Examples with Ticket org.maxkey.authz.cas.endpoint.ticket.Ticket used on opensource projects

Example 6 with Ticket

use of org.maxkey.authz.cas.endpoint.ticket.Ticket in project MaxKey by dromara.

the class InMemoryTicketGrantingTicketServices method remove.

@Override
public Ticket remove(String ticketId) {
    Ticket ticket = casTicketGrantingTicketStore.getIfPresent(ticketId);
    casTicketGrantingTicketStore.invalidate(ticketId);
    return ticket;
}

Example 7 with Ticket

use of org.maxkey.authz.cas.endpoint.ticket.Ticket in project MaxKey by dromara.

the class Cas10AuthorizeEndpoint method validate.

/**
 * @param request
 * @param response
 * @param ticket
 * @param service
 * @param renew
 * @return
 *
 *2.4. /validate [CAS 1.0]
 */validate checks the validity of a service ticket. /validate is part of the CAS 1.0 protocol and thus does not handle proxy authentication. CAS MUST respond with a ticket validation failure response when a proxy ticket is passed to /validate.
 *
 *2.4.1. parameters
 *The following HTTP request parameters MAY be specified to /validate. They are case sensitive and MUST all be handled by /validate.
 *
 *service [REQUIRED] - the identifier of the service for which the ticket was issued, as discussed in Section 2.2.1. As a HTTP request parameter, the service value MUST be URL-encoded as described in Section 2.2 of RFC 1738 [4].
 *
 *Note: It is STRONGLY RECOMMENDED that all service urls be filtered via the service management tool, such that only authorized and known client applications would be able to use the CAS server. Leaving the service management tool open to allow lenient access to all applications will potentially increase the risk of service attacks and other security vulnerabilities. Furthermore, it is RECOMMENDED that only secure protocols such as https be allowed for client applications for further strengthen the authenticating client.
 *
 *ticket [REQUIRED] - the service ticket issued by /login. Service tickets are described in Section 3.1.
 *
 *renew [OPTIONAL] - if this parameter is set, ticket validation will only succeed if the service ticket was issued from the presentation of the user��s primary credentials. It will fail if the ticket was issued from a single sign-on session.
 *
 *2.4.2. response
 */validate will return one of the following two responses:
 *			On ticket validation success:
 *			yes<LF>
 *			username<LF>
 *
 *			On ticket validation failure:
 *			no<LF>
 *			<LF>
 */
@Operation(summary = "CAS 1.0 ticket验证接口", description = "通过ticket获取当前登录用户信息", method = "POST")
@RequestMapping(CasConstants.ENDPOINT.ENDPOINT_VALIDATE)
@ResponseBody
public String validate(HttpServletRequest request, HttpServletResponse response, @RequestParam(value = CasConstants.PARAMETER.TICKET) String ticket, @RequestParam(value = CasConstants.PARAMETER.SERVICE) String service, @RequestParam(value = CasConstants.PARAMETER.RENEW, required = false) String renew) {
    _logger.debug("serviceValidate " + " ticket " + ticket + " , service " + service + " , renew " + renew);
    Ticket storedTicket = null;
    try {
        storedTicket = ticketServices.consumeTicket(ticket);
    } catch (Exception e) {
        _logger.error("consume Ticket error ", e);
    }
    if (storedTicket != null) {
        String principal = ((SigninPrincipal) storedTicket.getAuthentication().getPrincipal()).getUsername();
        _logger.debug("principal " + principal);
        return new Service10ResponseBuilder().success().setUser(principal).serviceResponseBuilder();
    } else {
        _logger.debug("Ticket not found .");
        return new Service10ResponseBuilder().failure().serviceResponseBuilder();
    }
}

Example 8 with Ticket

use of org.maxkey.authz.cas.endpoint.ticket.Ticket in project MaxKey by dromara.

the class Cas20AuthorizeEndpoint method serviceValidate.

/**
 * @param request
 * @param response
 * @param ticket
 * @param service
 * @param pgtUrl
 * @param renew
 * @param format
 * @return
 *2.5. /serviceValidate [CAS 2.0]
 */serviceValidate checks the validity of a service ticket and returns an XML-fragment response. /serviceValidate MUST also generate and issue proxy-granting tickets when requested. /serviceValidate MUST NOT return a successful authentication if it receives a proxy ticket. It is RECOMMENDED that if /serviceValidate receives a proxy ticket, the error message in the XML response SHOULD explain that validation failed because a proxy ticket was passed to /serviceValidate.
 *
 *2.5.1. parameters
 *The following HTTP request parameters MAY be specified to /serviceValidate. They are case sensitive and MUST all be handled by /serviceValidate.
 *
 *service [REQUIRED] - the identifier of the service for which the ticket was issued, as discussed in Section 2.2.1. As a HTTP request parameter, the service value MUST be URL-encoded as described in Section 2.2 of RFC 1738 [4].
 *
 *Note: It is STRONGLY RECOMMENDED that all service urls be filtered via the service management tool, such that only authorized and known client applications would be able to use the CAS server. Leaving the service management tool open to allow lenient access to all applications will potentially increase the risk of service attacks and other security vulnerabilities. Furthermore, it is RECOMMENDED that only secure protocols such as https be allowed for client applications for further strengthen the authenticating client.
 *
 *ticket [REQUIRED] - the service ticket issued by /login. Service tickets are described in Section 3.1.
 *
 *pgtUrl [OPTIONAL] - the URL of the proxy callback. Discussed in Section 2.5.4. As a HTTP request parameter, the ��pgtUrl�� value MUST be URL-encoded as described in Section 2.2 of RFC 1738 [4].
 *
 *renew [OPTIONAL] - if this parameter is set, ticket validation will only succeed if the service ticket was issued from the presentation of the user��s primary credentials. It will fail if the ticket was issued from a single sign-on session.
 *
 *format [OPTIONAL] - if this parameter is set, ticket validation response MUST be produced based on the parameter value. Supported values are XML and JSON. If this parameter is not set, the default XML format will be used. If the parameter value is not supported by the CAS server, an error code MUST be returned as is described in section 2.5.3.
 *
 *2.5.2. response
 * /serviceValidate will return an XML-formatted CAS serviceResponse as described in the XML schema in Appendix A. Below are example responses:
 *
 *	On ticket validation success:
 *		<cas:serviceResponse xmlns:cas="http://www.yale.edu/tp/cas">
 *		 <cas:authenticationSuccess>
 *		  <cas:user>username</cas:user>
 *		  <cas:proxyGrantingTicket>PGTIOU-84678-8a9d...</cas:proxyGrantingTicket>
 *		 </cas:authenticationSuccess>
 *		</cas:serviceResponse>
 *
 *		{
 *		  "serviceResponse" : {
 *		    "authenticationSuccess" : {
 *		      "user" : "username",
 *		      "proxyGrantingTicket" : "PGTIOU-84678-8a9d..."
 *		    }
 *		  }
 *		}
 *	On ticket validation failure:
 *		<cas:serviceResponse xmlns:cas="http://www.yale.edu/tp/cas">
 *		 <cas:authenticationFailure code="INVALID_TICKET">
 *		    Ticket ST-1856339-aA5Yuvrxzpv8Tau1cYQ7 not recognized
 *		  </cas:authenticationFailure>
 *		</cas:serviceResponse>
 *
 *		{
 *		  "serviceResponse" : {
 *		    "authenticationFailure" : {
 *		      "code" : "INVALID_TICKET",
 *		      "description" : "Ticket ST-1856339-aA5Yuvrxzpv8Tau1cYQ7 not recognized"
 *		    }
 *		  }
 *		}
 *
 *	Example response with custom attributes
 *		<cas:serviceResponse xmlns:cas="http://www.yale.edu/tp/cas">
 *		    <cas:authenticationSuccess>
 *		      <cas:user>username</cas:user>
 *		      <cas:attributes>
 *		        <cas:firstname>John</cas:firstname>
 *		        <cas:lastname>Doe</cas:lastname>
 *		        <cas:title>Mr.</cas:title>
 *		        <cas:email>jdoe@example.org</cas:email>
 *		        <cas:affiliation>staff</cas:affiliation>
 *		        <cas:affiliation>faculty</cas:affiliation>
 *		      </cas:attributes>
 *		      <cas:proxyGrantingTicket>PGTIOU-84678-8a9d...</cas:proxyGrantingTicket>
 *		    </cas:authenticationSuccess>
 *		  </cas:serviceResponse>
 *
 *		 {
 *		  "serviceResponse" : {
 *		    "authenticationSuccess" : {
 *		      "user" : "username",
 *		      "proxyGrantingTicket" : "PGTIOU-84678-8a9d...",
 *		      "proxies" : [ "https://proxy1/pgtUrl", "https://proxy2/pgtUrl" ],
 *		      "attributes" : {
 *		        "firstName" : "John",
 *		        "affiliation" : [ "staff", "faculty" ],
 *		        "title" : "Mr.",
 *		        "email" : "jdoe@example.orgmailto:jdoe@example.org",
 *		        "lastname" : "Doe"
 *		      }
 *		    }
 *		  }
 *		}
 *2.5.3. error codes
 *The following values MAY be used as the ��code�� attribute of authentication failure responses. The following is the minimum set of error codes that all CAS servers MUST implement. Implementations MAY include others.
 *
 *INVALID_REQUEST - not all of the required request parameters were present
 *
 *INVALID_TICKET_SPEC - failure to meet the requirements of validation specification
 *
 *UNAUTHORIZED_SERVICE_PROXY - the service is not authorized to perform proxy authentication
 *
 *INVALID_PROXY_CALLBACK - The proxy callback specified is invalid. The credentials specified for proxy authentication do not meet the security requirements
 *
 *INVALID_TICKET - the ticket provided was not valid, or the ticket did not come from an initial login and renew was set on validation. The body of the \<cas:authenticationFailure\> block of the XML response SHOULD describe the exact details.
 *
 *INVALID_SERVICE - the ticket provided was valid, but the service specified did not match the service associated with the ticket. CAS MUST invalidate the ticket and disallow future validation of that same ticket.
 *
 *INTERNAL_ERROR - an internal error occurred during ticket validation
 *
 *For all error codes, it is RECOMMENDED that CAS provide a more detailed message as the body of the \<cas:authenticationFailure\> block of the XML response.
 */
@Operation(summary = "CAS 2.0 ticket验证接口", description = "通过ticket获取当前登录用户信息", method = "POST")
@RequestMapping(value = CasConstants.ENDPOINT.ENDPOINT_SERVICE_VALIDATE, produces = MediaType.APPLICATION_XML_VALUE)
@ResponseBody
public String serviceValidate(HttpServletRequest request, HttpServletResponse response, @RequestParam(value = CasConstants.PARAMETER.TICKET) String ticket, @RequestParam(value = CasConstants.PARAMETER.SERVICE) String service, @RequestParam(value = CasConstants.PARAMETER.PROXY_CALLBACK_URL, required = false) String pgtUrl, @RequestParam(value = CasConstants.PARAMETER.RENEW, required = false) String renew, @RequestParam(value = CasConstants.PARAMETER.FORMAT, required = false, defaultValue = HttpResponseConstants.FORMAT_TYPE.XML) String format) {
    _logger.debug("serviceValidate " + " ticket " + ticket + " , service " + service + " , pgtUrl " + pgtUrl + " , renew " + renew + " , format " + format);
    Ticket storedTicket = null;
    if (ticket.startsWith(CasConstants.PREFIX.SERVICE_TICKET_PREFIX)) {
        try {
            storedTicket = ticketServices.consumeTicket(ticket);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
    ServiceResponseBuilder serviceResponseBuilder = new ServiceResponseBuilder();
    if (storedTicket != null) {
        SigninPrincipal authentication = ((SigninPrincipal) storedTicket.getAuthentication().getPrincipal());
        if (StringUtils.isNotBlank(pgtUrl)) {
            ProxyGrantingTicketIOUImpl proxyGrantingTicketIOUImpl = new ProxyGrantingTicketIOUImpl();
            String proxyGrantingTicketIOU = casProxyGrantingTicketServices.createTicket(proxyGrantingTicketIOUImpl);
            ProxyGrantingTicketImpl proxyGrantingTicketImpl = new ProxyGrantingTicketImpl(storedTicket.getAuthentication(), storedTicket.getCasDetails());
            String proxyGrantingTicket = casProxyGrantingTicketServices.createTicket(proxyGrantingTicketImpl);
            serviceResponseBuilder.success().setTicket(proxyGrantingTicketIOU);
            serviceResponseBuilder.success().setProxy(pgtUrl);
            httpRequestAdapter.post(pgtUrl + "?pgtId=" + proxyGrantingTicket + "&pgtIou=" + proxyGrantingTicketIOU, null);
        }
        if (ConstsBoolean.isTrue(storedTicket.getCasDetails().getIsAdapter())) {
            Object samlAdapter = Instance.newInstance(storedTicket.getCasDetails().getAdapter());
            try {
                BeanUtils.setProperty(samlAdapter, "serviceResponseBuilder", serviceResponseBuilder);
            } catch (IllegalAccessException | InvocationTargetException e) {
                _logger.error("setProperty error . ", e);
            }
            UserInfo userInfo = (UserInfo) userInfoService.findByUsername(authentication.getUsername());
            AbstractAuthorizeAdapter adapter = (AbstractAuthorizeAdapter) samlAdapter;
            adapter.setAuthentication(authentication);
            adapter.setUserInfo(userInfo);
            adapter.setApp(storedTicket.getCasDetails());
            adapter.generateInfo();
        }
    } else {
        serviceResponseBuilder.failure().setCode(CasConstants.ERROR_CODE.INVALID_TICKET).setDescription("Ticket " + ticket + " not recognized");
    }
    return serviceResponseBuilder.serviceResponseBuilder();
}

Example 9 with Ticket

use of org.maxkey.authz.cas.endpoint.ticket.Ticket in project MaxKey by dromara.

the class Cas20AuthorizeEndpoint method proxy.

/**
 * @param request
 * @param response
 * @param ticket
 * @param service
 * @param pgtUrl
 * @param renew
 * @return
 *2.6. /proxyValidate [CAS 2.0]
 */proxyValidate MUST perform the same validation tasks as /serviceValidate and additionally validate proxy tickets. /proxyValidate MUST be capable of validating both service tickets and proxy tickets. See Section 2.5.4 for details.
 *
 *2.6.1. parameters
 */proxyValidate has the same parameter requirements as /serviceValidate. See Section 2.5.1.
 *
 *2.6.2. response
 */proxyValidate will return an XML-formatted CAS serviceResponse as described in the XML schema in Appendix A. Below are example responses:
 *
 *Response on ticket validation success:
 *  <cas:serviceResponse xmlns:cas="http://www.yale.edu/tp/cas">
 *    <cas:authenticationSuccess>
 *      <cas:user>username</cas:user>
 *      <cas:proxyGrantingTicket>PGTIOU-84678-8a9d...</cas:proxyGrantingTicket>
 *      <cas:proxies>
 *        <cas:proxy>https://proxy2/pgtUrl</cas:proxy>
 *        <cas:proxy>https://proxy1/pgtUrl</cas:proxy>
 *      </cas:proxies>
 *    </cas:authenticationSuccess>
 *  </cas:serviceResponse>
 *
 *{
 *  "serviceResponse" : {
 *    "authenticationSuccess" : {
 *      "user" : "username",
 *      "proxyGrantingTicket" : "PGTIOU-84678-8a9d...",
 *      "proxies" : [ "https://proxy1/pgtUrl", "https://proxy2/pgtUrl" ]
 *    }
 *  }
 *}
 *
 *Note: when authentication has proceeded through multiple proxies, the order in which the proxies were traversed MUST be reflected in the <cas:proxies> block. The most recently-visited proxy MUST be the first proxy listed, and all the other proxies MUST be shifted down as new proxies are added. In the above example, the service identified by <https://proxy1/pgtUrl> was visited first, and that service proxied authentication to the service identified by <https://proxy2/pgtUrl>.
 *
 *Response on ticket validation failure:
 *
 *  <cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'>
 *      <cas:authenticationFailure code="INVALID_TICKET">
 *         ticket PT-1856376-1HMgO86Z2ZKeByc5XdYD not recognized
 *      </cas:authenticationFailure>
 *  </cas:serviceResponse>
 *
 *{
 *  "serviceResponse" : {
 *    "authenticationFailure" : {
 *      "code" : "INVALID_TICKET",
 *      "description" : "Ticket PT-1856339-aA5Yuvrxzpv8Tau1cYQ7 not recognized"
 *    }
 *  }
 *}
 */
@Operation(summary = "CAS 2.0 ticket代理验证接口", description = "通过ticket获取当前登录用户信息", method = "POST")
@RequestMapping(value = CasConstants.ENDPOINT.ENDPOINT_PROXY_VALIDATE, produces = MediaType.APPLICATION_XML_VALUE)
@ResponseBody
public String proxy(HttpServletRequest request, HttpServletResponse response, @RequestParam(value = CasConstants.PARAMETER.TICKET) String ticket, @RequestParam(value = CasConstants.PARAMETER.SERVICE) String service, @RequestParam(value = CasConstants.PARAMETER.PROXY_CALLBACK_URL, required = false) String pgtUrl, @RequestParam(value = CasConstants.PARAMETER.RENEW, required = false) String renew, @RequestParam(value = CasConstants.PARAMETER.FORMAT, required = false, defaultValue = HttpResponseConstants.FORMAT_TYPE.XML) String format) {
    _logger.debug("proxyValidate " + " ticket " + ticket + " , service " + service + " , pgtUrl " + pgtUrl + " , renew " + renew + " , format " + format);
    Ticket storedTicket = null;
    if (ticket.startsWith(CasConstants.PREFIX.PROXY_TICKET_PREFIX)) {
        try {
            storedTicket = ticketServices.consumeTicket(ticket);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
    ServiceResponseBuilder serviceResponseBuilder = new ServiceResponseBuilder();
    if (storedTicket != null) {
        SigninPrincipal authentication = ((SigninPrincipal) storedTicket.getAuthentication().getPrincipal());
        if (ConstsBoolean.isTrue(storedTicket.getCasDetails().getIsAdapter())) {
            Object samlAdapter = Instance.newInstance(storedTicket.getCasDetails().getAdapter());
            try {
                BeanUtils.setProperty(samlAdapter, "serviceResponseBuilder", serviceResponseBuilder);
            } catch (IllegalAccessException | InvocationTargetException e) {
                _logger.error("setProperty error . ", e);
            }
            UserInfo userInfo = (UserInfo) userInfoService.findByUsername(authentication.getUsername());
            AbstractAuthorizeAdapter adapter = (AbstractAuthorizeAdapter) samlAdapter;
            adapter.setAuthentication(authentication);
            adapter.setUserInfo(userInfo);
            adapter.setApp(storedTicket.getCasDetails());
            adapter.generateInfo();
        }
    } else {
        serviceResponseBuilder.failure().setCode(CasConstants.ERROR_CODE.INVALID_TICKET).setDescription("Ticket " + ticket + " not recognized");
    }
    return serviceResponseBuilder.serviceResponseBuilder();
}

Example 10 with Ticket

use of org.maxkey.authz.cas.endpoint.ticket.Ticket in project MaxKey by dromara.

the class Cas30AuthorizeEndpoint method serviceValidate.

@Operation(summary = "CAS 3.0 ticket验证接口", description = "通过ticket获取当前登录用户信息", method = "POST")
@RequestMapping(value = CasConstants.ENDPOINT.ENDPOINT_SERVICE_VALIDATE_V3)
public void serviceValidate(HttpServletRequest request, HttpServletResponse response, @RequestParam(value = CasConstants.PARAMETER.TICKET) String ticket, @RequestParam(value = CasConstants.PARAMETER.SERVICE) String service, @RequestParam(value = CasConstants.PARAMETER.PROXY_CALLBACK_URL, required = false) String pgtUrl, @RequestParam(value = CasConstants.PARAMETER.RENEW, required = false) String renew, @RequestParam(value = CasConstants.PARAMETER.FORMAT, required = false, defaultValue = HttpResponseConstants.FORMAT_TYPE.XML) String format) {
    _logger.debug("serviceValidate " + " ticket " + ticket + " , service " + service + " , pgtUrl " + pgtUrl + " , renew " + renew + " , format " + format);
    Ticket storedTicket = null;
    if (ticket.startsWith(CasConstants.PREFIX.SERVICE_TICKET_PREFIX)) {
        try {
            storedTicket = ticketServices.consumeTicket(ticket);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
    ServiceResponseBuilder serviceResponseBuilder = new ServiceResponseBuilder();
    if (storedTicket != null) {
        SigninPrincipal authentication = ((SigninPrincipal) storedTicket.getAuthentication().getPrincipal());
        if (StringUtils.isNotBlank(pgtUrl)) {
            ProxyGrantingTicketIOUImpl proxyGrantingTicketIOUImpl = new ProxyGrantingTicketIOUImpl();
            String proxyGrantingTicketIOU = casProxyGrantingTicketServices.createTicket(proxyGrantingTicketIOUImpl);
            ProxyGrantingTicketImpl proxyGrantingTicketImpl = new ProxyGrantingTicketImpl(storedTicket.getAuthentication(), storedTicket.getCasDetails());
            String proxyGrantingTicket = casProxyGrantingTicketServices.createTicket(proxyGrantingTicketImpl);
            serviceResponseBuilder.success().setTicket(proxyGrantingTicketIOU);
            serviceResponseBuilder.success().setProxy(pgtUrl);
            httpRequestAdapter.post(pgtUrl + "?pgtId=" + proxyGrantingTicket + "&pgtIou=" + proxyGrantingTicketIOU, null);
        }
        if (ConstsBoolean.isTrue(storedTicket.getCasDetails().getIsAdapter())) {
            Object samlAdapter = Instance.newInstance(storedTicket.getCasDetails().getAdapter());
            try {
                BeanUtils.setProperty(samlAdapter, "serviceResponseBuilder", serviceResponseBuilder);
            } catch (IllegalAccessException | InvocationTargetException e) {
                _logger.error("setProperty error . ", e);
            }
            UserInfo userInfo = (UserInfo) userInfoService.findByUsername(authentication.getUsername());
            AbstractAuthorizeAdapter adapter = (AbstractAuthorizeAdapter) samlAdapter;
            adapter.setAuthentication(authentication);
            adapter.setUserInfo(userInfo);
            adapter.setApp(storedTicket.getCasDetails());
            adapter.generateInfo();
        }
    } else {
        serviceResponseBuilder.failure().setCode(CasConstants.ERROR_CODE.INVALID_TICKET).setDescription("Ticket " + ticket + " not recognized");
    }
    httpResponseAdapter.write(response, serviceResponseBuilder.serviceResponseBuilder(), format);
}