From 7b839951b7d2cb088a557c642c2dec65bc5953ce Mon Sep 17 00:00:00 2001
From: Jacek Kowalski <Jacek@jacekk.info>
Date: Tue, 03 Nov 2026 20:58:44 +0000
Subject: [PATCH] Bind service and proxy tickets to the service they were issued for
---
integrationTest/suite.sh | 8 ++++++++
src/main/java/org/keycloak/protocol/cas/endpoints/AbstractValidateEndpoint.java | 9 +++++++++
2 files changed, 17 insertions(+), 0 deletions(-)
diff --git a/integrationTest/suite.sh b/integrationTest/suite.sh
index 47eadb2..b2f2b24 100755
--- a/integrationTest/suite.sh
+++ b/integrationTest/suite.sh
@@ -41,6 +41,14 @@
$CURL "${keycloak_cas_url}/validate?service=http://localhost&ticket=$ticket"
echo
+echo "Testing CAS 1.0 - ticket issued for another service..."
+ticket=$(get_ticket)
+if $CURL "${keycloak_cas_url}/validate?service=http://localhost/other&ticket=$ticket"; then
+ echo "Ticket was accepted for a different service"
+ exit 1
+fi
+echo
+
# CAS 2.0
echo "Testing CAS 2.0 - XML..."
ticket=$(get_ticket)
diff --git a/src/main/java/org/keycloak/protocol/cas/endpoints/AbstractValidateEndpoint.java b/src/main/java/org/keycloak/protocol/cas/endpoints/AbstractValidateEndpoint.java
index 30da645..33f5ac0 100644
--- a/src/main/java/org/keycloak/protocol/cas/endpoints/AbstractValidateEndpoint.java
+++ b/src/main/java/org/keycloak/protocol/cas/endpoints/AbstractValidateEndpoint.java
@@ -40,6 +40,7 @@
protected RealmModel realm;
protected EventBuilder event;
protected ClientModel client;
+ protected String service;
protected AuthenticatedClientSessionModel clientSession;
protected String pgtIou;
@@ -83,6 +84,8 @@
throw new CASValidationException(CASErrorCode.INVALID_SERVICE, "Client disabled", Response.Status.BAD_REQUEST);
}
+ this.service = RedirectUtils.verifyRedirectUri(session, service, client);
+
event.client(client.getClientId());
session.getContext().setClient(client);
@@ -162,6 +165,12 @@
throw new CASValidationException(CASErrorCode.INVALID_TICKET, "Code is expired", Response.Status.BAD_REQUEST);
}
+ // Service and proxy tickets are valid only for the service they were issued for
+ if (!isReusable && (service == null || !service.equals(codeData.getRedirectUriParam()))) {
+ event.error(Errors.INVALID_REDIRECT_URI);
+ throw new CASValidationException(CASErrorCode.INVALID_SERVICE, "Ticket was not issued for this service", Response.Status.BAD_REQUEST);
+ }
+
clientSession.setNote(CASLoginProtocol.SESSION_TICKET, ticket);
if (requireReauth && AuthenticationManager.isSSOAuthentication(clientSession)) {
--
Gitblit v1.10.0