safebox/guacamole-client
4
0
Fork 0
mirror of https://github.com/gyurix1968/guacamole-client.git synced 2025-09-06 21:27:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

GUACAMOLE-579: Parse tokens from attributes provided by the CAS server.

Browse Source
This commit is contained in:
Nick Couchman
2018-12-08 11:49:42 -05:00
committed by Virtually Nick
parent 82ea1d6ff5
commit 55c4144fbf
12 changed files with 288 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
extensions/guacamole-auth-cas/pom.xml
View File

@@ -254,6 +254,14 @@
<version>2.5</version>
<scope>provided</scope>
</dependency>
<!-- JUnit -->
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>4.12</version>
<scope>test</scope>
</dependency>
</dependencies>

18
extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/AuthenticationProviderService.java
View File

@@ -22,6 +22,9 @@ package org.apache.guacamole.auth.cas;
import com.google.inject.Inject;
import com.google.inject.Provider;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
import java.util.Map.Entry;
import javax.servlet.http.HttpServletRequest;
import org.apache.guacamole.form.Field;
import org.apache.guacamole.GuacamoleException;
@@ -31,7 +34,7 @@ import org.apache.guacamole.net.auth.credentials.GuacamoleInvalidCredentialsExce
import org.apache.guacamole.auth.cas.conf.ConfigurationService;
import org.apache.guacamole.auth.cas.form.CASTicketField;
import org.apache.guacamole.auth.cas.ticket.TicketValidationService;
import org.apache.guacamole.auth.cas.user.AuthenticatedUser;
import org.apache.guacamole.auth.cas.user.CASAuthenticatedUser;
/**
* Service providing convenience functions for the CAS AuthenticationProvider
@@ -55,7 +58,7 @@ public class AuthenticationProviderService {
* Provider for AuthenticatedUser objects.
*/
@Inject
private Provider<AuthenticatedUser> authenticatedUserProvider;
private Provider<CASAuthenticatedUser> authenticatedUserProvider;
/**
* Returns an AuthenticatedUser representing the user authenticated by the
@@ -65,14 +68,14 @@ public class AuthenticationProviderService {
* The credentials to use for authentication.
*
* @return
* An AuthenticatedUser representing the user authenticated by the
* A CASAuthenticatedUser representing the user authenticated by the
* given credentials.
*
* @throws GuacamoleException
* If an error occurs while authenticating the user, or if access is
* denied.
*/
public AuthenticatedUser authenticateUser(Credentials credentials)
public CASAuthenticatedUser authenticateUser(Credentials credentials)
throws GuacamoleException {
// Pull CAS ticket from request if present
@@ -80,10 +83,11 @@ public class AuthenticationProviderService {
if (request != null) {
String ticket = request.getParameter(CASTicketField.PARAMETER_NAME);
if (ticket != null) {
String username = ticketService.validateTicket(ticket, credentials);
Map<String, String> tokens = ticketService.validateTicket(ticket, credentials);
String username = credentials.getUsername();
if (username != null) {
AuthenticatedUser authenticatedUser = authenticatedUserProvider.get();
authenticatedUser.init(username, credentials);
CASAuthenticatedUser authenticatedUser = authenticatedUserProvider.get();
authenticatedUser.init(username, credentials, tokens);
return authenticatedUser;
}
}

15
extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/CASAuthenticationProvider.java
View File

@@ -22,9 +22,12 @@ package org.apache.guacamole.auth.cas;
import com.google.inject.Guice;
import com.google.inject.Injector;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.auth.cas.user.CASAuthenticatedUser;
import org.apache.guacamole.net.auth.AbstractAuthenticationProvider;
import org.apache.guacamole.net.auth.AuthenticatedUser;
import org.apache.guacamole.net.auth.Credentials;
import org.apache.guacamole.net.auth.TokenInjectingUserContext;
import org.apache.guacamole.net.auth.UserContext;
/**
* Guacamole authentication backend which authenticates users using an
@@ -71,5 +74,17 @@ public class CASAuthenticationProvider extends AbstractAuthenticationProvider {
return authProviderService.authenticateUser(credentials);
}
@Override
public UserContext decorate(UserContext context,
AuthenticatedUser authenticatedUser, Credentials credentials)
throws GuacamoleException {
if (!(authenticatedUser instanceof CASAuthenticatedUser))
return context;
return new TokenInjectingUserContext(context,
((CASAuthenticatedUser) authenticatedUser).getTokens());
}
}

33
extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/CASTokenName.java Normal file
View File

@@ -0,0 +1,33 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.guacamole.auth.cas;
import org.apache.guacamole.token.TokenName;
/**
* Utility class for generating parameter token names.
*/
public class CASTokenName extends TokenName {
public static String fromAttribute(String name) {
return fromAttribute(name, "CAS_");
}
}

36
extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/ticket/TicketValidationService.java
View File

@@ -28,13 +28,15 @@ import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.NoSuchPaddingException;
import java.nio.charset.Charset;
import java.util.HashMap;
import java.util.Map;
import java.util.Map.Entry;
import javax.xml.bind.DatatypeConverter;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.GuacamoleServerException;
import org.apache.guacamole.auth.cas.CASTokenName;
import org.apache.guacamole.auth.cas.conf.ConfigurationService;
import org.apache.guacamole.net.auth.Credentials;
import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
import org.apache.guacamole.net.auth.credentials.GuacamoleInvalidCredentialsException;
import org.jasig.cas.client.authentication.AttributePrincipal;
import org.jasig.cas.client.validation.Assertion;
import org.jasig.cas.client.validation.Cas20ProxyTicketValidator;
@@ -60,9 +62,9 @@ public class TicketValidationService {
private ConfigurationService confService;
/**
* Validates and parses the given ID ticket, returning the username
* provided by the CAS server in the ticket. If the
* ticket is invalid an exception is thrown.
* Validates and parses the given ID ticket, returning a map of all
* available tokens for the given user based on attributes provided by the
* CAS server. If the ticket is invalid an exception is thrown.
*
* @param ticket
* The ID ticket to validate and parse.
@@ -72,13 +74,15 @@ public class TicketValidationService {
* password values in.
*
* @return
* The username derived from the ticket.
* A Map all of tokens for the user parsed from attributes returned
* by the CAS server.
*
* @throws GuacamoleException
* If the ID ticket is not valid or guacamole.properties could
* not be parsed.
*/
public String validateTicket(String ticket, Credentials credentials) throws GuacamoleException {
public Map<String, String> validateTicket(String ticket,
Credentials credentials) throws GuacamoleException {
// Retrieve the configured CAS URL, establish a ticket validator,
// and then attempt to validate the supplied ticket. If that succeeds,
@@ -88,9 +92,11 @@ public class TicketValidationService {
validator.setAcceptAnyProxy(true);
validator.setEncoding("UTF-8");
try {
Map<String, String> tokens = new HashMap<>();
String confRedirectURI = confService.getRedirectURI();
Assertion a = validator.validate(ticket, confRedirectURI);
AttributePrincipal principal = a.getPrincipal();
Map<String, Object> ticketAttrs = principal.getAttributes();
// Retrieve username and set the credentials.
String username = principal.getName();
@@ -98,23 +104,27 @@ public class TicketValidationService {
credentials.setUsername(username);
// Retrieve password, attempt decryption, and set credentials.
Object credObj = principal.getAttributes().get("credential");
Object credObj = ticketAttrs.remove("credential");
if (credObj != null) {
String clearPass = decryptPassword(credObj.toString());
if (clearPass != null && !clearPass.isEmpty())
credentials.setPassword(clearPass);
}
// Convert remaining attributes that have values to Strings
for (Entry attr : ticketAttrs.entrySet()) {
String tokenName = CASTokenName.fromAttribute(attr.getKey().toString());
Object value = attr.getValue();
if (value != null)
tokens.put(tokenName, value.toString());
}
return username;
return tokens;
}
catch (TicketValidationException e) {
throw new GuacamoleException("Ticket validation failed.", e);
}
catch (Throwable t) {
logger.error("Error validating ticket with CAS server: {}", t.getMessage());
throw new GuacamoleInvalidCredentialsException("CAS login failed.", CredentialsInfo.USERNAME_PASSWORD);
}
}

29
extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/user/AuthenticatedUser.java → extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/user/CASAuthenticatedUser.java
View File

@@ -20,6 +20,8 @@
package org.apache.guacamole.auth.cas.user;
import com.google.inject.Inject;
import java.util.Collections;
import java.util.Map;
import org.apache.guacamole.net.auth.AbstractAuthenticatedUser;
import org.apache.guacamole.net.auth.AuthenticationProvider;
import org.apache.guacamole.net.auth.Credentials;
@@ -29,7 +31,7 @@ import org.apache.guacamole.net.auth.Credentials;
* username and particular set of credentials with the CAS authentication
* provider.
*/
public class AuthenticatedUser extends AbstractAuthenticatedUser {
public class CASAuthenticatedUser extends AbstractAuthenticatedUser {
/**
* Reference to the authentication provider associated with this
@@ -42,6 +44,11 @@ public class AuthenticatedUser extends AbstractAuthenticatedUser {
* The credentials provided when this user was authenticated.
*/
private Credentials credentials;
/**
* Tokens associated with this authenticated user.
*/
private Map<String, String> tokens;
/**
* Initializes this AuthenticatedUser using the given username and
@@ -52,12 +59,30 @@ public class AuthenticatedUser extends AbstractAuthenticatedUser {
*
* @param credentials
* The credentials provided when this user was authenticated.
*
* @param tokens
* A map of all the name/value pairs that should be available
* as tokens when connections are established with this user.
*/
public void init(String username, Credentials credentials) {
public void init(String username, Credentials credentials,
Map<String, String> tokens) {
this.credentials = credentials;
this.tokens = Collections.unmodifiableMap(tokens);
setIdentifier(username.toLowerCase());
}
/**
* Returns a Map containing the name/value pairs that can be applied
* as parameter tokens when connections are established by the user.
*
* @return
* A Map containing all of the name/value pairs that can be
* used as parameter tokens by this user.
*/
public Map<String, String> getTokens() {
return tokens;
}
@Override
public AuthenticationProvider getAuthenticationProvider() {
return authProvider;

53
extensions/guacamole-auth-cas/src/test/java/org/apache/guacamole/auth/cas/CASTokenNameTest.java Normal file
View File

@@ -0,0 +1,53 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.guacamole.auth.cas;
import static org.junit.Assert.assertEquals;
import org.junit.Test;
/**
* Test which verifies automatic generation of LDAP-specific connection
* parameter token names.
*/
public class CASTokenNameTest {
/**
* Verifies that TokenName.fromAttribute() generates token names as
* specified, regardless of the naming convention of the attribute.
*/
@Test
public void testFromAttribute() {
assertEquals("CAS_A", CASTokenName.fromAttribute("a"));
assertEquals("CAS_B", CASTokenName.fromAttribute("b"));
assertEquals("CAS_1", CASTokenName.fromAttribute("1"));
assertEquals("CAS_SOME_URL", CASTokenName.fromAttribute("someURL"));
assertEquals("CAS_LOWERCASE_WITH_DASHES", CASTokenName.fromAttribute("lowercase-with-dashes"));
assertEquals("CAS_HEADLESS_CAMEL_CASE", CASTokenName.fromAttribute("headlessCamelCase"));
assertEquals("CAS_CAMEL_CASE", CASTokenName.fromAttribute("CamelCase"));
assertEquals("CAS_CAMEL_CASE", CASTokenName.fromAttribute("CamelCase"));
assertEquals("CAS_LOWERCASE_WITH_UNDERSCORES", CASTokenName.fromAttribute("lowercase_with_underscores"));
assertEquals("CAS_UPPERCASE_WITH_UNDERSCORES", CASTokenName.fromAttribute("UPPERCASE_WITH_UNDERSCORES"));
assertEquals("CAS_A_VERY_INCONSISTENT_MIX_OF_ALL_STYLES", CASTokenName.fromAttribute("aVery-INCONSISTENTMix_ofAllStyles"));
assertEquals("CAS_ABC_123_DEF_456", CASTokenName.fromAttribute("abc123def456"));
assertEquals("CAS_ABC_123_DEF_456", CASTokenName.fromAttribute("ABC123DEF456"));
assertEquals("CAS_WORD_A_WORD_AB_WORD_ABC_WORD", CASTokenName.fromAttribute("WordAWordABWordABCWord"));
}
}