From 545651449930deda999d4e11d8dc90eff3b40271 Mon Sep 17 00:00:00 2001 From: Pedro Igor Date: Wed, 19 Jul 2017 16:38:06 -0300 Subject: [PATCH] [KEYCLOAK-5015] - Pushing keycloak context to exchange scope --- .../adapters/elytron/ElytronHttpFacade.java | 5 +++++ ...KeycloakHttpServerAuthenticationMechanism.java | 2 +- .../adapters/saml/elytron/ElytronHttpFacade.java | 15 ++++++++------- ...KeycloakHttpServerAuthenticationMechanism.java | 2 +- 4 files changed, 15 insertions(+), 9 deletions(-) diff --git a/adapters/oidc/wildfly-elytron/src/main/java/org/keycloak/adapters/elytron/ElytronHttpFacade.java b/adapters/oidc/wildfly-elytron/src/main/java/org/keycloak/adapters/elytron/ElytronHttpFacade.java index bc2e9039ca..4472af75f9 100644 --- a/adapters/oidc/wildfly-elytron/src/main/java/org/keycloak/adapters/elytron/ElytronHttpFacade.java +++ b/adapters/oidc/wildfly-elytron/src/main/java/org/keycloak/adapters/elytron/ElytronHttpFacade.java @@ -90,6 +90,11 @@ class ElytronHttpFacade implements OIDCHttpFacade { void authenticationComplete() { if (securityIdentity != null) { + HttpScope requestScope = request.getScope(Scope.EXCHANGE); + RefreshableKeycloakSecurityContext keycloakSecurityContext = account.getKeycloakSecurityContext(); + + requestScope.setAttachment(KeycloakSecurityContext.class.getName(), keycloakSecurityContext); + this.request.authenticationComplete(response -> { if (!restored) { responseConsumer.accept(response); diff --git a/adapters/oidc/wildfly-elytron/src/main/java/org/keycloak/adapters/elytron/KeycloakHttpServerAuthenticationMechanism.java b/adapters/oidc/wildfly-elytron/src/main/java/org/keycloak/adapters/elytron/KeycloakHttpServerAuthenticationMechanism.java index 3fcf9bf484..8d0cd1d538 100644 --- a/adapters/oidc/wildfly-elytron/src/main/java/org/keycloak/adapters/elytron/KeycloakHttpServerAuthenticationMechanism.java +++ b/adapters/oidc/wildfly-elytron/src/main/java/org/keycloak/adapters/elytron/KeycloakHttpServerAuthenticationMechanism.java @@ -71,7 +71,7 @@ class KeycloakHttpServerAuthenticationMechanism implements HttpServerAuthenticat AdapterDeploymentContext deploymentContext = getDeploymentContext(request); if (deploymentContext == null) { - LOGGER.debugf("Ignoring request for path [%s] from mechanism [%s]. No deployment context found.", request.getRequestURI()); + LOGGER.debugf("Ignoring request for path [%s] from mechanism [%s]. No deployment context found.", request.getRequestURI(), getMechanismName()); request.noAuthenticationInProgress(); return; } diff --git a/adapters/saml/wildfly-elytron/src/main/java/org/keycloak/adapters/saml/elytron/ElytronHttpFacade.java b/adapters/saml/wildfly-elytron/src/main/java/org/keycloak/adapters/saml/elytron/ElytronHttpFacade.java index 88e96f8bd3..68c6922fae 100644 --- a/adapters/saml/wildfly-elytron/src/main/java/org/keycloak/adapters/saml/elytron/ElytronHttpFacade.java +++ b/adapters/saml/wildfly-elytron/src/main/java/org/keycloak/adapters/saml/elytron/ElytronHttpFacade.java @@ -47,10 +47,8 @@ import org.wildfly.security.auth.callback.AnonymousAuthorizationCallback; import org.wildfly.security.auth.callback.AuthenticationCompleteCallback; import org.wildfly.security.auth.callback.SecurityIdentityCallback; import org.wildfly.security.auth.server.SecurityIdentity; -import org.wildfly.security.http.HttpAuthenticationException; import org.wildfly.security.http.HttpScope; import org.wildfly.security.http.HttpServerCookie; -import org.wildfly.security.http.HttpServerMechanismsResponder; import org.wildfly.security.http.HttpServerRequest; import org.wildfly.security.http.HttpServerResponse; import org.wildfly.security.http.Scope; @@ -87,11 +85,14 @@ class ElytronHttpFacade implements HttpFacade { void authenticationComplete() { this.securityIdentity = SecurityIdentityUtil.authorize(this.callbackHandler, samlSession.getPrincipal()); - this.request.authenticationComplete(response -> { - if (!restored) { - responseConsumer.accept(response); - } - }, () -> ((ElytronTokeStore) sessionStore).logout(true)); + + if (this.securityIdentity != null) { + this.request.authenticationComplete(response -> { + if (!restored) { + responseConsumer.accept(response); + } + }, () -> ((ElytronTokeStore) sessionStore).logout(true)); + } } void authenticationCompleteAnonymous() { diff --git a/adapters/saml/wildfly-elytron/src/main/java/org/keycloak/adapters/saml/elytron/KeycloakHttpServerAuthenticationMechanism.java b/adapters/saml/wildfly-elytron/src/main/java/org/keycloak/adapters/saml/elytron/KeycloakHttpServerAuthenticationMechanism.java index 9fce501d93..1f71bae329 100644 --- a/adapters/saml/wildfly-elytron/src/main/java/org/keycloak/adapters/saml/elytron/KeycloakHttpServerAuthenticationMechanism.java +++ b/adapters/saml/wildfly-elytron/src/main/java/org/keycloak/adapters/saml/elytron/KeycloakHttpServerAuthenticationMechanism.java @@ -65,7 +65,7 @@ class KeycloakHttpServerAuthenticationMechanism implements HttpServerAuthenticat SamlDeploymentContext deploymentContext = getDeploymentContext(request); if (deploymentContext == null) { - LOGGER.debugf("Ignoring request for path [%s] from mechanism [%s]. No deployment context found.", request.getRequestURI()); + LOGGER.debugf("Ignoring request for path [%s] from mechanism [%s]. No deployment context found.", request.getRequestURI(), getMechanismName()); request.noAuthenticationInProgress(); return; }