From f75caf002c2014cd1dd875225417f2a5de1af9d0 Mon Sep 17 00:00:00 2001
From: Matthias Piepkorn <mpiepk@gmail.com>
Date: Wed, 26 Jul 2017 17:54:25 +0000
Subject: [PATCH] adapt to changes in Keycloak 3.2 (fixes #6)

---
 src/main/java/org/keycloak/protocol/cas/CASLoginProtocol.java |   54 +++++++++++++++++++++++++++++++++++++++++++++---------
 1 files changed, 45 insertions(+), 9 deletions(-)

diff --git a/src/main/java/org/keycloak/protocol/cas/CASLoginProtocol.java b/src/main/java/org/keycloak/protocol/cas/CASLoginProtocol.java
index 17e435e..cbcf1d0 100644
--- a/src/main/java/org/keycloak/protocol/cas/CASLoginProtocol.java
+++ b/src/main/java/org/keycloak/protocol/cas/CASLoginProtocol.java
@@ -1,19 +1,28 @@
 package org.keycloak.protocol.cas;
 
+import org.apache.http.HttpEntity;
+import org.jboss.logging.Logger;
 import org.keycloak.common.util.KeycloakUriBuilder;
 import org.keycloak.events.EventBuilder;
 import org.keycloak.events.EventType;
+import org.keycloak.forms.login.LoginFormsProvider;
 import org.keycloak.models.*;
 import org.keycloak.protocol.LoginProtocol;
+import org.keycloak.protocol.cas.utils.LogoutHelper;
 import org.keycloak.services.managers.ClientSessionCode;
 import org.keycloak.services.managers.ResourceAdminManager;
+import org.keycloak.sessions.AuthenticationSessionModel;
+import org.keycloak.sessions.CommonClientSessionModel;
 
 import javax.ws.rs.core.HttpHeaders;
 import javax.ws.rs.core.Response;
 import javax.ws.rs.core.UriInfo;
+import java.io.IOException;
 import java.net.URI;
 
 public class CASLoginProtocol implements LoginProtocol {
+    private static final Logger logger = Logger.getLogger(CASLoginProtocol.class);
+
     public static final String LOGIN_PROTOCOL = "cas";
 
     public static final String SERVICE_PARAM = "service";
@@ -25,6 +34,9 @@
     public static final String TICKET_RESPONSE_PARAM = "ticket";
 
     public static final String SERVICE_TICKET_PREFIX = "ST-";
+    public static final String SESSION_SERVICE_TICKET = "service_ticket";
+
+    public static final String LOGOUT_REDIRECT_URI = "CAS_LOGOUT_REDIRECT_URI";
 
     protected KeycloakSession session;
     protected RealmModel realm;
@@ -74,12 +86,12 @@
     }
 
     @Override
-    public Response authenticated(UserSessionModel userSession, ClientSessionCode accessCode) {
-        ClientSessionModel clientSession = accessCode.getClientSession();
+    public Response authenticated(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
+        ClientSessionCode<AuthenticatedClientSessionModel> accessCode = new ClientSessionCode<>(session, realm, clientSession);
 
         String service = clientSession.getRedirectUri();
         //TODO validate service
-        accessCode.setAction(ClientSessionModel.Action.CODE_TO_TOKEN.name());
+        accessCode.setAction(CommonClientSessionModel.Action.CODE_TO_TOKEN.name());
         KeycloakUriBuilder uriBuilder = KeycloakUriBuilder.fromUri(service);
         uriBuilder.queryParam(TICKET_RESPONSE_PARAM, SERVICE_TICKET_PREFIX + accessCode.getCode());
 
@@ -90,32 +102,56 @@
     }
 
     @Override
-    public Response sendError(ClientSessionModel clientSession, Error error) {
+    public Response sendError(AuthenticationSessionModel authSession, Error error) {
         return Response.serverError().entity(error).build();
     }
 
     @Override
-    public void backchannelLogout(UserSessionModel userSession, ClientSessionModel clientSession) {
+    public void backchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
+        String logoutUrl = clientSession.getRedirectUri();
+        String serviceTicket = clientSession.getNote(CASLoginProtocol.SESSION_SERVICE_TICKET);
+        //check if session is fully authenticated (i.e. serviceValidate has been called)
+        if (serviceTicket != null && !serviceTicket.isEmpty()) {
+            sendSingleLogoutRequest(logoutUrl, serviceTicket);
+        }
         ClientModel client = clientSession.getClient();
         new ResourceAdminManager(session).logoutClientSession(uriInfo.getRequestUri(), realm, client, clientSession);
     }
 
+    private void sendSingleLogoutRequest(String logoutUrl, String serviceTicket) {
+        HttpEntity requestEntity = LogoutHelper.buildSingleLogoutRequest(serviceTicket);
+        try {
+            LogoutHelper.postWithRedirect(session, logoutUrl, requestEntity);
+            logger.debug("Sent CAS single logout for service " + logoutUrl);
+        } catch (IOException e) {
+            logger.warn("Failed to call CAS service for logout: " + logoutUrl, e);
+        }
+    }
+
     @Override
-    public Response frontchannelLogout(UserSessionModel userSession, ClientSessionModel clientSession) {
+    public Response frontchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
         // todo oidc redirect support
         throw new RuntimeException("NOT IMPLEMENTED");
     }
 
     @Override
     public Response finishLogout(UserSessionModel userSession) {
+        String redirectUri = userSession.getNote(CASLoginProtocol.LOGOUT_REDIRECT_URI);
+
         event.event(EventType.LOGOUT);
         event.user(userSession.getUser()).session(userSession).success();
-        return Response.ok().build();
+        LoginFormsProvider infoPage = session.getProvider(LoginFormsProvider.class).setSuccess("Logout successful");
+        if (redirectUri != null) {
+            infoPage.setAttribute("pageRedirectUri", redirectUri);
+        } else {
+            infoPage.setAttribute("skipLink", true);
+        }
+        return infoPage.createInfoPage();
     }
 
     @Override
-    public boolean requireReauthentication(UserSessionModel userSession, ClientSessionModel clientSession) {
-        return "true".equals(clientSession.getNote(CASLoginProtocol.RENEW_PARAM));
+    public boolean requireReauthentication(UserSessionModel userSession, AuthenticationSessionModel authSession) {
+        return "true".equals(authSession.getClientNote(CASLoginProtocol.RENEW_PARAM));
     }
 
     @Override

--
Gitblit v1.9.1