import org.jasig.cas.client.util.CommonUtils; //导入依赖的package包/类
/**
 * Handle federation request.
 *
 * @param response the response
 * @param request  the request
 * @return the model and view
 * @throws Exception the exception
 */
@GetMapping(path = WSFederationConstants.ENDPOINT_FEDERATION_REQUEST_CALLBACK)
protected ModelAndView handleFederationRequest(final HttpServletResponse response, final HttpServletRequest request) throws Exception {
    final WSFederationRequest fedRequest = WSFederationRequest.of(request);
    LOGGER.debug("Received callback profile request [{}]", request.getRequestURI());
    final WSFederationRegisteredService service = findAndValidateFederationRequestForRegisteredService(response, request, fedRequest);
    LOGGER.debug("Located matching service [{}]", service);

    final String ticket = CommonUtils.safeGetParameter(request, CasProtocolConstants.PARAMETER_TICKET);
    if (StringUtils.isBlank(ticket)) {
        LOGGER.error("Can not validate the request because no [{}] is provided via the request", CasProtocolConstants.PARAMETER_TICKET);
        return new ModelAndView(CasWebflowConstants.VIEW_ID_ERROR, new HashMap<>(), HttpStatus.FORBIDDEN);
    }

    final Assertion assertion = validateRequestAndBuildCasAssertion(response, request, fedRequest);
    SecurityToken securityToken = getSecurityTokenFromRequest(request);
    if (securityToken == null) {
        LOGGER.debug("No security token is yet available. Invoking security token service to issue token");
        securityToken = validateSecurityTokenInAssertion(assertion, request, response);
    }
    addSecurityTokenTicketToRegistry(request, securityToken);
    final String rpToken = produceRelyingPartyToken(response, request, fedRequest, securityToken, assertion);
    return postResponseBackToRelyingParty(rpToken, fedRequest);
}
 

import org.jasig.cas.client.util.CommonUtils; //导入依赖的package包/类
/**
 * Redirect request for authentication.
 *
 * @param pair     the pair
 * @param request  the request
 * @param response the response
 * @throws Exception the exception
 */
protected void issueAuthenticationRequestRedirect(final Pair<? extends SignableSAMLObject, MessageContext> pair,
                                                  final HttpServletRequest request,
                                                  final HttpServletResponse response) throws Exception {
    final AuthnRequest authnRequest = AuthnRequest.class.cast(pair.getLeft());
    final String serviceUrl = constructServiceUrl(request, response, pair);
    LOGGER.debug("Created service url [{}]", serviceUrl);

    final String initialUrl = CommonUtils.constructRedirectUrl(this.loginUrl,
            CasProtocolConstants.PARAMETER_SERVICE, serviceUrl, authnRequest.isForceAuthn(),
            authnRequest.isPassive());

    final String urlToRedirectTo = buildRedirectUrlByRequestedAuthnContext(initialUrl, authnRequest, request);

    LOGGER.debug("Redirecting SAML authN request to [{}]", urlToRedirectTo);
    final AuthenticationRedirectStrategy authenticationRedirectStrategy = new DefaultAuthenticationRedirectStrategy();
    authenticationRedirectStrategy.redirect(request, response, urlToRedirectTo);

}
 

import org.jasig.cas.client.util.CommonUtils; //导入依赖的package包/类
/**
 * Handle callback profile request.
 *
 * @param response the response
 * @param request  the request
 * @throws Exception the exception
 */
@GetMapping(path = SamlIdPConstants.ENDPOINT_SAML2_SSO_PROFILE_POST_CALLBACK)
protected void handleCallbackProfileRequest(final HttpServletResponse response, final HttpServletRequest request) throws Exception {

    LOGGER.info("Received SAML callback profile request [{}]", request.getRequestURI());
    final AuthnRequest authnRequest = retrieveSamlAuthenticationRequestFromHttpRequest(request);
    if (authnRequest == null) {
        LOGGER.error("Can not validate the request because the original Authn request can not be found.");
        response.setStatus(HttpServletResponse.SC_FORBIDDEN);
        return;
    }

    final String ticket = CommonUtils.safeGetParameter(request, CasProtocolConstants.PARAMETER_TICKET);
    if (StringUtils.isBlank(ticket)) {
        LOGGER.error("Can not validate the request because no [{}] is provided via the request", CasProtocolConstants.PARAMETER_TICKET);
        response.setStatus(HttpServletResponse.SC_FORBIDDEN);
        return;
    }

    final Pair<AuthnRequest, MessageContext> authenticationContext = buildAuthenticationContextPair(request, authnRequest);
    final Assertion assertion = validateRequestAndBuildCasAssertion(response, request, authenticationContext);
    buildSamlResponse(response, request, authenticationContext, assertion, SAMLConstants.SAML2_POST_BINDING_URI);
}
 

import org.jasig.cas.client.util.CommonUtils; //导入依赖的package包/类
private Assertion validateRequestAndBuildCasAssertion(final HttpServletResponse response,
                                                      final HttpServletRequest request,
                                                      final Pair<AuthnRequest, MessageContext> pair) throws Exception {
    final AuthnRequest authnRequest = pair.getKey();
    final String ticket = CommonUtils.safeGetParameter(request, CasProtocolConstants.PARAMETER_TICKET);
    final Cas30ServiceTicketValidator validator = new Cas30ServiceTicketValidator(this.serverPrefix);

    final HttpsURLConnectionFactory factory = new HttpsURLConnectionFactory();
    factory.setHostnameVerifier(this.hostnameVerifier);
    validator.setURLConnectionFactory(factory);
    
    validator.setRenew(authnRequest.isForceAuthn());
    final String serviceUrl = constructServiceUrl(request, response, pair);
    LOGGER.debug("Created service url for validation: [{}]", serviceUrl);
    final Assertion assertion = validator.validate(ticket, serviceUrl);
    logCasValidationAssertion(assertion);
    return assertion;
}
 

import org.jasig.cas.client.util.CommonUtils; //导入依赖的package包/类
@Override
protected void internalInit(final WebContext context) {
    super.internalInit(context);

    CommonHelper.assertNotNull("configuration", configuration);
    configuration.setCallbackUrlResolver(this.getCallbackUrlResolver());
    configuration.init(context);

    setRedirectActionBuilder(ctx -> {
        final String loginUrl = configuration.getCallbackUrlResolver().compute(configuration.getLoginUrl(), ctx);
        final String redirectionUrl = CommonUtils.constructRedirectUrl(loginUrl, CasConfiguration.SERVICE_PARAMETER,
                computeFinalCallbackUrl(ctx), configuration.isRenew(), configuration.isGateway());
        logger.debug("redirectionUrl: {}", redirectionUrl);
        return RedirectAction.redirect(redirectionUrl);
    });
    setCredentialsExtractor(new TicketAndLogoutRequestExtractor(configuration, getName()));
    setAuthenticator(new CasAuthenticator(configuration, callbackUrl));
    addAuthorizationGenerator(new DefaultCasAuthorizationGenerator<>());
}
 

import org.jasig.cas.client.util.CommonUtils; //导入依赖的package包/类
private void computeRedirectionToServerIfNecessary(final WebContext context) throws HttpAction {
    final String relayStateValue = context.getRequestParameter(CasConfiguration.RELAY_STATE_PARAMETER);
    // if we have a state value -> redirect to the CAS server to continue the logout process
    if (CommonUtils.isNotBlank(relayStateValue)) {
        final StringBuilder buffer = new StringBuilder();
        buffer.append(configuration.getPrefixUrl());
        if (!configuration.getPrefixUrl().endsWith("/")) {
            buffer.append("/");
        }
        buffer.append("logout?_eventId=next&");
        buffer.append(CasConfiguration.RELAY_STATE_PARAMETER);
        buffer.append("=");
        buffer.append(CommonUtils.urlEncode(relayStateValue));
        final String redirectUrl = buffer.toString();
        logger.debug("Redirection url to the CAS server: {}", redirectUrl);
        throw HttpAction.redirect("Force redirect to CAS server for front channel logout", context, redirectUrl);
    }
}
 

import org.jasig.cas.client.util.CommonUtils; //导入依赖的package包/类
/**
 * @TODO: We have the opportunity to give back more to Shib than just the PRINCIPAL_NAME_KEY. Identify additional information
 * we can return as well as the best way to know when to do this.
 * @see javax.servlet.http.HttpServlet#doGet(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
 */
@Override
protected void doGet(final HttpServletRequest request, final HttpServletResponse response) throws ServletException,
        IOException {
    String ticket = CommonUtils.safeGetParameter(request, artifactParameterName);
    Object authnType = request.getSession().getAttribute(AUTHN_TYPE);
    Assertion assertion = null;
    try {
        ticketValidator.setRenew(null != authnType && authnType.toString().contains("&renew=true"));
        assertion = ticketValidator.validate(ticket, constructServiceUrl(request, response));
    } catch (final TicketValidationException e) {
        logger.error("Unable to validate login attempt.", e);
        boolean wasPassiveAttempt = null != authnType && authnType.toString().contains("&gateway=true");
        // If it was a passive attempt, send back the indicator that the responding provider cannot authenticate 
        // the principal passively, as has been requested. Otherwise, send the generic authn failed code.
        request.setAttribute(LoginHandler.AUTHENTICATION_ERROR_KEY, wasPassiveAttempt ? StatusCode.NO_PASSIVE_URI
                : StatusCode.AUTHN_FAILED_URI);
        AuthenticationEngine.returnToAuthenticationEngine(request, response);
        return;
    }
    for (CasToShibTranslator casToShibTranslator : translators) {
        casToShibTranslator.doTranslation(request, response, assertion);
    }
    AuthenticationEngine.returnToAuthenticationEngine(request, response);
}
 

import org.jasig.cas.client.util.CommonUtils; //导入依赖的package包/类
@Override
protected void doGet(HttpServletRequest request, HttpServletResponse response)
        throws ServletException, IOException {
    // NOTE: The CasAuthenticationToken can also be obtained using SecurityContextHolder.getContext().getAuthentication()
    final CasAuthenticationToken token = (CasAuthenticationToken) request.getUserPrincipal();
    // proxyTicket could be reused to make calls to to the CAS service even if the target url differs
    final String proxyTicket = token.getAssertion().getPrincipal().getProxyTicketFor(targetUrl);

    // Make a remote call to ourself. This is a bit silly, but it works well to demonstrate how to use proxy tickets.
    final String serviceUrl = targetUrl+"?ticket="+URLEncoder.encode(proxyTicket, "UTF-8");
    String proxyResponse = CommonUtils.getResponseFromServer(serviceUrl, "UTF-8");

    // modify the response and write it out to inform the user that it was obtained using a proxy ticket.
    proxyResponse = proxyResponse.replaceFirst("Secure Page", "Secure Page using a Proxy Ticket");
    proxyResponse = proxyResponse.replaceFirst("<p>",
            "<p>This page is rendered by "+getClass().getSimpleName()+" by making a remote call to the Secure Page using a proxy ticket ("+proxyTicket+") and inserts this message. ");
    final PrintWriter writer = response.getWriter();
    writer.write(proxyResponse);
}
 

import org.jasig.cas.client.util.CommonUtils; //导入依赖的package包/类
/**
 * Construct service url string.
 *
 * @param request  the request
 * @param response the response
 * @param pair     the pair
 * @return the string
 * @throws SamlException the saml exception
 */
protected String constructServiceUrl(final HttpServletRequest request,
                                     final HttpServletResponse response,
                                     final Pair<? extends SignableSAMLObject, MessageContext> pair) throws SamlException {
    final AuthnRequest authnRequest = AuthnRequest.class.cast(pair.getLeft());
    final MessageContext messageContext = pair.getRight();

    try (StringWriter writer = SamlUtils.transformSamlObject(this.configBean, authnRequest)) {
        final URLBuilder builder = new URLBuilder(this.callbackService.getId());
        builder.getQueryParams().add(
                new net.shibboleth.utilities.java.support.collection.Pair<>(SamlProtocolConstants.PARAMETER_ENTITY_ID,
                        SamlIdPUtils.getIssuerFromSamlRequest(authnRequest)));

        final String samlRequest = EncodingUtils.encodeBase64(writer.toString().getBytes(StandardCharsets.UTF_8));
        builder.getQueryParams().add(
                new net.shibboleth.utilities.java.support.collection.Pair<>(SamlProtocolConstants.PARAMETER_SAML_REQUEST,
                        samlRequest));
        builder.getQueryParams().add(
                new net.shibboleth.utilities.java.support.collection.Pair<>(SamlProtocolConstants.PARAMETER_SAML_RELAY_STATE,
                        SAMLBindingSupport.getRelayState(messageContext)));
        final String url = builder.buildURL();

        LOGGER.debug("Built service callback url [{}]", url);
        return CommonUtils.constructServiceUrl(request, response,
                url, this.serverName,
                CasProtocolConstants.PARAMETER_SERVICE,
                CasProtocolConstants.PARAMETER_TICKET, false);
    } catch (final Exception e) {
        throw new SamlException(e.getMessage(), e);
    }
}
 

import org.jasig.cas.client.util.CommonUtils; //导入依赖的package包/类
private Assertion validateRequestAndBuildCasAssertion(final HttpServletResponse response,
                                                      final HttpServletRequest request,
                                                      final WSFederationRequest fedRequest) throws Exception {
    final String ticket = CommonUtils.safeGetParameter(request, CasProtocolConstants.PARAMETER_TICKET);
    final Cas30ServiceTicketValidator validator = new Cas30ServiceTicketValidator(casProperties.getServer().getPrefix());
    final String serviceUrl = constructServiceUrl(request, response, fedRequest);
    LOGGER.debug("Created service url for validation: [{}]", serviceUrl);
    final Assertion assertion = validator.validate(ticket, serviceUrl);
    LOGGER.debug("Located CAS assertion [{}]", assertion);
    return assertion;
}
 

import org.jasig.cas.client.util.CommonUtils; //导入依赖的package包/类
private void redirectToIdentityProvider(final WSFederationRequest fedRequest, final HttpServletResponse response,
                                        final HttpServletRequest request, final WSFederationRegisteredService service) {
    try {
        final String serviceUrl = constructServiceUrl(request, response, fedRequest);
        LOGGER.debug("Created service url [{}] mapped to [{}]", serviceUrl, service);
        final boolean renew = shouldRenewAuthentication(fedRequest, request);
        final String initialUrl = CommonUtils.constructRedirectUrl(casProperties.getServer().getLoginUrl(),
                CasProtocolConstants.PARAMETER_SERVICE, serviceUrl, renew, false);
        LOGGER.debug("Redirecting authN request to [{}]", initialUrl);
        final AuthenticationRedirectStrategy authenticationRedirectStrategy = new DefaultAuthenticationRedirectStrategy();
        authenticationRedirectStrategy.redirect(request, response, initialUrl);
    } catch (final Exception e) {
        throw Throwables.propagate(e);
    }
}
 

import org.jasig.cas.client.util.CommonUtils; //导入依赖的package包/类
@Override
public RedirectAction build(final CasClient casClient, final WebContext context) {
    try {
        final CasConfiguration casConfiguration = casClient.getConfiguration();
        final String redirectionUrl = CommonUtils.constructRedirectUrl(casConfiguration.getLoginUrl(),
                CasProtocolConstants.PARAMETER_SERVICE,
                casClient.computeFinalCallbackUrl(context),
                casConfiguration.isRenew(), casConfiguration.isGateway());
        LOGGER.debug("Final redirect url is [{}]", redirectionUrl);
        return RedirectAction.redirect(redirectionUrl);
    } catch (final Exception e) {
        throw new IllegalArgumentException(e);
    }
}
 

import org.jasig.cas.client.util.CommonUtils; //导入依赖的package包/类
@Override
protected TokenCredentials retrieveCredentials(final WebContext context) throws HttpAction {
    init(context);
    try {
        String currentUrl = context.getFullRequestURL();
        String loginUrl = configuration.getLoginUrl();
        final CallbackUrlResolver callbackUrlResolver = configuration.getCallbackUrlResolver();
        if (callbackUrlResolver != null) {
            currentUrl = callbackUrlResolver.compute(currentUrl, context);
            loginUrl = callbackUrlResolver.compute(loginUrl, context);
        }

        final TokenCredentials credentials = getCredentialsExtractor().extract(context);
        if (credentials == null) {
            // redirect to the login page
            final String redirectionUrl = CommonUtils.constructRedirectUrl(loginUrl, CasConfiguration.SERVICE_PARAMETER,
                    currentUrl, configuration.isRenew(), false);
            logger.debug("redirectionUrl: {}", redirectionUrl);
            throw HttpAction.redirect("no ticket -> force redirect to login page", context, redirectionUrl);
        }

        // clean url from ticket parameter
        currentUrl = CommonHelper.substringBefore(currentUrl, "?" + CasConfiguration.TICKET_PARAMETER + "=");
        currentUrl = CommonHelper.substringBefore(currentUrl, "&" + CasConfiguration.TICKET_PARAMETER + "=");
        final CasAuthenticator casAuthenticator = new CasAuthenticator(configuration, currentUrl);
        casAuthenticator.init(context);
        casAuthenticator.validate(credentials, context);

        return credentials;
    } catch (CredentialsException e) {
        logger.error("Failed to retrieve or validate CAS credentials", e);
        return null;
    }
}
 

import org.jasig.cas.client.util.CommonUtils; //导入依赖的package包/类
public void onAuthentication(Authentication authentication, HttpServletRequest request,
                             HttpServletResponse response) {
    super.onAuthentication(authentication, request, response);

    HttpSession newSession = request.getSession();
    String token = CommonUtils.safeGetParameter(request, this.artifactParameterName, this.safeParameters);
    logger.debug("Recording the new session after the previous one was destroyed to prevent session fixation " +
            "(token " + token + ").");
    if ((token != null) && (!token.trim().isEmpty())) {
        this.sessionMappingStorage.addSessionById(token, newSession);
    }
}
 

import org.jasig.cas.client.util.CommonUtils; //导入依赖的package包/类
/**
 * Use the CAS CommonUtils to build the CAS Service URL.
 */
protected String constructServiceUrl(final HttpServletRequest request, final HttpServletResponse response) {
    String serviceUrl = CommonUtils.constructServiceUrl(request, response, null, serverName, serviceParameterName, artifactParameterName, true);

    if ("embed".equalsIgnoreCase(entityIdLocation)) {
        serviceUrl += (new EntityIdParameterBuilder().getParameterString(request, false));
    }

    return serviceUrl;
}
 

import org.jasig.cas.client.util.CommonUtils; //导入依赖的package包/类
private void shibbolethSessionInitiate(HttpServletRequest request,	HttpServletResponse response) throws IOException {
	String serverURL = urlGenerator.getServerURL();

	// re-use code from CAS to reconstruct current URL
	// (nb: not using encode=true since it adds jsessionid in url which mess up things. we do not need it since we will have _shibsession_)
	String target = CommonUtils.constructServiceUrl(request, response, null, serverURL, "_shibsession_", false);
	
	String url = shibbolethSessionInitiatorUrl + "?target=" + UrlGenerator.urlencode(target);

	String idpId = request.getParameter("idpId");
	if (idpId != null) url += "&providerId=" + idpId;

	response.sendRedirect(concatUrlAndLocation(serverURL, url));
}
 

import org.jasig.cas.client.util.CommonUtils; //导入依赖的package包/类
protected String getRedirectUrl(final String urlEncodedService, final HttpServletRequest request) {
	ServiceProperties sp = wrappedCasAuthEntryPoint.getServiceProperties();
	String url = CommonUtils.constructRedirectUrl(wrappedCasAuthEntryPoint.getLoginUrl(), sp.getServiceParameter(),
			urlEncodedService, sp.isSendRenew(), false);

	if (request.getRequestURI().endsWith("/logoutcas")) {
		url = url + "&so=yes";
	}

	String account = parseAccount(getSavedRequestRedirectUrl(request));
	if (StringUtils.isEmpty(account)) {
		return url;
	}
	return url + "&account=" + account;
}
 

import org.jasig.cas.client.util.CommonUtils; //导入依赖的package包/类
@RequestMapping("/logout")
public void logout(HttpServletRequest request,HttpServletResponse response) throws IOException{
	 HttpSession session = request.getSession(false);
        if (session != null) {
            session.invalidate();
        }
	String loginUrl = (String)RainbowProperties.getProperties(CAS_LOGOUT);
	String serviceUrl = (String)RainbowProperties.getProperties(CLIENT_SERVICE) + "/login";
	if(serviceUrl == null || serviceUrl.length() == 0){
		serviceUrl = "http://" + request.getServerName() + ":" + request.getServerPort() + request.getContextPath() + "/login";
	}
	ServiceProperties sp = (ServiceProperties)SpringApplicationContext.getBean("serviceProperties");
	String redirectUrl = CommonUtils.constructRedirectUrl(loginUrl, sp.getServiceParameter(), serviceUrl, false, false);
	response.sendRedirect(redirectUrl);
}
 

import org.jasig.cas.client.util.CommonUtils; //导入依赖的package包/类
@Override
protected String createServiceUrl(HttpServletRequest request, HttpServletResponse response) {
    String serviceUrl = buildUrl(request, loginPath).orElse(loginPath);
    return CommonUtils.constructServiceUrl(null, response, serviceUrl, null,
            getServiceProperties().getServiceParameter(), getServiceProperties().getArtifactParameter(), true);
}
 

import org.jasig.cas.client.util.CommonUtils; //导入依赖的package包/类
/**
 * Uses the CAS CommonUtils to build the CAS Redirect URL.
 */
private String constructRedirectUrl(String serviceUrl, boolean renew, boolean gateway) {
    return CommonUtils.constructRedirectUrl(casLoginUrl, "service", serviceUrl, renew, gateway);
}