From 9986741851c41eceb66d741f5e701e7795cb9380 Mon Sep 17 00:00:00 2001 From: Jacek Kowalski <Jacek@jacekk.info> Date: Thu, 01 Aug 2024 19:29:14 +0000 Subject: [PATCH] Add FUNDING --- src/main/java/org/keycloak/protocol/cas/endpoints/AuthorizationEndpoint.java | 80 ++++++++++++++++++++------------------- 1 files changed, 41 insertions(+), 39 deletions(-) diff --git a/src/main/java/org/keycloak/protocol/cas/endpoints/AuthorizationEndpoint.java b/src/main/java/org/keycloak/protocol/cas/endpoints/AuthorizationEndpoint.java index 57b0da0..1dc2eef 100644 --- a/src/main/java/org/keycloak/protocol/cas/endpoints/AuthorizationEndpoint.java +++ b/src/main/java/org/keycloak/protocol/cas/endpoints/AuthorizationEndpoint.java @@ -1,40 +1,46 @@ package org.keycloak.protocol.cas.endpoints; +import jakarta.ws.rs.GET; +import jakarta.ws.rs.core.MultivaluedMap; +import jakarta.ws.rs.core.Response; import org.jboss.logging.Logger; import org.keycloak.events.Details; import org.keycloak.events.Errors; import org.keycloak.events.EventBuilder; import org.keycloak.events.EventType; import org.keycloak.models.ClientModel; -import org.keycloak.models.ClientSessionModel; -import org.keycloak.models.RealmModel; +import org.keycloak.models.KeycloakSession; import org.keycloak.protocol.AuthorizationEndpointBase; import org.keycloak.protocol.cas.CASLoginProtocol; import org.keycloak.protocol.oidc.utils.RedirectUtils; import org.keycloak.services.ErrorPageException; import org.keycloak.services.messages.Messages; import org.keycloak.services.util.CacheControlUtil; - -import javax.ws.rs.GET; -import javax.ws.rs.core.MultivaluedMap; -import javax.ws.rs.core.Response; +import org.keycloak.sessions.AuthenticationSessionModel; public class AuthorizationEndpoint extends AuthorizationEndpointBase { private static final Logger logger = Logger.getLogger(AuthorizationEndpoint.class); private ClientModel client; - private ClientSessionModel clientSession; + private AuthenticationSessionModel authenticationSession; private String redirectUri; - public AuthorizationEndpoint(RealmModel realm, EventBuilder event) { - super(realm, event); + public AuthorizationEndpoint(KeycloakSession session, EventBuilder event) { + super(session, event); event.event(EventType.LOGIN); } @GET public Response build() { - MultivaluedMap<String, String> params = uriInfo.getQueryParameters(); + MultivaluedMap<String, String> params = session.getContext().getUri().getQueryParameters(); String service = params.getFirst(CASLoginProtocol.SERVICE_PARAM); + + boolean isSaml11Request = false; + if (service == null && params.containsKey(CASLoginProtocol.TARGET_PARAM)) { + // SAML 1.1 authorization uses the TARGET parameter instead of service + service = params.getFirst(CASLoginProtocol.TARGET_PARAM); + isSaml11Request = true; + } boolean renew = params.containsKey(CASLoginProtocol.RENEW_PARAM); boolean gateway = params.containsKey(CASLoginProtocol.GATEWAY_PARAM); @@ -42,53 +48,50 @@ checkRealm(); checkClient(service); - createClientSession(); + authenticationSession = createAuthenticationSession(client, null); + updateAuthenticationSession(); + // So back button doesn't work - CacheControlUtil.noBackButtonCacheControlHeader(); + CacheControlUtil.noBackButtonCacheControlHeader(session); if (renew) { - clientSession.setNote(CASLoginProtocol.RENEW_PARAM, "true"); + authenticationSession.setClientNote(CASLoginProtocol.RENEW_PARAM, "true"); + } + if (gateway) { + authenticationSession.setClientNote(CASLoginProtocol.GATEWAY_PARAM, "true"); + } + if (isSaml11Request) { + // Flag the session so we can return the ticket as "SAMLart" in the response + authenticationSession.setClientNote(CASLoginProtocol.TARGET_PARAM, "true"); } this.event.event(EventType.LOGIN); - return handleBrowserAuthenticationRequest(clientSession, new CASLoginProtocol(session, realm, uriInfo, headers, event), gateway, false); - } - - private void checkSsl() { - if (!uriInfo.getBaseUri().getScheme().equals("https") && realm.getSslRequired().isRequired(clientConnection)) { - event.error(Errors.SSL_REQUIRED); - throw new ErrorPageException(session, Messages.HTTPS_REQUIRED); - } - } - - private void checkRealm() { - if (!realm.isEnabled()) { - event.error(Errors.REALM_DISABLED); - throw new ErrorPageException(session, Messages.REALM_NOT_ENABLED); - } + return handleBrowserAuthenticationRequest(authenticationSession, new CASLoginProtocol(session, realm, session.getContext().getUri(), headers, event), gateway, false); } private void checkClient(String service) { if (service == null) { event.error(Errors.INVALID_REQUEST); - throw new ErrorPageException(session, Messages.MISSING_PARAMETER, CASLoginProtocol.SERVICE_PARAM); + throw new ErrorPageException(session, Response.Status.BAD_REQUEST, Messages.MISSING_PARAMETER, CASLoginProtocol.SERVICE_PARAM); } - client = realm.getClients().stream() + event.detail(Details.REDIRECT_URI, service); + + client = realm.getClientsStream() .filter(c -> CASLoginProtocol.LOGIN_PROTOCOL.equals(c.getProtocol())) - .filter(c -> RedirectUtils.verifyRedirectUri(uriInfo, service, realm, c) != null) + .filter(c -> RedirectUtils.verifyRedirectUri(session, service, c) != null) .findFirst().orElse(null); if (client == null) { event.error(Errors.CLIENT_NOT_FOUND); - throw new ErrorPageException(session, Messages.CLIENT_NOT_FOUND); + throw new ErrorPageException(session, Response.Status.BAD_REQUEST, Messages.CLIENT_NOT_FOUND); } if (!client.isEnabled()) { event.error(Errors.CLIENT_DISABLED); - throw new ErrorPageException(session, Messages.CLIENT_DISABLED); + throw new ErrorPageException(session, Response.Status.BAD_REQUEST, Messages.CLIENT_DISABLED); } - redirectUri = RedirectUtils.verifyRedirectUri(uriInfo, service, realm, client); + redirectUri = RedirectUtils.verifyRedirectUri(session, service, client); event.client(client.getClientId()); event.detail(Details.REDIRECT_URI, redirectUri); @@ -96,10 +99,9 @@ session.getContext().setClient(client); } - private void createClientSession() { - clientSession = session.sessions().createClientSession(realm, client); - clientSession.setAuthMethod(CASLoginProtocol.LOGIN_PROTOCOL); - clientSession.setRedirectUri(redirectUri); - clientSession.setAction(ClientSessionModel.Action.AUTHENTICATE.name()); + private void updateAuthenticationSession() { + authenticationSession.setProtocol(CASLoginProtocol.LOGIN_PROTOCOL); + authenticationSession.setRedirectUri(redirectUri); + authenticationSession.setAction(AuthenticationSessionModel.Action.AUTHENTICATE.name()); } } -- Gitblit v1.9.1