libre.sh/keycloak-scim
4
0
Fork 0
Code Issues 15 Pull requests Releases 1 Activity Actions

KEYCLOAK-2828: LoginStatusIframeEndpoint now sets the P3P header.

Browse source 
IE requires a P3P header to be present in <iframe /> response. Otherwise
cookies are forbidden. The value of the header does not seem to matter.
This commit is contained in:
Thomas Raehalme 2016-04-15 15:48:56 +03:00 committed by Stian Thorgersen
parent 069d362778
commit cd1094c3ad
2 changed files with 30 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
services/src/main/java/org/keycloak/protocol/oidc/endpoints/LoginStatusIframeEndpoint.java
View file

@ -17,13 +17,19 @@
package org.keycloak.protocol.oidc.endpoints; package org.keycloak.protocol.oidc.endpoints;
import org.jboss.logging.Logger;
import org.jboss.resteasy.spi.NotFoundException; import org.jboss.resteasy.spi.NotFoundException;
import org.keycloak.Config; import org.keycloak.Config;
import org.keycloak.models.ClientModel; import org.keycloak.models.ClientModel;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.RealmModel; import org.keycloak.models.RealmModel;
import org.keycloak.protocol.oidc.utils.RedirectUtils; import org.keycloak.protocol.oidc.utils.RedirectUtils;
import org.keycloak.common.util.StreamUtil; import org.keycloak.common.util.StreamUtil;
import org.keycloak.common.util.UriUtils; import org.keycloak.common.util.UriUtils;
import org.keycloak.saml.common.util.StringUtil;
import org.keycloak.services.validation.Validation;
import org.keycloak.theme.Theme;
import org.keycloak.theme.ThemeProvider;
import javax.ws.rs.GET; import javax.ws.rs.GET;
import javax.ws.rs.Produces; import javax.ws.rs.Produces;
@ -41,10 +47,14 @@ import java.io.InputStream;
* @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a> * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
*/ */
public class LoginStatusIframeEndpoint { public class LoginStatusIframeEndpoint {
private static final Logger logger = Logger.getLogger(LoginStatusIframeEndpoint.class);
@Context @Context
private UriInfo uriInfo; private UriInfo uriInfo;
@Context
protected KeycloakSession session;
private RealmModel realm; private RealmModel realm;
public LoginStatusIframeEndpoint(RealmModel realm) { public LoginStatusIframeEndpoint(RealmModel realm) {
@ -95,15 +105,32 @@ public class LoginStatusIframeEndpoint {
throw new WebApplicationException(Response.Status.BAD_REQUEST); throw new WebApplicationException(Response.Status.BAD_REQUEST);
} }
ThemeProvider themeProvider = session.getProvider(ThemeProvider.class, "extending");
Theme theme;
try {
theme = themeProvider.getTheme(realm.getLoginTheme(), Theme.Type.LOGIN);
} catch (IOException e) {
logger.error("Failed to create theme", e);
return Response.serverError().build();
}
try { try {
String file = StreamUtil.readString(is); String file = StreamUtil.readString(is);
file = file.replace("ORIGIN", origin); file = file.replace("ORIGIN", origin);
Response.ResponseBuilder response = Response.ok(file);
String p3pValue = theme.getProperties().getProperty("sessionIframeP3P");
if (!Validation.isBlank(p3pValue)) {
// This header is required by IE, see KEYCLOAK-2828 for details.
response.header("P3P", p3pValue);
}
CacheControl cacheControl = new CacheControl(); CacheControl cacheControl = new CacheControl();
cacheControl.setNoTransform(false); cacheControl.setNoTransform(false);
cacheControl.setMaxAge(Config.scope("theme").getInt("staticMaxAge", -1)); cacheControl.setMaxAge(Config.scope("theme").getInt("staticMaxAge", -1));
return Response.ok(file).cacheControl(cacheControl).build(); return response.cacheControl(cacheControl).build();
} catch (IOException e) { } catch (IOException e) {
throw new WebApplicationException(e, Response.Status.BAD_REQUEST); throw new WebApplicationException(e, Response.Status.BAD_REQUEST);
} }

3
themes/src/main/resources/theme/base/login/theme.properties
View file

@ -1 +1,2 @@
locales=ca,de,en,es,fr,it,pt-BR locales=ca,de,en,es,fr,it,pt-BR
sessionIframeP3P=CP="This is not a P3P policy!"