, parts[1]);
- }
- event.error(Errors.INVALID_CODE);
- if (parseResult.getClientSession() != null) {
- session.sessions().removeClientSession(realm, parseResult.getClientSession());
- }
- throw new ErrorResponseException(OAuthErrorException.INVALID_GRANT, "Code not valid", Response.Status.BAD_REQUEST);
- }
-
- clientSession = parseResult.getClientSession();
- event.detail(Details.CODE_ID, clientSession.getId());
-
- if (!parseResult.getCode().isValid(ClientSessionModel.Action.CODE_TO_TOKEN.name(), ClientSessionCode.ActionType.CLIENT)) {
- event.error(Errors.INVALID_CODE);
- throw new ErrorResponseException(OAuthErrorException.INVALID_GRANT, "Code is expired", Response.Status.BAD_REQUEST);
- }
-
- parseResult.getCode().setAction(null);
-
- UserSessionModel userSession = clientSession.getUserSession();
-
- if (userSession == null) {
- event.error(Errors.USER_SESSION_NOT_FOUND);
- throw new ErrorResponseException(OAuthErrorException.INVALID_GRANT, "User session not found", Response.Status.BAD_REQUEST);
- }
-
- UserModel user = userSession.getUser();
- if (user == null) {
- event.error(Errors.USER_NOT_FOUND);
- throw new ErrorResponseException(OAuthErrorException.INVALID_GRANT, "User not found", Response.Status.BAD_REQUEST);
- }
- if (!user.isEnabled()) {
- event.error(Errors.USER_DISABLED);
- throw new ErrorResponseException(OAuthErrorException.INVALID_GRANT, "User disabled", Response.Status.BAD_REQUEST);
- }
-
- event.user(userSession.getUser());
- event.session(userSession.getId());
-
- if (!client.getClientId().equals(clientSession.getClient().getClientId())) {
- event.error(Errors.INVALID_CODE);
- throw new ErrorResponseException(OAuthErrorException.INVALID_GRANT, "Auth error", Response.Status.BAD_REQUEST);
- }
-
- if (!AuthenticationManager.isSessionValid(realm, userSession)) {
- event.error(Errors.USER_SESSION_NOT_FOUND);
- throw new ErrorResponseException(OAuthErrorException.INVALID_GRANT, "Session not active", Response.Status.BAD_REQUEST);
- }
-
- }
}
--
Gitblit v1.9.1