From 7b839951b7d2cb088a557c642c2dec65bc5953ce Mon Sep 17 00:00:00 2001
From: Jacek Kowalski <Jacek@jacekk.info>
Date: Tue, 03 Nov 2026 20:58:44 +0000
Subject: [PATCH] Bind service and proxy tickets to the service they were issued for
---
src/main/java/org/keycloak/protocol/cas/endpoints/AbstractValidateEndpoint.java | 12 +++++++++++-
1 files changed, 11 insertions(+), 1 deletions(-)
diff --git a/src/main/java/org/keycloak/protocol/cas/endpoints/AbstractValidateEndpoint.java b/src/main/java/org/keycloak/protocol/cas/endpoints/AbstractValidateEndpoint.java
index a03563c..33f5ac0 100644
--- a/src/main/java/org/keycloak/protocol/cas/endpoints/AbstractValidateEndpoint.java
+++ b/src/main/java/org/keycloak/protocol/cas/endpoints/AbstractValidateEndpoint.java
@@ -40,6 +40,7 @@
protected RealmModel realm;
protected EventBuilder event;
protected ClientModel client;
+ protected String service;
protected AuthenticatedClientSessionModel clientSession;
protected String pgtIou;
@@ -83,6 +84,8 @@
throw new CASValidationException(CASErrorCode.INVALID_SERVICE, "Client disabled", Response.Status.BAD_REQUEST);
}
+ this.service = RedirectUtils.verifyRedirectUri(session, service, client);
+
event.client(client.getClientId());
session.getContext().setClient(client);
@@ -162,6 +165,12 @@
throw new CASValidationException(CASErrorCode.INVALID_TICKET, "Code is expired", Response.Status.BAD_REQUEST);
}
+ // Service and proxy tickets are valid only for the service they were issued for
+ if (!isReusable && (service == null || !service.equals(codeData.getRedirectUriParam()))) {
+ event.error(Errors.INVALID_REDIRECT_URI);
+ throw new CASValidationException(CASErrorCode.INVALID_SERVICE, "Ticket was not issued for this service", Response.Status.BAD_REQUEST);
+ }
+
clientSession.setNote(CASLoginProtocol.SESSION_TICKET, ticket);
if (requireReauth && AuthenticationManager.isSSOAuthentication(clientSession)) {
@@ -184,7 +193,8 @@
if (client == null) {
client = clientSession.getClient();
- } else {
+ } else if (!prefix.equals(CASLoginProtocol.PROXY_TICKET_PREFIX)) {
+ // Proxy tickets are issued from the proxying client's session for a (possibly) different target service
if (!client.getClientId().equals(clientSession.getClient().getClientId())) {
event.error(Errors.INVALID_CODE);
throw new CASValidationException(CASErrorCode.INVALID_SERVICE, "Invalid service", Response.Status.BAD_REQUEST);
--
Gitblit v1.10.0