KEYCLOAK-8397 Remove deprecated Keycloak Proxy
This commit is contained in:
stianst
Bruno Oliveira da Silva
parent
b5fbc04e5e
commit
8dfd07662c
29 changed files with 1 additions and 2890 deletions
|
|
@ -1,7 +1,6 @@
|
|||
./
|
||||
keycloak-server-dist:keycloak
|
||||
keycloak-server-overlay:keycloak-overlay
|
||||
keycloak-proxy-dist:keycloak-proxy
|
||||
keycloak-api-docs-dist:keycloak-api-docs
|
||||
keycloak-examples-dist:keycloak-examples
|
||||
|
||||
|
|
|
|||
|
|
@ -51,7 +51,6 @@
|
|||
<modules>
|
||||
<module>api-docs-dist</module>
|
||||
<module>examples-dist</module>
|
||||
<module>proxy-dist</module>
|
||||
<module>downloads</module>
|
||||
</modules>
|
||||
</profile>
|
||||
|
|
|
|||
|
|
@ -1,58 +0,0 @@
|
|||
<!--
|
||||
~ Copyright 2016 Red Hat, Inc. and/or its affiliates
|
||||
~ and other contributors as indicated by the @author tags.
|
||||
~
|
||||
~ Licensed under the Apache License, Version 2.0 (the "License");
|
||||
~ you may not use this file except in compliance with the License.
|
||||
~ You may obtain a copy of the License at
|
||||
~
|
||||
~ http://www.apache.org/licenses/LICENSE-2.0
|
||||
~
|
||||
~ Unless required by applicable law or agreed to in writing, software
|
||||
~ distributed under the License is distributed on an "AS IS" BASIS,
|
||||
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
~ See the License for the specific language governing permissions and
|
||||
~ limitations under the License.
|
||||
-->
|
||||
|
||||
<assembly>
|
||||
<id>proxy-dist</id>
|
||||
|
||||
<formats>
|
||||
<format>zip</format>
|
||||
</formats>
|
||||
|
||||
<includeBaseDirectory>true</includeBaseDirectory>
|
||||
|
||||
<fileSets>
|
||||
<fileSet>
|
||||
<directory>../../</directory>
|
||||
<includes>
|
||||
<include>License.html</include>
|
||||
</includes>
|
||||
<outputDirectory></outputDirectory>
|
||||
</fileSet>
|
||||
</fileSets>
|
||||
|
||||
<dependencySets>
|
||||
<dependencySet>
|
||||
<unpack>false</unpack>
|
||||
<useTransitiveDependencies>true</useTransitiveDependencies>
|
||||
<useTransitiveFiltering>true</useTransitiveFiltering>
|
||||
<includes>
|
||||
<include>org.keycloak:launcher</include>
|
||||
</includes>
|
||||
<outputFileNameMapping>${artifact.artifactId}.${artifact.extension}</outputFileNameMapping>
|
||||
<outputDirectory>bin</outputDirectory>
|
||||
</dependencySet>
|
||||
<dependencySet>
|
||||
<unpack>false</unpack>
|
||||
<useTransitiveDependencies>true</useTransitiveDependencies>
|
||||
<useTransitiveFiltering>true</useTransitiveFiltering>
|
||||
<includes>
|
||||
<include>org.keycloak:keycloak-proxy-server</include>
|
||||
</includes>
|
||||
<outputDirectory>lib</outputDirectory>
|
||||
</dependencySet>
|
||||
</dependencySets>
|
||||
</assembly>
|
||||
|
|
@ -1,83 +0,0 @@
|
|||
<!--
|
||||
~ Copyright 2016 Red Hat, Inc. and/or its affiliates
|
||||
~ and other contributors as indicated by the @author tags.
|
||||
~
|
||||
~ Licensed under the Apache License, Version 2.0 (the "License");
|
||||
~ you may not use this file except in compliance with the License.
|
||||
~ You may obtain a copy of the License at
|
||||
~
|
||||
~ http://www.apache.org/licenses/LICENSE-2.0
|
||||
~
|
||||
~ Unless required by applicable law or agreed to in writing, software
|
||||
~ distributed under the License is distributed on an "AS IS" BASIS,
|
||||
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
~ See the License for the specific language governing permissions and
|
||||
~ limitations under the License.
|
||||
-->
|
||||
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
<parent>
|
||||
<artifactId>keycloak-distribution-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>5.0.0-SNAPSHOT</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>keycloak-proxy-dist</artifactId>
|
||||
<packaging>pom</packaging>
|
||||
<name>Proxy Distro</name>
|
||||
<description/>
|
||||
|
||||
<profiles>
|
||||
<profile>
|
||||
<id>community</id>
|
||||
<activation>
|
||||
<property>
|
||||
<name>!product</name>
|
||||
</property>
|
||||
</activation>
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>launcher</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-proxy-server</artifactId>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
|
||||
<build>
|
||||
<finalName>keycloak-proxy-${project.version}</finalName>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<artifactId>maven-assembly-plugin</artifactId>
|
||||
<executions>
|
||||
<execution>
|
||||
<id>assemble</id>
|
||||
<phase>package</phase>
|
||||
<goals>
|
||||
<goal>single</goal>
|
||||
</goals>
|
||||
<configuration>
|
||||
<descriptors>
|
||||
<descriptor>assembly.xml</descriptor>
|
||||
</descriptors>
|
||||
<outputDirectory>
|
||||
target
|
||||
</outputDirectory>
|
||||
<workDirectory>
|
||||
target/assembly/work
|
||||
</workDirectory>
|
||||
<appendAssemblyId>false</appendAssemblyId>
|
||||
</configuration>
|
||||
</execution>
|
||||
</executions>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
</profile>
|
||||
</profiles>
|
||||
|
||||
</project>
|
||||
14
pom.xml
14
pom.xml
|
|
@ -1081,11 +1081,6 @@
|
|||
<artifactId>launcher</artifactId>
|
||||
<version>${project.version}</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-proxy-server</artifactId>
|
||||
<version>${project.version}</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-saml-core</artifactId>
|
||||
|
|
@ -1269,12 +1264,6 @@
|
|||
<version>${project.version}</version>
|
||||
<type>zip</type>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-proxy-dist</artifactId>
|
||||
<version>${project.version}</version>
|
||||
<type>zip</type>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-examples-dist</artifactId>
|
||||
|
|
@ -1666,9 +1655,6 @@
|
|||
<product.version>${project.version}</product.version>
|
||||
<product.default-profile>community</product.default-profile>
|
||||
</properties>
|
||||
<modules>
|
||||
<module>proxy</module>
|
||||
</modules>
|
||||
</profile>
|
||||
|
||||
<profile>
|
||||
|
|
|
|||
|
|
@ -1,52 +0,0 @@
|
|||
<?xml version="1.0"?>
|
||||
<!--
|
||||
~ Copyright 2016 Red Hat, Inc. and/or its affiliates
|
||||
~ and other contributors as indicated by the @author tags.
|
||||
~
|
||||
~ Licensed under the Apache License, Version 2.0 (the "License");
|
||||
~ you may not use this file except in compliance with the License.
|
||||
~ You may obtain a copy of the License at
|
||||
~
|
||||
~ http://www.apache.org/licenses/LICENSE-2.0
|
||||
~
|
||||
~ Unless required by applicable law or agreed to in writing, software
|
||||
~ distributed under the License is distributed on an "AS IS" BASIS,
|
||||
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
~ See the License for the specific language governing permissions and
|
||||
~ limitations under the License.
|
||||
-->
|
||||
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>5.0.0-SNAPSHOT</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
<artifactId>launcher</artifactId>
|
||||
<name>Keycloak Launcher</name>
|
||||
<description/>
|
||||
|
||||
<dependencies>
|
||||
|
||||
</dependencies>
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-jar-plugin</artifactId>
|
||||
<configuration>
|
||||
<archive>
|
||||
<manifest>
|
||||
<mainClass>org.keycloak.Launcher</mainClass>
|
||||
</manifest>
|
||||
</archive>
|
||||
</configuration>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
|
||||
</project>
|
||||
|
|
@ -1,83 +0,0 @@
|
|||
/*
|
||||
* Copyright 2016 Red Hat, Inc. and/or its affiliates
|
||||
* and other contributors as indicated by the @author tags.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.keycloak;
|
||||
|
||||
import java.io.File;
|
||||
import java.lang.reflect.Method;
|
||||
import java.net.URI;
|
||||
import java.net.URISyntaxException;
|
||||
import java.net.URL;
|
||||
import java.net.URLClassLoader;
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
import java.util.regex.Matcher;
|
||||
import java.util.regex.Pattern;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
|
||||
* @version $Revision: 1 $
|
||||
*/
|
||||
public class Launcher {
|
||||
|
||||
public static File getHome() {
|
||||
String launcherPath = Launcher.class.getName().replace('.', '/') + ".class";
|
||||
URL jarfile = Launcher.class.getClassLoader().getResource(launcherPath);
|
||||
if (jarfile != null) {
|
||||
Matcher m = Pattern.compile("jar:(file:.*)!/" + launcherPath).matcher(jarfile.toString());
|
||||
if (m.matches()) {
|
||||
try {
|
||||
File jarPath = new File(new URI(m.group(1)));
|
||||
File libPath = jarPath.getParentFile().getParentFile();
|
||||
System.out.println("Home directory: " + libPath.toString());
|
||||
if (!libPath.exists()) {
|
||||
System.exit(1);
|
||||
|
||||
}
|
||||
return libPath;
|
||||
} catch (URISyntaxException e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
System.err.println("jar file null: " + launcherPath);
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
|
||||
File home = getHome();
|
||||
File lib = new File(home, "lib");
|
||||
if (!lib.exists()) {
|
||||
System.err.println("Could not find lib directory: " + lib.toString());
|
||||
System.exit(1);
|
||||
}
|
||||
List<URL> jars = new ArrayList<URL>();
|
||||
for (File file : lib.listFiles()) {
|
||||
jars.add(file.toURI().toURL());
|
||||
}
|
||||
URL[] urls = jars.toArray(new URL[jars.size()]);
|
||||
URLClassLoader loader = new URLClassLoader(urls, Launcher.class.getClassLoader());
|
||||
|
||||
Class mainClass = loader.loadClass("org.keycloak.proxy.Main");
|
||||
Method mainMethod = null;
|
||||
for (Method m : mainClass.getMethods()) if (m.getName().equals("main")) { mainMethod = m; break; }
|
||||
Object obj = args;
|
||||
mainMethod.invoke(null, obj);
|
||||
}
|
||||
}
|
||||
|
|
@ -1,48 +0,0 @@
|
|||
<!--
|
||||
~ Copyright 2016 Red Hat, Inc. and/or its affiliates
|
||||
~ and other contributors as indicated by the @author tags.
|
||||
~
|
||||
~ Licensed under the Apache License, Version 2.0 (the "License");
|
||||
~ you may not use this file except in compliance with the License.
|
||||
~ You may obtain a copy of the License at
|
||||
~
|
||||
~ http://www.apache.org/licenses/LICENSE-2.0
|
||||
~
|
||||
~ Unless required by applicable law or agreed to in writing, software
|
||||
~ distributed under the License is distributed on an "AS IS" BASIS,
|
||||
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
~ See the License for the specific language governing permissions and
|
||||
~ limitations under the License.
|
||||
-->
|
||||
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>5.0.0-SNAPSHOT</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<name>Keycloak Proxy</name>
|
||||
<description/>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
<artifactId>keycloak-proxy-pom</artifactId>
|
||||
<packaging>pom</packaging>
|
||||
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-deploy-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>true</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
<modules>
|
||||
<module>launcher</module>
|
||||
<module>proxy-server</module>
|
||||
</modules>
|
||||
</project>
|
||||
|
|
@ -1,81 +0,0 @@
|
|||
<?xml version="1.0"?>
|
||||
<!--
|
||||
~ Copyright 2016 Red Hat, Inc. and/or its affiliates
|
||||
~ and other contributors as indicated by the @author tags.
|
||||
~
|
||||
~ Licensed under the Apache License, Version 2.0 (the "License");
|
||||
~ you may not use this file except in compliance with the License.
|
||||
~ You may obtain a copy of the License at
|
||||
~
|
||||
~ http://www.apache.org/licenses/LICENSE-2.0
|
||||
~
|
||||
~ Unless required by applicable law or agreed to in writing, software
|
||||
~ distributed under the License is distributed on an "AS IS" BASIS,
|
||||
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
~ See the License for the specific language governing permissions and
|
||||
~ limitations under the License.
|
||||
-->
|
||||
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>5.0.0-SNAPSHOT</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
<artifactId>keycloak-proxy-server</artifactId>
|
||||
<name>Keycloak Proxy Server</name>
|
||||
<description/>
|
||||
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>org.jboss.logging</groupId>
|
||||
<artifactId>jboss-logging</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-core</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-undertow-adapter</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-adapter-core</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.apache.httpcomponents</groupId>
|
||||
<artifactId>httpclient</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.bouncycastle</groupId>
|
||||
<artifactId>bcprov-jdk15on</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>com.fasterxml.jackson.core</groupId>
|
||||
<artifactId>jackson-core</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>com.fasterxml.jackson.core</groupId>
|
||||
<artifactId>jackson-databind</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>com.fasterxml.jackson.core</groupId>
|
||||
<artifactId>jackson-annotations</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>io.undertow</groupId>
|
||||
<artifactId>undertow-core</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>junit</groupId>
|
||||
<artifactId>junit</artifactId>
|
||||
<scope>test</scope>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
|
||||
</project>
|
||||
|
|
@ -1,124 +0,0 @@
|
|||
/*
|
||||
* Copyright 2016 Red Hat, Inc. and/or its affiliates
|
||||
* and other contributors as indicated by the @author tags.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.keycloak.proxy;
|
||||
|
||||
import io.undertow.server.HttpHandler;
|
||||
import io.undertow.server.HttpServerExchange;
|
||||
import io.undertow.util.HttpString;
|
||||
import org.keycloak.adapters.undertow.KeycloakUndertowAccount;
|
||||
import org.keycloak.representations.IDToken;
|
||||
|
||||
import java.util.HashMap;
|
||||
import java.util.Map;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
|
||||
* @version $Revision: 1 $
|
||||
*/
|
||||
public class ConstraintAuthorizationHandler implements HttpHandler {
|
||||
|
||||
public static final String KEYCLOAK_SUBJECT = "KEYCLOAK_SUBJECT";
|
||||
public static final String KEYCLOAK_USERNAME = "KEYCLOAK_USERNAME";
|
||||
public static final String KEYCLOAK_EMAIL = "KEYCLOAK_EMAIL";
|
||||
public static final String KEYCLOAK_NAME = "KEYCLOAK_NAME";
|
||||
public static final String KEYCLOAK_ACCESS_TOKEN = "KEYCLOAK_ACCESS_TOKEN";
|
||||
private final Map<String, HttpString> httpHeaderNames;
|
||||
|
||||
protected HttpHandler next;
|
||||
protected String errorPage;
|
||||
protected boolean sendAccessToken;
|
||||
|
||||
public ConstraintAuthorizationHandler(HttpHandler next, String errorPage, boolean sendAccessToken, Map<String, String> headerNames) {
|
||||
this.next = next;
|
||||
this.errorPage = errorPage;
|
||||
this.sendAccessToken = sendAccessToken;
|
||||
|
||||
this.httpHeaderNames = new HashMap<>();
|
||||
this.httpHeaderNames.put(KEYCLOAK_SUBJECT, new HttpString(getOrDefault(headerNames, "keycloak-subject", KEYCLOAK_SUBJECT)));
|
||||
this.httpHeaderNames.put(KEYCLOAK_USERNAME, new HttpString(getOrDefault(headerNames, "keycloak-username", KEYCLOAK_USERNAME)));
|
||||
this.httpHeaderNames.put(KEYCLOAK_EMAIL, new HttpString(getOrDefault(headerNames, "keycloak-email", KEYCLOAK_EMAIL)));
|
||||
this.httpHeaderNames.put(KEYCLOAK_NAME, new HttpString(getOrDefault(headerNames, "keycloak-name", KEYCLOAK_NAME)));
|
||||
this.httpHeaderNames.put(KEYCLOAK_ACCESS_TOKEN, new HttpString(getOrDefault(headerNames, "keycloak-access-token", KEYCLOAK_ACCESS_TOKEN)));
|
||||
}
|
||||
|
||||
private String getOrDefault(Map<String, String> map, String key, String defaultValue) {
|
||||
return map.containsKey(key) ? map.get(key) : defaultValue;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void handleRequest(HttpServerExchange exchange) throws Exception {
|
||||
|
||||
KeycloakUndertowAccount account = (KeycloakUndertowAccount)exchange.getSecurityContext().getAuthenticatedAccount();
|
||||
|
||||
SingleConstraintMatch match = exchange.getAttachment(ConstraintMatcherHandler.CONSTRAINT_KEY);
|
||||
if (match == null || (match.getRequiredRoles().isEmpty() && match.getEmptyRoleSemantic() == SecurityInfo.EmptyRoleSemantic.AUTHENTICATE)) {
|
||||
authenticatedRequest(account, exchange);
|
||||
return;
|
||||
}
|
||||
|
||||
if (match != null) {
|
||||
if(SecurityInfo.EmptyRoleSemantic.PERMIT_AND_INJECT_IF_AUTHENTICATED.equals(match.getEmptyRoleSemantic())) {
|
||||
authenticatedRequest(account, exchange);
|
||||
return;
|
||||
} else {
|
||||
for (String role : match.getRequiredRoles()) {
|
||||
if (account.getRoles().contains(role)) {
|
||||
authenticatedRequest(account, exchange);
|
||||
return;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (errorPage != null) {
|
||||
exchange.setRequestPath(errorPage);
|
||||
exchange.setRelativePath(errorPage);
|
||||
exchange.setResolvedPath(errorPage);
|
||||
next.handleRequest(exchange);
|
||||
return;
|
||||
|
||||
}
|
||||
exchange.setResponseCode(403);
|
||||
exchange.endExchange();
|
||||
|
||||
}
|
||||
|
||||
public void authenticatedRequest(KeycloakUndertowAccount account, HttpServerExchange exchange) throws Exception {
|
||||
if (account != null) {
|
||||
IDToken idToken = account.getKeycloakSecurityContext().getToken();
|
||||
if (idToken == null) return;
|
||||
if (idToken.getSubject() != null) {
|
||||
exchange.getRequestHeaders().put(httpHeaderNames.get(KEYCLOAK_SUBJECT), idToken.getSubject());
|
||||
}
|
||||
|
||||
if (idToken.getPreferredUsername() != null) {
|
||||
exchange.getRequestHeaders().put(httpHeaderNames.get(KEYCLOAK_USERNAME), idToken.getPreferredUsername());
|
||||
}
|
||||
if (idToken.getEmail() != null) {
|
||||
exchange.getRequestHeaders().put(httpHeaderNames.get(KEYCLOAK_EMAIL), idToken.getEmail());
|
||||
}
|
||||
if (idToken.getName() != null) {
|
||||
exchange.getRequestHeaders().put(httpHeaderNames.get(KEYCLOAK_NAME), idToken.getName());
|
||||
}
|
||||
if (sendAccessToken) {
|
||||
exchange.getRequestHeaders().put(httpHeaderNames.get(KEYCLOAK_ACCESS_TOKEN), account.getKeycloakSecurityContext().getTokenString());
|
||||
}
|
||||
}
|
||||
next.handleRequest(exchange);
|
||||
}
|
||||
}
|
||||
|
|
@ -1,106 +0,0 @@
|
|||
/*
|
||||
* Copyright 2016 Red Hat, Inc. and/or its affiliates
|
||||
* and other contributors as indicated by the @author tags.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.keycloak.proxy;
|
||||
|
||||
import io.undertow.security.api.AuthenticationMechanism;
|
||||
import io.undertow.server.HttpHandler;
|
||||
import io.undertow.server.HttpServerExchange;
|
||||
import io.undertow.util.AttachmentKey;
|
||||
import org.jboss.logging.Logger;
|
||||
|
||||
import java.util.List;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
|
||||
* @version $Revision: 1 $
|
||||
*/
|
||||
public class ConstraintMatcherHandler implements HttpHandler {
|
||||
protected static Logger log = Logger.getLogger(ConstraintMatcherHandler.class);
|
||||
public static final AttachmentKey<SingleConstraintMatch> CONSTRAINT_KEY = AttachmentKey.create(SingleConstraintMatch.class);
|
||||
protected SecurityPathMatches matcher;
|
||||
protected HttpHandler securedHandler;
|
||||
protected HttpHandler unsecuredHandler;
|
||||
protected String errorPage;
|
||||
|
||||
public ConstraintMatcherHandler(SecurityPathMatches matcher, HttpHandler securedHandler, HttpHandler unsecuredHandler, String errorPage) {
|
||||
this.matcher = matcher;
|
||||
this.securedHandler = securedHandler;
|
||||
this.unsecuredHandler = unsecuredHandler;
|
||||
this.errorPage = errorPage;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void handleRequest(HttpServerExchange exchange) throws Exception {
|
||||
log.debugv("ConstraintMatcherHandler: {0}", exchange.getRelativePath());
|
||||
SingleConstraintMatch match = matcher.getSecurityInfo(exchange.getRelativePath(), exchange.getRequestMethod().toString());
|
||||
if (match == null || (match.getRequiredRoles().isEmpty() && match.getEmptyRoleSemantic() == SecurityInfo.EmptyRoleSemantic.PERMIT)) {
|
||||
unsecuredHandler.handleRequest(exchange);
|
||||
return;
|
||||
}
|
||||
|
||||
if (match.getRequiredRoles().isEmpty() && match.getEmptyRoleSemantic() == SecurityInfo.EmptyRoleSemantic.DENY) {
|
||||
if (errorPage != null) {
|
||||
exchange.setRequestPath(errorPage);
|
||||
exchange.setRelativePath(errorPage);
|
||||
exchange.setResolvedPath(errorPage);
|
||||
unsecuredHandler.handleRequest(exchange);
|
||||
} else {
|
||||
exchange.setResponseCode(403);
|
||||
exchange.endExchange();
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
if (match.getRequiredRoles().isEmpty()
|
||||
&& match.getEmptyRoleSemantic() == SecurityInfo.EmptyRoleSemantic.PERMIT_AND_INJECT_IF_AUTHENTICATED) {
|
||||
|
||||
boolean successfulAuthenticatedMethodFound = isSuccessfulAuthenticatedMethodFound(exchange);
|
||||
|
||||
if(successfulAuthenticatedMethodFound) {
|
||||
//in case of authenticated we go for injecting headers
|
||||
exchange.putAttachment(CONSTRAINT_KEY, match);
|
||||
securedHandler.handleRequest(exchange);
|
||||
return;
|
||||
} else {
|
||||
//in case of not authenticated we just show the resource
|
||||
unsecuredHandler.handleRequest(exchange);
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
log.debug("found constraint");
|
||||
exchange.getSecurityContext().setAuthenticationRequired();
|
||||
exchange.putAttachment(CONSTRAINT_KEY, match);
|
||||
securedHandler.handleRequest(exchange);
|
||||
|
||||
}
|
||||
|
||||
private boolean isSuccessfulAuthenticatedMethodFound(HttpServerExchange exchange) {
|
||||
boolean successfulAuthenticatedMethodFound = false;
|
||||
List<AuthenticationMechanism> authenticationMechanisms = exchange.getSecurityContext().getAuthenticationMechanisms();
|
||||
|
||||
for (AuthenticationMechanism authenticationMechanism : authenticationMechanisms) {
|
||||
AuthenticationMechanism.AuthenticationMechanismOutcome authenticationMechanismOutcome =
|
||||
authenticationMechanism.authenticate(exchange, exchange.getSecurityContext());
|
||||
if(authenticationMechanismOutcome.equals(AuthenticationMechanism.AuthenticationMechanismOutcome.AUTHENTICATED)) {
|
||||
successfulAuthenticatedMethodFound = true;
|
||||
}
|
||||
}
|
||||
return successfulAuthenticatedMethodFound;
|
||||
}
|
||||
}
|
||||
|
|
@ -1,45 +0,0 @@
|
|||
/*
|
||||
* Copyright 2016 Red Hat, Inc. and/or its affiliates
|
||||
* and other contributors as indicated by the @author tags.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.keycloak.proxy;
|
||||
|
||||
import io.undertow.Undertow;
|
||||
|
||||
import java.io.File;
|
||||
import java.io.FileInputStream;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
|
||||
* @version $Revision: 1 $
|
||||
*/
|
||||
public class Main {
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
String jsonConfig = "proxy.json";
|
||||
if (args.length > 0) jsonConfig = args[0];
|
||||
File file = new File(jsonConfig);
|
||||
if (!file.exists()) {
|
||||
System.err.println("No proxy config argument and could not find default file proxy.json");
|
||||
System.exit(1);
|
||||
return;
|
||||
}
|
||||
FileInputStream fis = new FileInputStream(file);
|
||||
Undertow proxyServer = ProxyServerBuilder.build(fis);
|
||||
proxyServer.start();
|
||||
|
||||
}
|
||||
}
|
||||
|
|
@ -1,52 +0,0 @@
|
|||
/*
|
||||
* Copyright 2016 Red Hat, Inc. and/or its affiliates
|
||||
* and other contributors as indicated by the @author tags.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.keycloak.proxy;
|
||||
|
||||
import io.undertow.security.api.SecurityContext;
|
||||
import io.undertow.server.HttpHandler;
|
||||
import io.undertow.server.HttpServerExchange;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
|
||||
* @version $Revision: 1 $
|
||||
*/
|
||||
public class ProxyAuthenticationCallHandler implements HttpHandler {
|
||||
|
||||
private final HttpHandler next;
|
||||
|
||||
public ProxyAuthenticationCallHandler(final HttpHandler next) {
|
||||
this.next = next;
|
||||
}
|
||||
|
||||
/**
|
||||
* Only allow the request through if successfully authenticated or if authentication is not required.
|
||||
*
|
||||
* @see io.undertow.server.HttpHandler#handleRequest(io.undertow.server.HttpServerExchange)
|
||||
*/
|
||||
@Override
|
||||
public void handleRequest(final HttpServerExchange exchange) throws Exception {
|
||||
SecurityContext context = exchange.getSecurityContext();
|
||||
if (context.authenticate()) {
|
||||
if(!exchange.isComplete()) {
|
||||
next.handleRequest(exchange);
|
||||
}
|
||||
} else {
|
||||
exchange.endExchange();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -1,332 +0,0 @@
|
|||
/*
|
||||
* Copyright 2016 Red Hat, Inc. and/or its affiliates
|
||||
* and other contributors as indicated by the @author tags.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.keycloak.proxy;
|
||||
|
||||
import com.fasterxml.jackson.annotation.JsonProperty;
|
||||
import org.keycloak.representations.adapters.config.AdapterConfig;
|
||||
|
||||
import java.util.HashMap;
|
||||
import java.util.HashSet;
|
||||
import java.util.LinkedList;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.Set;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
|
||||
* @version $Revision: 1 $
|
||||
*/
|
||||
public class ProxyConfig {
|
||||
@JsonProperty("bind-address")
|
||||
protected String bindAddress = "localhost";
|
||||
@JsonProperty("http-port")
|
||||
protected Integer httpPort;
|
||||
@JsonProperty("https-port")
|
||||
protected Integer httpsPort;
|
||||
@JsonProperty("keystore")
|
||||
protected String keystore;
|
||||
@JsonProperty("keystore-password")
|
||||
protected String keystorePassword;
|
||||
@JsonProperty("key-password")
|
||||
protected String keyPassword;
|
||||
@JsonProperty("buffer-size")
|
||||
protected Integer bufferSize;
|
||||
@JsonProperty("buffers-per-region")
|
||||
protected Integer buffersPerRegion;
|
||||
@JsonProperty("io-threads")
|
||||
protected Integer ioThreads;
|
||||
@JsonProperty("worker-threads")
|
||||
protected Integer workerThreads;
|
||||
@JsonProperty("direct-buffers")
|
||||
protected Boolean directBuffers;
|
||||
@JsonProperty("target-url")
|
||||
protected String targetUrl;
|
||||
/** Defaults to 30 seconds */
|
||||
@JsonProperty("target-request-timeout")
|
||||
protected Integer targetRequestTimeout = 30000;
|
||||
@JsonProperty("send-access-token")
|
||||
protected boolean sendAccessToken;
|
||||
@JsonProperty("applications")
|
||||
protected List<Application> applications = new LinkedList<Application>();
|
||||
@JsonProperty("header-names")
|
||||
private Map<String,String> headerNames = new HashMap<>();
|
||||
|
||||
public String getBindAddress() {
|
||||
return bindAddress;
|
||||
}
|
||||
|
||||
public void setBindAddress(String bindAddress) {
|
||||
this.bindAddress = bindAddress;
|
||||
}
|
||||
|
||||
public Integer getHttpPort() {
|
||||
return httpPort;
|
||||
}
|
||||
|
||||
public void setHttpPort(Integer httpPort) {
|
||||
this.httpPort = httpPort;
|
||||
}
|
||||
|
||||
public Integer getHttpsPort() {
|
||||
return httpsPort;
|
||||
}
|
||||
|
||||
public void setHttpsPort(Integer httpsPort) {
|
||||
this.httpsPort = httpsPort;
|
||||
}
|
||||
|
||||
public String getKeystore() {
|
||||
return keystore;
|
||||
}
|
||||
|
||||
public void setKeystore(String keystore) {
|
||||
this.keystore = keystore;
|
||||
}
|
||||
|
||||
public String getKeystorePassword() {
|
||||
return keystorePassword;
|
||||
}
|
||||
|
||||
public void setKeystorePassword(String keystorePassword) {
|
||||
this.keystorePassword = keystorePassword;
|
||||
}
|
||||
|
||||
public String getKeyPassword() {
|
||||
return keyPassword;
|
||||
}
|
||||
|
||||
public void setKeyPassword(String keyPassword) {
|
||||
this.keyPassword = keyPassword;
|
||||
}
|
||||
|
||||
public Integer getBufferSize() {
|
||||
return bufferSize;
|
||||
}
|
||||
|
||||
public void setBufferSize(Integer bufferSize) {
|
||||
this.bufferSize = bufferSize;
|
||||
}
|
||||
|
||||
public Integer getBuffersPerRegion() {
|
||||
return buffersPerRegion;
|
||||
}
|
||||
|
||||
public void setBuffersPerRegion(Integer buffersPerRegion) {
|
||||
this.buffersPerRegion = buffersPerRegion;
|
||||
}
|
||||
|
||||
public Integer getIoThreads() {
|
||||
return ioThreads;
|
||||
}
|
||||
|
||||
public void setIoThreads(Integer ioThreads) {
|
||||
this.ioThreads = ioThreads;
|
||||
}
|
||||
|
||||
public Integer getWorkerThreads() {
|
||||
return workerThreads;
|
||||
}
|
||||
|
||||
public void setWorkerThreads(Integer workerThreads) {
|
||||
this.workerThreads = workerThreads;
|
||||
}
|
||||
|
||||
public Boolean getDirectBuffers() {
|
||||
return directBuffers;
|
||||
}
|
||||
|
||||
public void setDirectBuffers(Boolean directBuffers) {
|
||||
this.directBuffers = directBuffers;
|
||||
}
|
||||
|
||||
public String getTargetUrl() {
|
||||
return targetUrl;
|
||||
}
|
||||
|
||||
public void setTargetUrl(String targetUrl) {
|
||||
this.targetUrl = targetUrl;
|
||||
}
|
||||
|
||||
public Integer getTargetRequestTimeout() {
|
||||
return targetRequestTimeout;
|
||||
}
|
||||
|
||||
public void setTargetRequestTimeout(Integer targetRequestTimeout) {
|
||||
this.targetRequestTimeout = targetRequestTimeout;
|
||||
}
|
||||
|
||||
public List<Application> getApplications() {
|
||||
return applications;
|
||||
}
|
||||
|
||||
public void setApplications(List<Application> applications) {
|
||||
this.applications = applications;
|
||||
}
|
||||
|
||||
public boolean isSendAccessToken() {
|
||||
return sendAccessToken;
|
||||
}
|
||||
|
||||
public void setSendAccessToken(boolean sendAccessToken) {
|
||||
this.sendAccessToken = sendAccessToken;
|
||||
}
|
||||
|
||||
public void setHeaderNames(Map<String, String> headerNames) {
|
||||
this.headerNames = headerNames;
|
||||
}
|
||||
|
||||
public Map<String, String> getHeaderNames() {
|
||||
return headerNames;
|
||||
}
|
||||
|
||||
public static class Application {
|
||||
@JsonProperty("base-path")
|
||||
protected String basePath;
|
||||
@JsonProperty("adapter-config")
|
||||
protected AdapterConfig adapterConfig;
|
||||
@JsonProperty("error-page")
|
||||
protected String errorPage;
|
||||
@JsonProperty("proxy-address-forwarding")
|
||||
protected boolean proxyAddressForwarding;
|
||||
@JsonProperty("constraints")
|
||||
protected List<Constraint> constraints = new LinkedList<Constraint>();
|
||||
|
||||
public String getBasePath() {
|
||||
return basePath;
|
||||
}
|
||||
|
||||
public void setBasePath(String basePath) {
|
||||
this.basePath = basePath;
|
||||
}
|
||||
|
||||
public AdapterConfig getAdapterConfig() {
|
||||
return adapterConfig;
|
||||
}
|
||||
|
||||
public void setAdapterConfig(AdapterConfig adapterConfig) {
|
||||
this.adapterConfig = adapterConfig;
|
||||
}
|
||||
|
||||
public String getErrorPage() {
|
||||
return errorPage;
|
||||
}
|
||||
|
||||
public void setErrorPage(String errorPage) {
|
||||
this.errorPage = errorPage;
|
||||
}
|
||||
|
||||
public boolean isProxyAddressForwarding() {
|
||||
return proxyAddressForwarding;
|
||||
}
|
||||
|
||||
public void setProxyAddressForwarding(boolean proxyAddressForwarding) {
|
||||
this.proxyAddressForwarding = proxyAddressForwarding;
|
||||
}
|
||||
|
||||
public List<Constraint> getConstraints() {
|
||||
return constraints;
|
||||
}
|
||||
|
||||
public void setConstraints(List<Constraint> constraints) {
|
||||
this.constraints = constraints;
|
||||
}
|
||||
}
|
||||
|
||||
public static class Constraint {
|
||||
@JsonProperty("pattern")
|
||||
protected String pattern;
|
||||
@JsonProperty("roles-allowed")
|
||||
protected Set<String> rolesAllowed = new HashSet<String>();
|
||||
@JsonProperty("methods")
|
||||
protected Set<String> methods = new HashSet<String>();
|
||||
@JsonProperty("excluded-methods")
|
||||
protected Set<String> excludedMethods = new HashSet<String>();
|
||||
@JsonProperty("deny")
|
||||
protected boolean deny;
|
||||
@JsonProperty("permit")
|
||||
protected boolean permit;
|
||||
@JsonProperty("authenticate")
|
||||
protected boolean authenticate;
|
||||
@JsonProperty("permit-and-inject")
|
||||
protected boolean permitAndInject;
|
||||
|
||||
public String getPattern() {
|
||||
return pattern;
|
||||
}
|
||||
|
||||
public void setPattern(String pattern) {
|
||||
this.pattern = pattern;
|
||||
}
|
||||
|
||||
public Set<String> getRolesAllowed() {
|
||||
return rolesAllowed;
|
||||
}
|
||||
|
||||
public void setRolesAllowed(Set<String> rolesAllowed) {
|
||||
this.rolesAllowed = rolesAllowed;
|
||||
}
|
||||
|
||||
public boolean isDeny() {
|
||||
return deny;
|
||||
}
|
||||
|
||||
public void setDeny(boolean deny) {
|
||||
this.deny = deny;
|
||||
}
|
||||
|
||||
public boolean isPermit() {
|
||||
return permit;
|
||||
}
|
||||
|
||||
public void setPermit(boolean permit) {
|
||||
this.permit = permit;
|
||||
}
|
||||
|
||||
public boolean isAuthenticate() {
|
||||
return authenticate;
|
||||
}
|
||||
|
||||
public void setAuthenticate(boolean authenticate) {
|
||||
this.authenticate = authenticate;
|
||||
}
|
||||
|
||||
public boolean isPermitAndInject() {
|
||||
return permitAndInject;
|
||||
}
|
||||
|
||||
public void setPermitAndInject(boolean permitAndInject) {
|
||||
this.permitAndInject = permitAndInject;
|
||||
}
|
||||
|
||||
public Set<String> getMethods() {
|
||||
return methods;
|
||||
}
|
||||
|
||||
public void setMethods(Set<String> methods) {
|
||||
this.methods = methods;
|
||||
}
|
||||
|
||||
public Set<String> getExcludedMethods() {
|
||||
return excludedMethods;
|
||||
}
|
||||
|
||||
public void setExcludedMethods(Set<String> excludedMethods) {
|
||||
this.excludedMethods = excludedMethods;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -1,493 +0,0 @@
|
|||
/*
|
||||
* Copyright 2016 Red Hat, Inc. and/or its affiliates
|
||||
* and other contributors as indicated by the @author tags.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.keycloak.proxy;
|
||||
|
||||
import com.fasterxml.jackson.annotation.JsonInclude;
|
||||
import com.fasterxml.jackson.databind.ObjectMapper;
|
||||
import io.undertow.Undertow;
|
||||
import io.undertow.security.api.AuthenticationMechanism;
|
||||
import io.undertow.security.api.AuthenticationMode;
|
||||
import io.undertow.security.handlers.AuthenticationMechanismsHandler;
|
||||
import io.undertow.security.handlers.SecurityInitialHandler;
|
||||
import io.undertow.security.idm.Account;
|
||||
import io.undertow.security.idm.Credential;
|
||||
import io.undertow.security.idm.IdentityManager;
|
||||
import io.undertow.security.impl.CachedAuthenticatedSessionMechanism;
|
||||
import io.undertow.server.HttpHandler;
|
||||
import io.undertow.server.HttpServerExchange;
|
||||
import io.undertow.server.handlers.PathHandler;
|
||||
import io.undertow.server.handlers.ProxyPeerAddressHandler;
|
||||
import io.undertow.server.handlers.ResponseCodeHandler;
|
||||
import io.undertow.server.handlers.proxy.ProxyHandler;
|
||||
import io.undertow.server.handlers.proxy.SimpleProxyClientProvider;
|
||||
import io.undertow.server.session.InMemorySessionManager;
|
||||
import io.undertow.server.session.SessionAttachmentHandler;
|
||||
import io.undertow.server.session.SessionCookieConfig;
|
||||
import io.undertow.server.session.SessionManager;
|
||||
import org.jboss.logging.Logger;
|
||||
import org.keycloak.adapters.AdapterDeploymentContext;
|
||||
import org.keycloak.adapters.KeycloakDeployment;
|
||||
import org.keycloak.adapters.KeycloakDeploymentBuilder;
|
||||
import org.keycloak.adapters.NodesRegistrationManagement;
|
||||
import org.keycloak.adapters.undertow.UndertowAuthenticatedActionsHandler;
|
||||
import org.keycloak.adapters.undertow.UndertowAuthenticationMechanism;
|
||||
import org.keycloak.adapters.undertow.UndertowPreAuthActionsHandler;
|
||||
import org.keycloak.adapters.undertow.UndertowUserSessionManagement;
|
||||
import org.keycloak.common.enums.SslRequired;
|
||||
import org.keycloak.common.util.CertificateUtils;
|
||||
import org.keycloak.common.util.FindFile;
|
||||
import org.keycloak.representations.adapters.config.AdapterConfig;
|
||||
import org.keycloak.util.SystemPropertiesJsonParserFactory;
|
||||
import org.xnio.Option;
|
||||
|
||||
import javax.net.ssl.KeyManager;
|
||||
import javax.net.ssl.SSLContext;
|
||||
import javax.net.ssl.TrustManager;
|
||||
import java.io.IOException;
|
||||
import java.io.InputStream;
|
||||
import java.net.URI;
|
||||
import java.net.URISyntaxException;
|
||||
import java.security.KeyPair;
|
||||
import java.security.KeyPairGenerator;
|
||||
import java.security.KeyStore;
|
||||
import java.security.NoSuchAlgorithmException;
|
||||
import java.security.PrivateKey;
|
||||
import java.security.cert.Certificate;
|
||||
import java.security.cert.X509Certificate;
|
||||
import java.util.HashSet;
|
||||
import java.util.LinkedList;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.Set;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
|
||||
* @version $Revision: 1 $
|
||||
*/
|
||||
public class ProxyServerBuilder {
|
||||
protected static Logger log = Logger.getLogger(ProxyServerBuilder.class);
|
||||
public static final HttpHandler NOT_FOUND = new HttpHandler() {
|
||||
@Override
|
||||
public void handleRequest(HttpServerExchange exchange) throws Exception {
|
||||
exchange.setResponseCode(404);
|
||||
exchange.endExchange();
|
||||
}
|
||||
};
|
||||
|
||||
protected Undertow.Builder builder = Undertow.builder();
|
||||
|
||||
protected PathHandler root = new PathHandler(NOT_FOUND);
|
||||
protected HttpHandler proxyHandler;
|
||||
protected boolean sendAccessToken;
|
||||
|
||||
protected Map<String, String> headerNameConfig;
|
||||
|
||||
public ProxyServerBuilder target(ProxyConfig config) {
|
||||
SimpleProxyClientProvider provider = null;
|
||||
try {
|
||||
provider = new SimpleProxyClientProvider(new URI(config.getTargetUrl()));
|
||||
} catch (URISyntaxException e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
final HttpHandler handler = new ProxyHandler(provider, config.getTargetRequestTimeout(), ResponseCodeHandler.HANDLE_404);
|
||||
proxyHandler = new HttpHandler() {
|
||||
@Override
|
||||
public void handleRequest(HttpServerExchange exchange) throws Exception {
|
||||
exchange.setRelativePath(exchange.getRequestPath()); // need this otherwise proxy forwards to chopped off path
|
||||
handler.handleRequest(exchange);
|
||||
}
|
||||
};
|
||||
return this;
|
||||
}
|
||||
|
||||
public ProxyServerBuilder sendAccessToken(boolean flag) {
|
||||
this.sendAccessToken = flag;
|
||||
return this;
|
||||
}
|
||||
|
||||
public ProxyServerBuilder headerNameConfig(Map<String, String> headerNameConfig) {
|
||||
this.headerNameConfig = headerNameConfig;
|
||||
return this;
|
||||
}
|
||||
|
||||
public ApplicationBuilder application(AdapterConfig config) {
|
||||
return new ApplicationBuilder(config);
|
||||
}
|
||||
|
||||
public class ApplicationBuilder {
|
||||
protected NodesRegistrationManagement nodesRegistrationManagement = new NodesRegistrationManagement();
|
||||
protected UndertowUserSessionManagement userSessionManagement = new UndertowUserSessionManagement();
|
||||
protected AdapterDeploymentContext deploymentContext;
|
||||
protected KeycloakDeployment deployment;
|
||||
SessionManager sessionManager = new InMemorySessionManager(
|
||||
"SESSION_MANAGER");
|
||||
protected String base;
|
||||
protected SecurityPathMatches.Builder constraintBuilder = new SecurityPathMatches.Builder();
|
||||
protected SecurityPathMatches matches;
|
||||
protected String errorPage;
|
||||
protected boolean proxyAddressForwarding;
|
||||
|
||||
public ApplicationBuilder base(String base) {
|
||||
this.base = base;
|
||||
return this;
|
||||
}
|
||||
|
||||
public ApplicationBuilder errorPage(String errorPage) {
|
||||
if (errorPage != null && errorPage.startsWith("/")) {
|
||||
errorPage = errorPage.substring(1);
|
||||
}
|
||||
this.errorPage = errorPage;
|
||||
return this;
|
||||
}
|
||||
|
||||
public ApplicationBuilder proxyAddressForwarding(boolean proxyAddressForwarding) {
|
||||
this.proxyAddressForwarding = proxyAddressForwarding;
|
||||
return this;
|
||||
}
|
||||
|
||||
public ApplicationBuilder(AdapterConfig config) {
|
||||
this.deployment = KeycloakDeploymentBuilder.build(config);
|
||||
this.deploymentContext = new AdapterDeploymentContext(deployment);
|
||||
}
|
||||
|
||||
public ProxyServerBuilder add() {
|
||||
matches = constraintBuilder.build();
|
||||
HttpHandler handler = sessionHandling(addSecurity(proxyHandler));
|
||||
root.addPrefixPath(base, handler);
|
||||
return ProxyServerBuilder.this;
|
||||
}
|
||||
|
||||
public ConstraintBuilder constraint(String pattern) {
|
||||
log.debugv("add constraint: {0}", pattern);
|
||||
return new ConstraintBuilder(pattern);
|
||||
}
|
||||
|
||||
public class ConstraintBuilder {
|
||||
protected String pattern;
|
||||
protected Set<String> rolesAllowed = new HashSet<String>();
|
||||
protected Set<String> methods = new HashSet<String>();
|
||||
protected Set<String> excludedMethods = new HashSet<String>();
|
||||
protected SecurityInfo.EmptyRoleSemantic semantic = SecurityInfo.EmptyRoleSemantic.AUTHENTICATE;
|
||||
|
||||
public ConstraintBuilder(String pattern) {
|
||||
this.pattern = pattern;
|
||||
|
||||
}
|
||||
|
||||
public ConstraintBuilder deny() {
|
||||
semantic = SecurityInfo.EmptyRoleSemantic.DENY;
|
||||
return this;
|
||||
}
|
||||
public ConstraintBuilder permit() {
|
||||
semantic = SecurityInfo.EmptyRoleSemantic.PERMIT;
|
||||
return this;
|
||||
}
|
||||
public ConstraintBuilder authenticate() {
|
||||
semantic = SecurityInfo.EmptyRoleSemantic.AUTHENTICATE;
|
||||
return this;
|
||||
}
|
||||
|
||||
public ConstraintBuilder injectIfAuthenticated() {
|
||||
semantic = SecurityInfo.EmptyRoleSemantic.PERMIT_AND_INJECT_IF_AUTHENTICATED;
|
||||
return this;
|
||||
}
|
||||
|
||||
public ConstraintBuilder excludedMethods(Set<String> excludedMethods) {
|
||||
this.excludedMethods = excludedMethods;
|
||||
return this;
|
||||
}
|
||||
|
||||
public ConstraintBuilder methods(Set<String> methods) {
|
||||
this.methods = methods;
|
||||
return this;
|
||||
}
|
||||
|
||||
public ConstraintBuilder method(String method) {
|
||||
methods.add(method);
|
||||
return this;
|
||||
}
|
||||
|
||||
public ConstraintBuilder excludeMethod(String method) {
|
||||
excludedMethods.add(method);
|
||||
return this;
|
||||
}
|
||||
|
||||
|
||||
public ConstraintBuilder roles(String... roles) {
|
||||
for (String role : roles) role(role);
|
||||
return this;
|
||||
}
|
||||
public ConstraintBuilder roles(Set<String> roles) {
|
||||
for (String role : roles) role(role);
|
||||
return this;
|
||||
}
|
||||
|
||||
public ConstraintBuilder role(String role) {
|
||||
rolesAllowed.add(role);
|
||||
return this;
|
||||
}
|
||||
|
||||
public ApplicationBuilder add() {
|
||||
constraintBuilder.addSecurityConstraint(rolesAllowed, semantic, pattern, methods, excludedMethods);
|
||||
return ApplicationBuilder.this;
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
private HttpHandler addSecurity(final HttpHandler toWrap) {
|
||||
HttpHandler handler = new UndertowAuthenticatedActionsHandler(deploymentContext, toWrap);
|
||||
if (errorPage != null) {
|
||||
if (base.endsWith("/")) {
|
||||
errorPage = base + errorPage;
|
||||
} else {
|
||||
errorPage = base + "/" + errorPage;
|
||||
}
|
||||
}
|
||||
handler = new TokenRequestPreHandler(handler);
|
||||
handler = new ConstraintAuthorizationHandler(handler, errorPage, sendAccessToken, headerNameConfig);
|
||||
handler = new ProxyAuthenticationCallHandler(handler);
|
||||
handler = new ConstraintMatcherHandler(matches, handler, toWrap, errorPage);
|
||||
final List<AuthenticationMechanism> mechanisms = new LinkedList<AuthenticationMechanism>();
|
||||
mechanisms.add(new CachedAuthenticatedSessionMechanism());
|
||||
mechanisms.add(new UndertowAuthenticationMechanism(deploymentContext, userSessionManagement, nodesRegistrationManagement, -1, null));
|
||||
handler = new AuthenticationMechanismsHandler(handler, mechanisms);
|
||||
IdentityManager identityManager = new IdentityManager() {
|
||||
@Override
|
||||
public Account verify(Account account) {
|
||||
return account;
|
||||
}
|
||||
|
||||
@Override
|
||||
public Account verify(String id, Credential credential) {
|
||||
throw new IllegalStateException("Should never be called in Keycloak flow");
|
||||
}
|
||||
|
||||
@Override
|
||||
public Account verify(Credential credential) {
|
||||
throw new IllegalStateException("Should never be called in Keycloak flow");
|
||||
}
|
||||
};
|
||||
handler = new UndertowPreAuthActionsHandler(deploymentContext, userSessionManagement, sessionManager, handler);
|
||||
handler = new SecurityInitialHandler(AuthenticationMode.PRO_ACTIVE, identityManager, handler);
|
||||
if (proxyAddressForwarding) handler = new ProxyPeerAddressHandler(handler);
|
||||
return handler;
|
||||
}
|
||||
|
||||
private HttpHandler sessionHandling(HttpHandler toWrap) {
|
||||
SessionCookieConfig sessionConfig = new SessionCookieConfig();
|
||||
sessionConfig.setCookieName("keycloak." + deployment.getResourceName() + ".session");
|
||||
sessionConfig.setPath(base);
|
||||
if (deployment.getSslRequired() == SslRequired.ALL) sessionConfig.setSecure(true);
|
||||
toWrap = new SessionAttachmentHandler(
|
||||
toWrap, sessionManager, sessionConfig);
|
||||
return toWrap;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
public Undertow build() {
|
||||
builder.setHandler(root);
|
||||
return builder.build();
|
||||
}
|
||||
|
||||
public ProxyServerBuilder addHttpListener(int port, String host) {
|
||||
builder.addHttpListener(port, host);
|
||||
return this;
|
||||
}
|
||||
|
||||
public ProxyServerBuilder addHttpsListener(int port, String host, KeyManager[] keyManagers, TrustManager[] trustManagers) {
|
||||
builder.addHttpsListener(port, host, keyManagers, trustManagers);
|
||||
return this;
|
||||
}
|
||||
|
||||
public ProxyServerBuilder addHttpsListener(int port, String host, SSLContext sslContext) {
|
||||
builder.addHttpsListener(port, host, sslContext);
|
||||
return this;
|
||||
}
|
||||
|
||||
public ProxyServerBuilder setBufferSize(int bufferSize) {
|
||||
builder.setBufferSize(bufferSize);
|
||||
return this;
|
||||
}
|
||||
|
||||
public ProxyServerBuilder setBuffersPerRegion(int buffersPerRegion) {
|
||||
builder.setBuffersPerRegion(buffersPerRegion);
|
||||
return this;
|
||||
}
|
||||
|
||||
public ProxyServerBuilder setIoThreads(int ioThreads) {
|
||||
builder.setIoThreads(ioThreads);
|
||||
return this;
|
||||
}
|
||||
|
||||
public ProxyServerBuilder setWorkerThreads(int workerThreads) {
|
||||
builder.setWorkerThreads(workerThreads);
|
||||
return this;
|
||||
}
|
||||
|
||||
public ProxyServerBuilder setDirectBuffers(boolean directBuffers) {
|
||||
builder.setDirectBuffers(directBuffers);
|
||||
return this;
|
||||
}
|
||||
|
||||
public <T> ProxyServerBuilder setServerOption(Option<T> option, T value) {
|
||||
builder.setServerOption(option, value);
|
||||
return this;
|
||||
}
|
||||
|
||||
public <T> ProxyServerBuilder setSocketOption(Option<T> option, T value) {
|
||||
builder.setSocketOption(option, value);
|
||||
return this;
|
||||
}
|
||||
|
||||
public <T> ProxyServerBuilder setWorkerOption(Option<T> option, T value) {
|
||||
builder.setWorkerOption(option, value);
|
||||
return this;
|
||||
}
|
||||
|
||||
public static ProxyConfig loadConfig(InputStream is) {
|
||||
ObjectMapper mapper = new ObjectMapper(new SystemPropertiesJsonParserFactory());
|
||||
mapper.setSerializationInclusion(JsonInclude.Include.NON_DEFAULT);
|
||||
ProxyConfig proxyConfig;
|
||||
try {
|
||||
proxyConfig = mapper.readValue(is, ProxyConfig.class);
|
||||
} catch (IOException e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
return proxyConfig;
|
||||
}
|
||||
public static Undertow build(InputStream configStream) {
|
||||
ProxyConfig config = loadConfig(configStream);
|
||||
return build(config);
|
||||
|
||||
}
|
||||
|
||||
public static Undertow build(ProxyConfig config) {
|
||||
ProxyServerBuilder builder = new ProxyServerBuilder();
|
||||
if (config.getTargetUrl() == null) {
|
||||
log.error("Must set Target URL");
|
||||
return null;
|
||||
}
|
||||
builder.target(config);
|
||||
if (config.getApplications() == null || config.getApplications().size() == 0) {
|
||||
log.error("No applications defined");
|
||||
return null;
|
||||
}
|
||||
initConnections(config, builder);
|
||||
initOptions(config, builder);
|
||||
|
||||
for (ProxyConfig.Application application : config.getApplications()) {
|
||||
ApplicationBuilder applicationBuilder = builder.application(application.getAdapterConfig())
|
||||
.base(application.getBasePath())
|
||||
.errorPage(application.getErrorPage())
|
||||
.proxyAddressForwarding(application.isProxyAddressForwarding());
|
||||
|
||||
if (application.getConstraints() != null) {
|
||||
for (ProxyConfig.Constraint constraint : application.getConstraints()) {
|
||||
ApplicationBuilder.ConstraintBuilder constraintBuilder = applicationBuilder.constraint(constraint.getPattern());
|
||||
if (constraint.getRolesAllowed() != null) {
|
||||
constraintBuilder.roles(constraint.getRolesAllowed());
|
||||
}
|
||||
if (constraint.getMethods() != null) {
|
||||
constraintBuilder.methods(constraint.getMethods());
|
||||
}
|
||||
if (constraint.getExcludedMethods() != null) {
|
||||
constraintBuilder.excludedMethods(constraint.getExcludedMethods());
|
||||
}
|
||||
if (constraint.isDeny()) constraintBuilder.deny();
|
||||
if (constraint.isPermit()) constraintBuilder.permit();
|
||||
if (constraint.isAuthenticate()) constraintBuilder.authenticate();
|
||||
if (constraint.isPermitAndInject()) constraintBuilder.injectIfAuthenticated();
|
||||
constraintBuilder.add();
|
||||
}
|
||||
}
|
||||
applicationBuilder.add();
|
||||
}
|
||||
return builder.build();
|
||||
}
|
||||
|
||||
public static void initOptions(ProxyConfig config, ProxyServerBuilder builder) {
|
||||
builder.sendAccessToken(config.isSendAccessToken());
|
||||
builder.headerNameConfig(config.getHeaderNames());
|
||||
if (config.getBufferSize() != null) builder.setBufferSize(config.getBufferSize());
|
||||
if (config.getBuffersPerRegion() != null) builder.setBuffersPerRegion(config.getBuffersPerRegion());
|
||||
if (config.getIoThreads() != null) builder.setIoThreads(config.getIoThreads());
|
||||
if (config.getWorkerThreads() != null) builder.setWorkerThreads(config.getWorkerThreads());
|
||||
if (config.getDirectBuffers() != null) builder.setDirectBuffers(config.getDirectBuffers());
|
||||
}
|
||||
|
||||
public static void initConnections(ProxyConfig config, ProxyServerBuilder builder) {
|
||||
if (config.getHttpPort() == null && config.getHttpsPort() == null) {
|
||||
log.warn("You have not set up HTTP or HTTPS");
|
||||
}
|
||||
if (config.getHttpPort() != null) {
|
||||
String bindAddress = "localhost";
|
||||
if (config.getBindAddress() != null) bindAddress = config.getBindAddress();
|
||||
builder.addHttpListener(config.getHttpPort(), bindAddress);
|
||||
}
|
||||
if (config.getHttpsPort() != null) {
|
||||
String bindAddress = "localhost";
|
||||
if (config.getBindAddress() != null) bindAddress = config.getBindAddress();
|
||||
if (config.getKeystore() != null) {
|
||||
InputStream is = FindFile.findFile(config.getKeystore());
|
||||
SSLContext sslContext = null;
|
||||
try {
|
||||
KeyStore keystore = KeyStore.getInstance("jks");
|
||||
keystore.load(is, config.getKeystorePassword().toCharArray());
|
||||
sslContext = SslUtil.createSSLContext(keystore, config.getKeyPassword(), null);
|
||||
} catch (Exception e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
builder.addHttpsListener(config.getHttpsPort().intValue(), bindAddress, sslContext);
|
||||
} else {
|
||||
log.warn("Generating temporary SSL cert");
|
||||
KeyPair keyPair = null;
|
||||
try {
|
||||
KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");
|
||||
generator.initialize(2048);
|
||||
keyPair = generator.generateKeyPair();
|
||||
} catch (NoSuchAlgorithmException e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
X509Certificate certificate = null;
|
||||
try {
|
||||
certificate = CertificateUtils.generateV1SelfSignedCertificate(keyPair, bindAddress);
|
||||
} catch (Exception e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
|
||||
try {
|
||||
KeyStore keyStore = KeyStore.getInstance("JKS");
|
||||
keyStore.load(null, null);
|
||||
PrivateKey privateKey = keyPair.getPrivate();
|
||||
|
||||
|
||||
Certificate[] chain = {certificate};
|
||||
|
||||
keyStore.setKeyEntry(bindAddress, privateKey, "password".toCharArray(), chain);
|
||||
SSLContext sslContext = SslUtil.createSSLContext(keyStore, "password", null);
|
||||
builder.addHttpsListener(config.getHttpsPort().intValue(), bindAddress, sslContext);
|
||||
} catch (Exception e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -1,96 +0,0 @@
|
|||
/*
|
||||
* Copyright 2016 Red Hat, Inc. and/or its affiliates
|
||||
* and other contributors as indicated by the @author tags.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package org.keycloak.proxy;
|
||||
|
||||
import java.util.Arrays;
|
||||
import java.util.Collection;
|
||||
import java.util.HashSet;
|
||||
import java.util.Set;
|
||||
|
||||
/**
|
||||
* @author Stuart Douglas
|
||||
*/
|
||||
public class SecurityInfo<T extends SecurityInfo> implements Cloneable {
|
||||
|
||||
/**
|
||||
* Equivalent to {@see ServletSecurity.EmptyRoleSemantic} but with an additional mode to require authentication but no role
|
||||
* check.
|
||||
*/
|
||||
public enum EmptyRoleSemantic {
|
||||
|
||||
/**
|
||||
* Permit access to the resource without requiring authentication or role membership.
|
||||
*/
|
||||
PERMIT,
|
||||
|
||||
/**
|
||||
* Deny access to the resource regardless of the authentication state.
|
||||
*/
|
||||
DENY,
|
||||
|
||||
/**
|
||||
* Mandate authentication but authorize access as no roles to check against.
|
||||
*/
|
||||
AUTHENTICATE,
|
||||
|
||||
/**
|
||||
* Permit access in any case, but provide authorization info only if authorized.
|
||||
*/
|
||||
PERMIT_AND_INJECT_IF_AUTHENTICATED;
|
||||
}
|
||||
|
||||
private volatile EmptyRoleSemantic emptyRoleSemantic = EmptyRoleSemantic.DENY;
|
||||
private final Set<String> rolesAllowed = new HashSet<String>();
|
||||
|
||||
public EmptyRoleSemantic getEmptyRoleSemantic() {
|
||||
return emptyRoleSemantic;
|
||||
}
|
||||
|
||||
public T setEmptyRoleSemantic(final EmptyRoleSemantic emptyRoleSemantic) {
|
||||
this.emptyRoleSemantic = emptyRoleSemantic;
|
||||
return (T)this;
|
||||
}
|
||||
|
||||
public T addRoleAllowed(final String role) {
|
||||
this.rolesAllowed.add(role);
|
||||
return (T) this;
|
||||
}
|
||||
|
||||
public T addRolesAllowed(final String ... roles) {
|
||||
this.rolesAllowed.addAll(Arrays.asList(roles));
|
||||
return (T) this;
|
||||
}
|
||||
public T addRolesAllowed(final Collection<String> roles) {
|
||||
this.rolesAllowed.addAll(roles);
|
||||
return (T) this;
|
||||
}
|
||||
public Set<String> getRolesAllowed() {
|
||||
return new HashSet<String>(rolesAllowed);
|
||||
}
|
||||
|
||||
@Override
|
||||
public T clone() {
|
||||
final SecurityInfo info = createInstance();
|
||||
info.emptyRoleSemantic = emptyRoleSemantic;
|
||||
info.rolesAllowed.addAll(rolesAllowed);
|
||||
return (T) info;
|
||||
}
|
||||
|
||||
protected T createInstance() {
|
||||
return (T) new SecurityInfo();
|
||||
}
|
||||
}
|
||||
|
|
@ -1,249 +0,0 @@
|
|||
/*
|
||||
* Copyright 2016 Red Hat, Inc. and/or its affiliates
|
||||
* and other contributors as indicated by the @author tags.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.keycloak.proxy;
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.Collections;
|
||||
import java.util.HashMap;
|
||||
import java.util.HashSet;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.Set;
|
||||
|
||||
/**
|
||||
* @author Stuart Douglas
|
||||
*/
|
||||
public class SecurityPathMatches {
|
||||
|
||||
private final boolean denyUncoveredHttpMethods;
|
||||
private final PathSecurityInformation defaultPathSecurityInformation;
|
||||
private final Map<String, PathSecurityInformation> exactPathRoleInformation;
|
||||
private final Map<String, PathSecurityInformation> prefixPathRoleInformation;
|
||||
private final Map<String, PathSecurityInformation> extensionRoleInformation;
|
||||
|
||||
private SecurityPathMatches(final boolean denyUncoveredHttpMethods, final PathSecurityInformation defaultPathSecurityInformation, final Map<String, PathSecurityInformation> exactPathRoleInformation, final Map<String, PathSecurityInformation> prefixPathRoleInformation, final Map<String, PathSecurityInformation> extensionRoleInformation) {
|
||||
this.denyUncoveredHttpMethods = denyUncoveredHttpMethods;
|
||||
this.defaultPathSecurityInformation = defaultPathSecurityInformation;
|
||||
this.exactPathRoleInformation = exactPathRoleInformation;
|
||||
this.prefixPathRoleInformation = prefixPathRoleInformation;
|
||||
this.extensionRoleInformation = extensionRoleInformation;
|
||||
}
|
||||
|
||||
/**
|
||||
*
|
||||
* @return <code>true</code> If no security path information has been defined
|
||||
*/
|
||||
public boolean isEmpty() {
|
||||
return defaultPathSecurityInformation.excludedMethodRoles.isEmpty() &&
|
||||
defaultPathSecurityInformation.perMethodRequiredRoles.isEmpty() &&
|
||||
defaultPathSecurityInformation.defaultRequiredRoles.isEmpty() &&
|
||||
exactPathRoleInformation.isEmpty() &&
|
||||
prefixPathRoleInformation.isEmpty() &&
|
||||
extensionRoleInformation.isEmpty();
|
||||
}
|
||||
|
||||
public SingleConstraintMatch getSecurityInfo(final String path, final String method) {
|
||||
RuntimeMatch currentMatch = new RuntimeMatch();
|
||||
handleMatch(method, defaultPathSecurityInformation, currentMatch);
|
||||
PathSecurityInformation match = exactPathRoleInformation.get(path);
|
||||
if (match != null) {
|
||||
handleMatch(method, match, currentMatch);
|
||||
return mergeConstraints(currentMatch);
|
||||
}
|
||||
|
||||
match = prefixPathRoleInformation.get(path);
|
||||
if (match != null) {
|
||||
handleMatch(method, match, currentMatch);
|
||||
return mergeConstraints(currentMatch);
|
||||
}
|
||||
|
||||
int qsPos = -1;
|
||||
boolean extension = false;
|
||||
for (int i = path.length() - 1; i >= 0; --i) {
|
||||
final char c = path.charAt(i);
|
||||
if (c == '?') {
|
||||
//there was a query string, check the exact matches again
|
||||
final String part = path.substring(0, i);
|
||||
match = exactPathRoleInformation.get(part);
|
||||
if (match != null) {
|
||||
handleMatch(method, match, currentMatch);
|
||||
return mergeConstraints(currentMatch);
|
||||
}
|
||||
qsPos = i;
|
||||
extension = false;
|
||||
} else if (c == '/') {
|
||||
extension = true;
|
||||
final String part = path.substring(0, i);
|
||||
match = prefixPathRoleInformation.get(part);
|
||||
if (match != null) {
|
||||
handleMatch(method, match, currentMatch);
|
||||
return mergeConstraints(currentMatch);
|
||||
}
|
||||
} else if (c == '.') {
|
||||
if (!extension) {
|
||||
extension = true;
|
||||
final String ext;
|
||||
if (qsPos == -1) {
|
||||
ext = path.substring(i + 1, path.length());
|
||||
} else {
|
||||
ext = path.substring(i + 1, qsPos);
|
||||
}
|
||||
match = extensionRoleInformation.get(ext);
|
||||
if (match != null) {
|
||||
handleMatch(method, match, currentMatch);
|
||||
return mergeConstraints(currentMatch);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return mergeConstraints(currentMatch);
|
||||
}
|
||||
|
||||
/**
|
||||
* merge all constraints, as per 13.8.1 Combining Constraints
|
||||
*/
|
||||
private SingleConstraintMatch mergeConstraints(final RuntimeMatch currentMatch) {
|
||||
if(currentMatch.uncovered && denyUncoveredHttpMethods) {
|
||||
return new SingleConstraintMatch(SecurityInfo.EmptyRoleSemantic.DENY, Collections.<String>emptySet());
|
||||
}
|
||||
final Set<String> allowedRoles = new HashSet<String>();
|
||||
for(SingleConstraintMatch match : currentMatch.constraints) {
|
||||
if(match.getRequiredRoles().isEmpty()) {
|
||||
return new SingleConstraintMatch(match.getEmptyRoleSemantic(), Collections.<String>emptySet());
|
||||
} else {
|
||||
allowedRoles.addAll(match.getRequiredRoles());
|
||||
}
|
||||
}
|
||||
return new SingleConstraintMatch(SecurityInfo.EmptyRoleSemantic.PERMIT, allowedRoles);
|
||||
}
|
||||
|
||||
private void handleMatch(final String method, final PathSecurityInformation exact, RuntimeMatch currentMatch) {
|
||||
List<SecurityInformation> roles = exact.defaultRequiredRoles;
|
||||
for (SecurityInformation role : roles) {
|
||||
currentMatch.constraints.add(new SingleConstraintMatch(role.emptyRoleSemantic, role.roles));
|
||||
if(role.emptyRoleSemantic == SecurityInfo.EmptyRoleSemantic.DENY || !role.roles.isEmpty()) {
|
||||
currentMatch.uncovered = false;
|
||||
}
|
||||
}
|
||||
List<SecurityInformation> methodInfo = exact.perMethodRequiredRoles.get(method);
|
||||
if (methodInfo != null) {
|
||||
currentMatch.uncovered = false;
|
||||
for (SecurityInformation role : methodInfo) {
|
||||
currentMatch.constraints.add(new SingleConstraintMatch(role.emptyRoleSemantic, role.roles));
|
||||
}
|
||||
}
|
||||
for (ExcludedMethodRoles excluded : exact.excludedMethodRoles) {
|
||||
if (!excluded.methods.contains(method)) {
|
||||
currentMatch.uncovered = false;
|
||||
currentMatch.constraints.add(new SingleConstraintMatch(excluded.securityInformation.emptyRoleSemantic, excluded.securityInformation.roles));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public static class Builder {
|
||||
private final PathSecurityInformation defaultPathSecurityInformation = new PathSecurityInformation();
|
||||
private final Map<String, PathSecurityInformation> exactPathRoleInformation = new HashMap<String, PathSecurityInformation>();
|
||||
private final Map<String, PathSecurityInformation> prefixPathRoleInformation = new HashMap<String, PathSecurityInformation>();
|
||||
private final Map<String, PathSecurityInformation> extensionRoleInformation = new HashMap<String, PathSecurityInformation>();
|
||||
|
||||
public void addSecurityConstraint(Set<String> roles, SecurityInfo.EmptyRoleSemantic emptyRoleSemantic, String pattern, Set<String> httpMethods, Set<String> excludedMethods) {
|
||||
final SecurityInformation securityInformation = new SecurityInformation(roles, emptyRoleSemantic);
|
||||
if (pattern.endsWith("/*") || pattern.endsWith("/")) {
|
||||
String part = pattern.substring(0, pattern.lastIndexOf('/'));
|
||||
PathSecurityInformation info = prefixPathRoleInformation.get(part);
|
||||
if (info == null) {
|
||||
prefixPathRoleInformation.put(part, info = new PathSecurityInformation());
|
||||
}
|
||||
setupPathSecurityInformation(info, securityInformation, httpMethods, excludedMethods);
|
||||
} else if (pattern.startsWith("*.")) {
|
||||
String part = pattern.substring(2, pattern.length());
|
||||
PathSecurityInformation info = extensionRoleInformation.get(part);
|
||||
if (info == null) {
|
||||
extensionRoleInformation.put(part, info = new PathSecurityInformation());
|
||||
}
|
||||
setupPathSecurityInformation(info, securityInformation, httpMethods, excludedMethods);
|
||||
} else {
|
||||
PathSecurityInformation info = exactPathRoleInformation.get(pattern);
|
||||
if (info == null) {
|
||||
exactPathRoleInformation.put(pattern, info = new PathSecurityInformation());
|
||||
}
|
||||
setupPathSecurityInformation(info, securityInformation, httpMethods, excludedMethods);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
private Set<String> expandRolesAllowed(final Set<String> rolesAllowed) {
|
||||
final Set<String> roles = new HashSet<String>(rolesAllowed);
|
||||
return roles;
|
||||
}
|
||||
|
||||
private void setupPathSecurityInformation(final PathSecurityInformation info, final SecurityInformation securityConstraint,
|
||||
Set<String> httpMethods, Set<String> excludedMethods) {
|
||||
if (httpMethods.isEmpty() &&
|
||||
excludedMethods.isEmpty()) {
|
||||
info.defaultRequiredRoles.add(securityConstraint);
|
||||
} else if (!httpMethods.isEmpty()) {
|
||||
for (String method : httpMethods) {
|
||||
List<SecurityInformation> securityInformations = info.perMethodRequiredRoles.get(method);
|
||||
if (securityInformations == null) {
|
||||
info.perMethodRequiredRoles.put(method, securityInformations = new ArrayList<SecurityInformation>());
|
||||
}
|
||||
securityInformations.add(securityConstraint);
|
||||
}
|
||||
} else if (!excludedMethods.isEmpty()) {
|
||||
info.excludedMethodRoles.add(new ExcludedMethodRoles(excludedMethods, securityConstraint));
|
||||
}
|
||||
}
|
||||
|
||||
public SecurityPathMatches build() {
|
||||
return new SecurityPathMatches(false, defaultPathSecurityInformation, exactPathRoleInformation, prefixPathRoleInformation, extensionRoleInformation);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
private static class PathSecurityInformation {
|
||||
final List<SecurityInformation> defaultRequiredRoles = new ArrayList<SecurityInformation>();
|
||||
final Map<String, List<SecurityInformation>> perMethodRequiredRoles = new HashMap<String, List<SecurityInformation>>();
|
||||
final List<ExcludedMethodRoles> excludedMethodRoles = new ArrayList<ExcludedMethodRoles>();
|
||||
}
|
||||
|
||||
private static final class ExcludedMethodRoles {
|
||||
final Set<String> methods;
|
||||
final SecurityInformation securityInformation;
|
||||
|
||||
public ExcludedMethodRoles(final Set<String> methods, final SecurityInformation securityInformation) {
|
||||
this.methods = methods;
|
||||
this.securityInformation = securityInformation;
|
||||
}
|
||||
}
|
||||
|
||||
private static final class SecurityInformation {
|
||||
final Set<String> roles;
|
||||
final SecurityInfo.EmptyRoleSemantic emptyRoleSemantic;
|
||||
|
||||
private SecurityInformation(final Set<String> roles, final SecurityInfo.EmptyRoleSemantic emptyRoleSemantic) {
|
||||
this.emptyRoleSemantic = emptyRoleSemantic;
|
||||
this.roles = new HashSet<String>(roles);
|
||||
}
|
||||
}
|
||||
|
||||
private static final class RuntimeMatch {
|
||||
final List<SingleConstraintMatch> constraints = new ArrayList<SingleConstraintMatch>();
|
||||
boolean uncovered = true;
|
||||
}
|
||||
}
|
||||
|
|
@ -1,47 +0,0 @@
|
|||
/*
|
||||
* Copyright 2016 Red Hat, Inc. and/or its affiliates
|
||||
* and other contributors as indicated by the @author tags.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package org.keycloak.proxy;
|
||||
|
||||
import java.util.Set;
|
||||
|
||||
/**
|
||||
* Representation of a single security constrain matched for a single request.
|
||||
*
|
||||
* When performing any authentication/authorization check every constraint MUST be satisfied for the request to be allowed to
|
||||
* proceed.
|
||||
*
|
||||
* @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
|
||||
*/
|
||||
public class SingleConstraintMatch {
|
||||
|
||||
private final SecurityInfo.EmptyRoleSemantic emptyRoleSemantic;
|
||||
private final Set<String> requiredRoles;
|
||||
|
||||
public SingleConstraintMatch(SecurityInfo.EmptyRoleSemantic emptyRoleSemantic, Set<String> requiredRoles) {
|
||||
this.emptyRoleSemantic = emptyRoleSemantic;
|
||||
this.requiredRoles = requiredRoles;
|
||||
}
|
||||
|
||||
public SecurityInfo.EmptyRoleSemantic getEmptyRoleSemantic() {
|
||||
return emptyRoleSemantic;
|
||||
}
|
||||
|
||||
public Set<String> getRequiredRoles() {
|
||||
return requiredRoles;
|
||||
}
|
||||
|
||||
}
|
||||
|
|
@ -1,53 +0,0 @@
|
|||
/*
|
||||
* Copyright 2016 Red Hat, Inc. and/or its affiliates
|
||||
* and other contributors as indicated by the @author tags.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.keycloak.proxy;
|
||||
|
||||
import javax.net.ssl.KeyManager;
|
||||
import javax.net.ssl.KeyManagerFactory;
|
||||
import javax.net.ssl.SSLContext;
|
||||
import javax.net.ssl.TrustManager;
|
||||
import javax.net.ssl.TrustManagerFactory;
|
||||
import java.security.KeyStore;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
|
||||
* @version $Revision: 1 $
|
||||
*/
|
||||
public class SslUtil {
|
||||
public static SSLContext createSSLContext(final KeyStore keyStore, String password, final KeyStore trustStore) throws Exception {
|
||||
KeyManager[] keyManagers;
|
||||
KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
|
||||
keyManagerFactory.init(keyStore, password.toCharArray());
|
||||
keyManagers = keyManagerFactory.getKeyManagers();
|
||||
|
||||
TrustManager[] trustManagers = null;
|
||||
if (trustStore != null) {
|
||||
TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
|
||||
trustManagerFactory.init(trustStore);
|
||||
trustManagers = trustManagerFactory.getTrustManagers();
|
||||
}
|
||||
|
||||
SSLContext sslContext;
|
||||
sslContext = SSLContext.getInstance("TLS");
|
||||
sslContext.init(keyManagers, trustManagers, null);
|
||||
|
||||
return sslContext;
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
|
@ -1,27 +0,0 @@
|
|||
package org.keycloak.proxy;
|
||||
|
||||
import io.undertow.server.HttpHandler;
|
||||
import io.undertow.server.HttpServerExchange;
|
||||
import org.keycloak.constants.AdapterConstants;
|
||||
|
||||
/**
|
||||
* Dispatches requests for k_query_bearer_token through a worker thread (handler for this
|
||||
* resource performs blocking IO).
|
||||
*/
|
||||
public class TokenRequestPreHandler implements HttpHandler {
|
||||
|
||||
private final HttpHandler next;
|
||||
|
||||
public TokenRequestPreHandler(HttpHandler next) {
|
||||
this.next = next;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void handleRequest(HttpServerExchange exchange) throws Exception {
|
||||
if (exchange.getRequestURI().endsWith(AdapterConstants.K_QUERY_BEARER_TOKEN)) {
|
||||
exchange.dispatch(next);
|
||||
} else {
|
||||
next.handleRequest(exchange);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -70,7 +70,6 @@
|
|||
</build>
|
||||
<modules>
|
||||
<module>jetty</module>
|
||||
<module>proxy</module>
|
||||
<module>tomcat7</module>
|
||||
</modules>
|
||||
</profile>
|
||||
|
|
|
|||
|
|
@ -1,369 +0,0 @@
|
|||
<?xml version="1.0"?>
|
||||
<!--
|
||||
~ Copyright 2016 Red Hat, Inc. and/or its affiliates
|
||||
~ and other contributors as indicated by the @author tags.
|
||||
~
|
||||
~ Licensed under the Apache License, Version 2.0 (the "License");
|
||||
~ you may not use this file except in compliance with the License.
|
||||
~ You may obtain a copy of the License at
|
||||
~
|
||||
~ http://www.apache.org/licenses/LICENSE-2.0
|
||||
~
|
||||
~ Unless required by applicable law or agreed to in writing, software
|
||||
~ distributed under the License is distributed on an "AS IS" BASIS,
|
||||
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
~ See the License for the specific language governing permissions and
|
||||
~ limitations under the License.
|
||||
-->
|
||||
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
|
||||
<parent>
|
||||
<artifactId>keycloak-testsuite-pom</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>5.0.0-SNAPSHOT</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
<artifactId>keycloak-testsuite-security-proxy</artifactId>
|
||||
<name>Keycloak Security Proxy TestSuite</name>
|
||||
<properties>
|
||||
<!--<tomcat.version>8.0.14</tomcat.version>-->
|
||||
<tomcat.version>7.0.54</tomcat.version>
|
||||
</properties>
|
||||
<description />
|
||||
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-dependencies-server-all</artifactId>
|
||||
<type>pom</type>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-admin-client</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-proxy-server</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>log4j</groupId>
|
||||
<artifactId>log4j</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.jboss.spec.javax.servlet</groupId>
|
||||
<artifactId>jboss-servlet-api_3.0_spec</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.jboss.spec.javax.ws.rs</groupId>
|
||||
<artifactId>jboss-jaxrs-api_2.1_spec</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.jboss.resteasy</groupId>
|
||||
<artifactId>resteasy-jaxrs</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.jboss.resteasy</groupId>
|
||||
<artifactId>resteasy-client</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.jboss.resteasy</groupId>
|
||||
<artifactId>resteasy-multipart-provider</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.jboss.resteasy</groupId>
|
||||
<artifactId>resteasy-jackson2-provider</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.jboss.resteasy</groupId>
|
||||
<artifactId>resteasy-undertow</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>com.google.zxing</groupId>
|
||||
<artifactId>javase</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.bouncycastle</groupId>
|
||||
<artifactId>bcprov-jdk15on</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.apache.httpcomponents</groupId>
|
||||
<artifactId>httpclient</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-ldap-federation</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-kerberos-federation</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-undertow-adapter</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-tomcat7-adapter</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.jboss.logging</groupId>
|
||||
<artifactId>jboss-logging</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>io.undertow</groupId>
|
||||
<artifactId>undertow-servlet</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>io.undertow</groupId>
|
||||
<artifactId>undertow-core</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>com.fasterxml.jackson.core</groupId>
|
||||
<artifactId>jackson-core</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>com.fasterxml.jackson.core</groupId>
|
||||
<artifactId>jackson-databind</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>com.fasterxml.jackson.core</groupId>
|
||||
<artifactId>jackson-annotations</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>junit</groupId>
|
||||
<artifactId>junit</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.hamcrest</groupId>
|
||||
<artifactId>hamcrest-all</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>com.h2database</groupId>
|
||||
<artifactId>h2</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>com.icegreen</groupId>
|
||||
<artifactId>greenmail</artifactId>
|
||||
<exclusions>
|
||||
<exclusion>
|
||||
<groupId>org.slf4j</groupId>
|
||||
<artifactId>slf4j-api</artifactId>
|
||||
</exclusion>
|
||||
</exclusions>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.infinispan</groupId>
|
||||
<artifactId>infinispan-core</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.seleniumhq.selenium</groupId>
|
||||
<artifactId>selenium-java</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>xml-apis</groupId>
|
||||
<artifactId>xml-apis</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.seleniumhq.selenium</groupId>
|
||||
<artifactId>selenium-chrome-driver</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.wildfly</groupId>
|
||||
<artifactId>wildfly-undertow</artifactId>
|
||||
<scope>test</scope>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-testsuite-integration-deprecated</artifactId>
|
||||
<scope>test</scope>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-testsuite-integration-deprecated</artifactId>
|
||||
<type>test-jar</type>
|
||||
<scope>test</scope>
|
||||
</dependency>
|
||||
|
||||
<dependency>
|
||||
<groupId>org.apache.tomcat</groupId>
|
||||
<artifactId>tomcat-catalina</artifactId>
|
||||
<version>${tomcat.version}</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.apache.tomcat</groupId>
|
||||
<artifactId>tomcat-util</artifactId>
|
||||
<version>${tomcat.version}</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.apache.tomcat.embed</groupId>
|
||||
<artifactId>tomcat-embed-core</artifactId>
|
||||
<version>${tomcat.version}</version>
|
||||
</dependency>
|
||||
|
||||
</dependencies>
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-jar-plugin</artifactId>
|
||||
<version>2.2</version>
|
||||
<executions>
|
||||
<execution>
|
||||
<goals>
|
||||
<goal>test-jar</goal>
|
||||
</goals>
|
||||
</execution>
|
||||
</executions>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-deploy-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>true</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.codehaus.mojo</groupId>
|
||||
<artifactId>exec-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<workingDirectory>${project.basedir}</workingDirectory>
|
||||
</configuration>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
|
||||
<profiles>
|
||||
<profile>
|
||||
<id>keycloak-server</id>
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.codehaus.mojo</groupId>
|
||||
<artifactId>exec-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<mainClass>org.keycloak.testsuite.KeycloakServer</mainClass>
|
||||
</configuration>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
</profile>
|
||||
<profile>
|
||||
<id>mail-server</id>
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.codehaus.mojo</groupId>
|
||||
<artifactId>exec-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<mainClass>org.keycloak.testsuite.MailServer</mainClass>
|
||||
</configuration>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
</profile>
|
||||
<profile>
|
||||
<id>totp</id>
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.codehaus.mojo</groupId>
|
||||
<artifactId>exec-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<mainClass>org.keycloak.testsuite.TotpGenerator</mainClass>
|
||||
</configuration>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
</profile>
|
||||
|
||||
<profile>
|
||||
<id>jpa</id>
|
||||
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-surefire-plugin</artifactId>
|
||||
<configuration>
|
||||
<systemPropertyVariables>
|
||||
<keycloak.realm.provider>jpa</keycloak.realm.provider>
|
||||
<keycloak.user.provider>jpa</keycloak.user.provider>
|
||||
<keycloak.eventStore.provider>jpa</keycloak.eventStore.provider>
|
||||
</systemPropertyVariables>
|
||||
</configuration>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
</profile>
|
||||
|
||||
<!-- MySQL -->
|
||||
<profile>
|
||||
<activation>
|
||||
<property>
|
||||
<name>keycloak.connectionsJpa.driver</name>
|
||||
<value>com.mysql.jdbc.Driver</value>
|
||||
</property>
|
||||
</activation>
|
||||
<id>mysql</id>
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>mysql</groupId>
|
||||
<artifactId>mysql-connector-java</artifactId>
|
||||
<version>${mysql.version}</version>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
</profile>
|
||||
|
||||
<!-- PostgreSQL -->
|
||||
<profile>
|
||||
<activation>
|
||||
<property>
|
||||
<name>keycloak.connectionsJpa.driver</name>
|
||||
<value>org.postgresql.Driver</value>
|
||||
</property>
|
||||
</activation>
|
||||
<id>postgresql</id>
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>org.postgresql</groupId>
|
||||
<artifactId>postgresql</artifactId>
|
||||
<version>${postgresql.version}</version>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
</profile>
|
||||
|
||||
<profile>
|
||||
<id>clean-jpa</id>
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.liquibase</groupId>
|
||||
<artifactId>liquibase-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<changeLogFile>META-INF/jpa-changelog-master.xml</changeLogFile>
|
||||
|
||||
<url>${keycloak.connectionsJpa.url}</url>
|
||||
<driver>${keycloak.connectionsJpa.driver}</driver>
|
||||
<username>${keycloak.connectionsJpa.user}</username>
|
||||
<password>${keycloak.connectionsJpa.password}</password>
|
||||
|
||||
<promptOnNonLocalDatabase>false</promptOnNonLocalDatabase>
|
||||
</configuration>
|
||||
<executions>
|
||||
<execution>
|
||||
<id>clean-jpa</id>
|
||||
<phase>clean</phase>
|
||||
<goals>
|
||||
<goal>dropAll</goal>
|
||||
</goals>
|
||||
</execution>
|
||||
</executions>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
</profile>
|
||||
</profiles>
|
||||
</project>
|
||||
|
|
@ -1,283 +0,0 @@
|
|||
/*
|
||||
* Copyright 2016 Red Hat, Inc. and/or its affiliates
|
||||
* and other contributors as indicated by the @author tags.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package org.keycloak.testsuite;
|
||||
|
||||
import io.undertow.Undertow;
|
||||
import org.apache.catalina.startup.Tomcat;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Assert;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.ClassRule;
|
||||
import org.junit.Ignore;
|
||||
import org.junit.Rule;
|
||||
import org.junit.Test;
|
||||
import org.keycloak.OAuth2Constants;
|
||||
import org.keycloak.models.KeycloakSession;
|
||||
import org.keycloak.models.RealmModel;
|
||||
import org.keycloak.protocol.oidc.OIDCLoginProtocolService;
|
||||
import org.keycloak.proxy.ProxyServerBuilder;
|
||||
import org.keycloak.representations.idm.RealmRepresentation;
|
||||
import org.keycloak.services.managers.RealmManager;
|
||||
import org.keycloak.testsuite.pages.LoginPage;
|
||||
import org.keycloak.testsuite.rule.AbstractKeycloakRule;
|
||||
import org.keycloak.testsuite.rule.WebResource;
|
||||
import org.keycloak.testsuite.rule.WebRule;
|
||||
import org.openqa.selenium.WebDriver;
|
||||
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
import javax.ws.rs.client.Client;
|
||||
import javax.ws.rs.client.ClientBuilder;
|
||||
import javax.ws.rs.client.WebTarget;
|
||||
import javax.ws.rs.core.HttpHeaders;
|
||||
import javax.ws.rs.core.Response;
|
||||
import javax.ws.rs.core.UriBuilder;
|
||||
import java.io.File;
|
||||
import java.io.IOException;
|
||||
import java.io.InputStream;
|
||||
import java.io.OutputStream;
|
||||
import java.net.URL;
|
||||
import java.util.Enumeration;
|
||||
import java.util.regex.Matcher;
|
||||
|
||||
@Ignore
|
||||
public class ProxyTest {
|
||||
static String logoutUri = OIDCLoginProtocolService.logoutUrl(UriBuilder.fromUri("http://localhost:8081/auth"))
|
||||
.queryParam(OAuth2Constants.REDIRECT_URI, "http://localhost:8080/customer-portal").build("demo").toString();
|
||||
|
||||
@ClassRule
|
||||
public static AbstractKeycloakRule keycloakRule = new AbstractKeycloakRule() {
|
||||
@Override
|
||||
protected void configure(KeycloakSession session, RealmManager manager, RealmModel adminRealm) {
|
||||
RealmRepresentation representation = KeycloakServer.loadJson(getClass().getResourceAsStream("/demorealm.json"), RealmRepresentation.class);
|
||||
RealmModel realm = manager.importRealm(representation);
|
||||
}
|
||||
};
|
||||
|
||||
public static class SendUsernameServlet extends HttpServlet {
|
||||
@Override
|
||||
protected void doGet(final HttpServletRequest req, final HttpServletResponse resp) throws ServletException, IOException {
|
||||
String requestURI = req.getRequestURI();
|
||||
resp.setContentType("text/plain");
|
||||
OutputStream stream = resp.getOutputStream();
|
||||
stream.write(req.getRequestURL().toString().getBytes());
|
||||
stream.write("\n".getBytes());
|
||||
Integer count = (Integer)req.getSession().getAttribute("counter");
|
||||
if (count == null) count = new Integer(0);
|
||||
req.getSession().setAttribute("counter", new Integer(count.intValue() + 1));
|
||||
stream.write(("count:"+count).getBytes());
|
||||
|
||||
Enumeration<String> headers = req.getHeaderNames();
|
||||
while (headers.hasMoreElements()) {
|
||||
String name = headers.nextElement();
|
||||
System.out.println(name +": " + req.getHeader(name));
|
||||
}
|
||||
|
||||
if (requestURI.contains("/bearer")) {
|
||||
Client client = ClientBuilder.newClient();
|
||||
|
||||
try {
|
||||
String appBase = "http://localhost:8080/customer-portal";
|
||||
WebTarget target = client.target(appBase + "/call-bearer");
|
||||
|
||||
Response response = null;
|
||||
response = target.request()
|
||||
.header(HttpHeaders.AUTHORIZATION, "Bearer CRAP")
|
||||
.get();
|
||||
Assert.assertEquals(401, response.getStatus());
|
||||
response.close();
|
||||
response = target.request()
|
||||
.header(HttpHeaders.AUTHORIZATION, "Bearer " + req.getHeader("KEYCLOAK_ACCESS_TOKEN"))
|
||||
.get();
|
||||
Assert.assertEquals(200, response.getStatus());
|
||||
String data = response.readEntity(String.class);
|
||||
response.close();
|
||||
stream.write(data.getBytes());
|
||||
} finally {
|
||||
client.close();
|
||||
}
|
||||
|
||||
} else if (requestURI.contains("/call-bearer")) {
|
||||
stream.write("bearer called".getBytes());
|
||||
}
|
||||
}
|
||||
@Override
|
||||
protected void doPost(final HttpServletRequest req, final HttpServletResponse resp) throws ServletException, IOException {
|
||||
doGet(req, resp);
|
||||
}
|
||||
}
|
||||
public static class SendError extends HttpServlet {
|
||||
@Override
|
||||
protected void doGet(final HttpServletRequest req, final HttpServletResponse resp) throws ServletException, IOException {
|
||||
resp.setContentType("text/plain");
|
||||
OutputStream stream = resp.getOutputStream();
|
||||
stream.write("access error".getBytes());
|
||||
}
|
||||
@Override
|
||||
protected void doPost(final HttpServletRequest req, final HttpServletResponse resp) throws ServletException, IOException {
|
||||
doGet(req, resp);
|
||||
}
|
||||
}
|
||||
|
||||
static Tomcat tomcat = null;
|
||||
|
||||
public static void initTomcat() throws Exception {
|
||||
URL dir = ProxyTest.class.getResource("/tomcat-test/webapp/WEB-INF/web.xml");
|
||||
File webappDir = new File(dir.getFile()).getParentFile().getParentFile();
|
||||
tomcat = new Tomcat();
|
||||
String baseDir = getBaseDirectory();
|
||||
tomcat.setBaseDir(baseDir);
|
||||
tomcat.setPort(8082);
|
||||
|
||||
tomcat.addWebapp("/customer-portal", webappDir.toString());
|
||||
System.out.println("configuring app with basedir: " + webappDir.toString());
|
||||
|
||||
tomcat.start();
|
||||
//tomcat.getServer().await();
|
||||
}
|
||||
|
||||
public static void shutdownTomcat() throws Exception {
|
||||
tomcat.stop();
|
||||
tomcat.destroy();
|
||||
}
|
||||
|
||||
static Undertow proxyServer = null;
|
||||
|
||||
@BeforeClass
|
||||
public static void initProxy() throws Exception {
|
||||
initTomcat();
|
||||
InputStream is = ProxyTest.class.getResourceAsStream("/proxy-config.json");
|
||||
proxyServer = ProxyServerBuilder.build(is);
|
||||
proxyServer.start();
|
||||
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void shutdownProxy() throws Exception {
|
||||
shutdownTomcat();
|
||||
if (proxyServer != null) proxyServer.stop();
|
||||
}
|
||||
|
||||
|
||||
@Rule
|
||||
public WebRule webRule = new WebRule(this);
|
||||
@WebResource
|
||||
protected WebDriver driver;
|
||||
@WebResource
|
||||
protected LoginPage loginPage;
|
||||
|
||||
public static final String LOGIN_URL = OIDCLoginProtocolService.authUrl(UriBuilder.fromUri("http://localhost:8081/auth")).build("demo").toString();
|
||||
|
||||
@Test
|
||||
public void testHttp() throws Exception {
|
||||
String baseUrl = "http://localhost:8080";
|
||||
testit(baseUrl);
|
||||
|
||||
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testHttps() throws Exception {
|
||||
String baseUrl = "https://localhost:8443";
|
||||
testit(baseUrl);
|
||||
|
||||
|
||||
}
|
||||
|
||||
public void testit(String baseUrl) {
|
||||
driver.navigate().to(baseUrl + "/customer-portal/users");
|
||||
System.out.println("Current url: " + driver.getCurrentUrl());
|
||||
Assert.assertTrue(driver.getCurrentUrl().startsWith(LOGIN_URL));
|
||||
String loginPageSource = driver.getPageSource();
|
||||
loginPage.login("bburke@redhat.com", "password");
|
||||
System.out.println("Current url: " + driver.getCurrentUrl());
|
||||
Assert.assertEquals(driver.getCurrentUrl(), baseUrl + "/customer-portal/users");
|
||||
String pageSource = driver.getPageSource();
|
||||
System.out.println(pageSource);
|
||||
Assert.assertTrue(pageSource.contains("customer-portal/users"));
|
||||
Assert.assertTrue(pageSource.contains("count:0"));
|
||||
driver.navigate().to(baseUrl + "/customer-portal/users");
|
||||
Assert.assertEquals(driver.getCurrentUrl(), baseUrl + "/customer-portal/users");
|
||||
pageSource = driver.getPageSource();
|
||||
System.out.println(pageSource);
|
||||
Assert.assertTrue(pageSource.contains("customer-portal/users"));
|
||||
Assert.assertTrue(pageSource.contains("count:1")); // test http session
|
||||
|
||||
driver.navigate().to(baseUrl + "/customer-portal/bearer");
|
||||
pageSource = driver.getPageSource();
|
||||
Assert.assertTrue(pageSource.contains("bearer called"));
|
||||
|
||||
|
||||
driver.navigate().to(baseUrl + "/customer-portal/users/deny");
|
||||
Assert.assertEquals(driver.getCurrentUrl(), baseUrl + "/customer-portal/users/deny");
|
||||
pageSource = driver.getPageSource();
|
||||
System.out.println(pageSource);
|
||||
Assert.assertTrue(pageSource.contains("access error"));
|
||||
|
||||
driver.navigate().to(baseUrl + "/customer-portal/admins");
|
||||
Assert.assertEquals(driver.getCurrentUrl(), baseUrl + "/customer-portal/admins");
|
||||
pageSource = driver.getPageSource();
|
||||
System.out.println(pageSource);
|
||||
Assert.assertTrue(pageSource.contains("access error"));
|
||||
|
||||
|
||||
// test logout
|
||||
|
||||
String logoutUri = OIDCLoginProtocolService.logoutUrl(UriBuilder.fromUri("http://localhost:8081/auth"))
|
||||
.queryParam(OAuth2Constants.REDIRECT_URI, baseUrl + "/customer-portal/users").build("demo").toString();
|
||||
driver.navigate().to(logoutUri);
|
||||
Assert.assertTrue(driver.getCurrentUrl().startsWith(LOGIN_URL));
|
||||
driver.navigate().to(baseUrl + "/customer-portal/users");
|
||||
String currentUrl = driver.getCurrentUrl();
|
||||
Assert.assertTrue(currentUrl.startsWith(LOGIN_URL));
|
||||
|
||||
// test unsecured page
|
||||
driver.navigate().to(baseUrl + "/customer-portal") ;
|
||||
pageSource = driver.getPageSource();
|
||||
System.out.println(pageSource);
|
||||
Assert.assertTrue(pageSource.contains("customer-portal"));
|
||||
driver.navigate().to(baseUrl + "/customer-portal/users/permit") ;
|
||||
pageSource = driver.getPageSource();
|
||||
System.out.println(pageSource);
|
||||
Assert.assertTrue(pageSource.contains("customer-portal/users/permit"));
|
||||
}
|
||||
|
||||
private static String getBaseDirectory() {
|
||||
String dirPath = null;
|
||||
String relativeDirPath = "testsuite" + File.separator + "proxy" + File.separator + "target";
|
||||
|
||||
if (System.getProperties().containsKey("maven.home")) {
|
||||
dirPath = System.getProperty("user.dir").replaceFirst("testsuite.proxy.*", Matcher.quoteReplacement(relativeDirPath));
|
||||
} else {
|
||||
for (String c : System.getProperty("java.class.path").split(File.pathSeparator)) {
|
||||
if (c.contains(File.separator + "testsuite" + File.separator + "proxy")) {
|
||||
dirPath = c.replaceFirst("testsuite.proxy.*", Matcher.quoteReplacement(relativeDirPath));
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
String absolutePath = new File(dirPath).getAbsolutePath();
|
||||
return absolutePath;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
}
|
||||
|
|
@ -1,71 +0,0 @@
|
|||
{
|
||||
"id": "demo",
|
||||
"realm": "demo",
|
||||
"enabled": true,
|
||||
"accessTokenLifespan": 3000,
|
||||
"accessCodeLifespan": 10,
|
||||
"accessCodeLifespanUserAction": 6000,
|
||||
"sslRequired": "external",
|
||||
"registrationAllowed": false,
|
||||
"privateKey": "MIICXAIBAAKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQABAoGAfmO8gVhyBxdqlxmIuglbz8bcjQbhXJLR2EoS8ngTXmN1bo2L90M0mUKSdc7qF10LgETBzqL8jYlQIbt+e6TH8fcEpKCjUlyq0Mf/vVbfZSNaVycY13nTzo27iPyWQHK5NLuJzn1xvxxrUeXI6A2WFpGEBLbHjwpx5WQG9A+2scECQQDvdn9NE75HPTVPxBqsEd2z10TKkl9CZxu10Qby3iQQmWLEJ9LNmy3acvKrE3gMiYNWb6xHPKiIqOR1as7L24aTAkEAtyvQOlCvr5kAjVqrEKXalj0Tzewjweuxc0pskvArTI2Oo070h65GpoIKLc9jf+UA69cRtquwP93aZKtW06U8dQJAF2Y44ks/mK5+eyDqik3koCI08qaC8HYq2wVl7G2QkJ6sbAaILtcvD92ToOvyGyeE0flvmDZxMYlvaZnaQ0lcSQJBAKZU6umJi3/xeEbkJqMfeLclD27XGEFoPeNrmdx0q10Azp4NfJAY+Z8KRyQCR2BEG+oNitBOZ+YXF9KCpH3cdmECQHEigJhYg+ykOvr1aiZUMFT72HU0jnmQe2FVekuG+LJUt2Tm7GtMjTFoGpf0JwrVuZN39fOYAlo+nTixgeW7X8Y=",
|
||||
"publicKey": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB",
|
||||
"requiredCredentials": [ "password" ],
|
||||
"users" : [
|
||||
{
|
||||
"username" : "bburke@redhat.com",
|
||||
"enabled": true,
|
||||
"email" : "bburke@redhat.com",
|
||||
"firstName": "Bill",
|
||||
"lastName": "Burke",
|
||||
"credentials" : [
|
||||
{ "type" : "password",
|
||||
"value" : "password" }
|
||||
],
|
||||
"realmRoles": [ "user" ],
|
||||
"applicationRoles": {
|
||||
"account": [ "manage-account" ]
|
||||
}
|
||||
},
|
||||
{
|
||||
"username" : "admin",
|
||||
"enabled": true,
|
||||
"email" : "admin.burke@redhat.com",
|
||||
"firstName": "Admin",
|
||||
"lastName": "Burke",
|
||||
"credentials" : [
|
||||
{ "type" : "password",
|
||||
"value" : "password" }
|
||||
],
|
||||
"realmRoles": [ "user", "admin" ],
|
||||
"applicationRoles": {
|
||||
"account": [ "manage-account" ]
|
||||
}
|
||||
}
|
||||
],
|
||||
"roles" : {
|
||||
"realm" : [
|
||||
{
|
||||
"name": "user",
|
||||
"description": "User privileges"
|
||||
},
|
||||
{
|
||||
"name": "admin",
|
||||
"description": "Administrator privileges"
|
||||
}
|
||||
]
|
||||
},
|
||||
"applications": [
|
||||
{
|
||||
"name": "customer-portal",
|
||||
"enabled": true,
|
||||
"fullScopeAllowed": true,
|
||||
"adminUrl": "http://localhost:8080/customer-portal",
|
||||
"baseUrl": "http://localhost:8080/customer-portal",
|
||||
"redirectUris": [
|
||||
"http://localhost:8080/customer-portal/*",
|
||||
"https://localhost:8443/customer-portal/*"
|
||||
],
|
||||
"secret": "password"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
{
|
||||
"realm": "demo",
|
||||
"resource": "customer-portal",
|
||||
"realm-public-key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB",
|
||||
"auth-server-url": "http://localhost:8081/auth",
|
||||
"ssl-required" : "external",
|
||||
"principal-attribute": "name",
|
||||
"credentials": {
|
||||
"secret": "password"
|
||||
}
|
||||
}
|
||||
|
|
@ -1,64 +0,0 @@
|
|||
{
|
||||
"bind-address": "localhost",
|
||||
"http-port": "8080",
|
||||
"https-port": "8443",
|
||||
"keystore": "classpath:ssl.jks",
|
||||
"keystore-password": "password",
|
||||
"key-password": "password",
|
||||
"target-url": "http://localhost:8082",
|
||||
"send-access-token": true,
|
||||
"applications": [
|
||||
{
|
||||
"base-path": "/customer-portal",
|
||||
"error-page": "/error.html",
|
||||
"adapter-config": {
|
||||
"realm": "demo",
|
||||
"resource": "customer-portal",
|
||||
"realm-public-key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB",
|
||||
"auth-server-url": "http://localhost:8081/auth",
|
||||
"ssl-required" : "external",
|
||||
"principal-attribute": "name",
|
||||
"credentials": {
|
||||
"secret": "password"
|
||||
}
|
||||
}
|
||||
,
|
||||
"constraints": [
|
||||
{
|
||||
"pattern": "/users/*",
|
||||
"roles-allowed": [
|
||||
"user"
|
||||
]
|
||||
},
|
||||
{
|
||||
"pattern": "/call-bearer/*",
|
||||
"roles-allowed": [
|
||||
"user"
|
||||
]
|
||||
},
|
||||
{
|
||||
"pattern": "/bearer/*",
|
||||
"roles-allowed": [
|
||||
"user"
|
||||
]
|
||||
},
|
||||
{
|
||||
"pattern": "/admins/*",
|
||||
"roles-allowed": [
|
||||
"admin"
|
||||
]
|
||||
},
|
||||
{
|
||||
"pattern": "/users/permit",
|
||||
"permit": true
|
||||
},
|
||||
{
|
||||
"pattern": "/users/deny",
|
||||
"deny": true
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
|
||||
|
||||
}
|
||||
Binary file not shown.
|
|
@ -1,44 +0,0 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!--
|
||||
~ Copyright 2016 Red Hat, Inc. and/or its affiliates
|
||||
~ and other contributors as indicated by the @author tags.
|
||||
~
|
||||
~ Licensed under the Apache License, Version 2.0 (the "License");
|
||||
~ you may not use this file except in compliance with the License.
|
||||
~ You may obtain a copy of the License at
|
||||
~
|
||||
~ http://www.apache.org/licenses/LICENSE-2.0
|
||||
~
|
||||
~ Unless required by applicable law or agreed to in writing, software
|
||||
~ distributed under the License is distributed on an "AS IS" BASIS,
|
||||
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
~ See the License for the specific language governing permissions and
|
||||
~ limitations under the License.
|
||||
-->
|
||||
|
||||
<web-app xmlns="http://java.sun.com/xml/ns/javaee"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
|
||||
version="3.0">
|
||||
|
||||
<module-name>adapter-test</module-name>
|
||||
|
||||
<servlet>
|
||||
<servlet-name>SendUsername</servlet-name>
|
||||
<servlet-class>org.keycloak.testsuite.ProxyTest$SendUsernameServlet</servlet-class>
|
||||
</servlet>
|
||||
<servlet>
|
||||
<servlet-name>Error</servlet-name>
|
||||
<servlet-class>org.keycloak.testsuite.ProxyTest$SendError</servlet-class>
|
||||
</servlet>
|
||||
|
||||
<servlet-mapping>
|
||||
<servlet-name>Error</servlet-name>
|
||||
<url-pattern>/error.html</url-pattern>
|
||||
</servlet-mapping>
|
||||
<servlet-mapping>
|
||||
<servlet-name>SendUsername</servlet-name>
|
||||
<url-pattern>/*</url-pattern>
|
||||
</servlet-mapping>
|
||||
|
||||
</web-app>
|
||||
|
|
@ -53,7 +53,6 @@ if [ $1 == "old" ]; then
|
|||
cd testsuite
|
||||
mvn test -B -nsu -f integration-deprecated
|
||||
mvn test -B -nsu -f jetty
|
||||
mvn test -B -nsu -f proxy
|
||||
mvn test -B -nsu -f tomcat7
|
||||
mvn test -B -nsu -f tomcat8
|
||||
fi
|
||||
|
|
@ -102,4 +101,4 @@ if [ $1 == "crossdc-adapter" ]; then
|
|||
mvn clean test -B -nsu -Pcache-server-infinispan,auth-servers-crossdc-jboss,auth-server-wildfly,app-server-wildfly -Dtest=org.keycloak.testsuite.adapter.**.crossdc.**.* 2>&1 |
|
||||
java -cp ../../../utils/target/classes org.keycloak.testsuite.LogTrimmer
|
||||
exit ${PIPESTATUS[0]}
|
||||
fi
|
||||
fi
|
||||
|
|
|
|||
Loading…
Reference in a new issue