From a81f4a3da2531884e8d9f5c98b7cacc8eec1febe Mon Sep 17 00:00:00 2001
From: Jacek Kowalski <Jacek@jacekk.info>
Date: Tue, 03 Nov 2026 20:58:36 +0000
Subject: [PATCH] Require and verify service parameter in proxyValidate endpoint
---
src/main/java/org/keycloak/protocol/cas/endpoints/AbstractValidateEndpoint.java | 13 ++++++++++---
1 files changed, 10 insertions(+), 3 deletions(-)
diff --git a/src/main/java/org/keycloak/protocol/cas/endpoints/AbstractValidateEndpoint.java b/src/main/java/org/keycloak/protocol/cas/endpoints/AbstractValidateEndpoint.java
index d83af50..30da645 100644
--- a/src/main/java/org/keycloak/protocol/cas/endpoints/AbstractValidateEndpoint.java
+++ b/src/main/java/org/keycloak/protocol/cas/endpoints/AbstractValidateEndpoint.java
@@ -12,8 +12,8 @@
import org.keycloak.protocol.cas.mappers.CASAttributeMapper;
import org.keycloak.protocol.cas.representations.CASErrorCode;
import org.keycloak.protocol.cas.utils.CASValidationException;
+import org.keycloak.protocol.cas.utils.RedirectUtils;
import org.keycloak.protocol.oidc.utils.OAuth2Code;
-import org.keycloak.protocol.oidc.utils.RedirectUtils;
import org.keycloak.services.managers.AuthenticationManager;
import org.keycloak.services.managers.UserSessionCrossDCManager;
import org.keycloak.services.util.DefaultClientSessionContext;
@@ -22,6 +22,7 @@
import java.util.HashMap;
import java.util.HexFormat;
import java.util.Map;
+import java.util.Objects;
import java.util.Set;
import java.util.UUID;
import java.util.regex.Pattern;
@@ -183,13 +184,19 @@
if (client == null) {
client = clientSession.getClient();
- } else {
+ } else if (!prefix.equals(CASLoginProtocol.PROXY_TICKET_PREFIX)) {
+ // Proxy tickets are issued from the proxying client's session for a (possibly) different target service
if (!client.getClientId().equals(clientSession.getClient().getClientId())) {
event.error(Errors.INVALID_CODE);
throw new CASValidationException(CASErrorCode.INVALID_SERVICE, "Invalid service", Response.Status.BAD_REQUEST);
}
}
+ if (codeData.getClientUUID() != null && !codeData.getClientUUID().equals(clientUUID)) {
+ event.error(Errors.INVALID_CODE);
+ throw new CASValidationException(CASErrorCode.INVALID_SERVICE, "Invalid client", Response.Status.BAD_REQUEST);
+ }
+
if (!AuthenticationManager.isSessionValid(realm, userSession)) {
event.error(Errors.USER_SESSION_NOT_FOUND);
throw new CASValidationException(CASErrorCode.INVALID_TICKET, "Session not active", Response.Status.BAD_REQUEST);
@@ -270,7 +277,7 @@
{
String key = UUID.randomUUID().toString();
UserSessionModel userSession = clientSession.getUserSession();
- OAuth2Code codeData = new OAuth2Code(key, Time.currentTime() + userSession.getRealm().getAccessCodeLifespan(), null, null, redirectUriParam, null, null, null, userSession.getId());
+ OAuth2Code codeData = new OAuth2Code(key, clientSession.getClient().getId(), Time.currentTime() + userSession.getRealm().getAccessCodeLifespan(), null, null, null, redirectUriParam, null, null, null, userSession.getId());
session.singleUseObjects().put(prefix + key, clientSession.getUserSession().getRealm().getAccessCodeLifespan(), codeData.serializeCode());
return prefix + key + "--" + hexEncode(clientSession.getUserSession().getId()) + "--" + clientSession.getClient().getId();
}
--
Gitblit v1.10.0