KEYCLOAK-2377

adapters/saml/tomcat/tomcat-core/src/main/java/org/keycloak/adapters/saml/AbstractSamlAuthenticatorValve.java

@@ -61,7 +61,7 @@ public abstract class AbstractSamlAuthenticatorValve extends FormAuthenticator i
     protected void logoutInternal(Request request) {
         CatalinaHttpFacade facade = new CatalinaHttpFacade(null, request);
         SamlDeployment deployment = deploymentContext.resolveDeployment(facade);
-        SamlSessionStore tokenStore = getTokenStore(request, facade, deployment);
+        SamlSessionStore tokenStore = getSessionStore(request, facade, deployment);
         tokenStore.logoutAccount();
         request.setUserPrincipal(null);
     }
@@ -184,7 +184,7 @@ public abstract class AbstractSamlAuthenticatorValve extends FormAuthenticator i
             log.fine("deployment not configured");
             return false;
         }
-        SamlSessionStore tokenStore = getTokenStore(request, facade, deployment);
+        SamlSessionStore tokenStore = getSessionStore(request, facade, deployment);
 
 
         CatalinaSamlAuthenticator authenticator = new CatalinaSamlAuthenticator(facade, deployment, tokenStore);
@@ -229,16 +229,22 @@ public abstract class AbstractSamlAuthenticatorValve extends FormAuthenticator i
         }
     }
 
-    protected SamlSessionStore getTokenStore(Request request, HttpFacade facade, SamlDeployment resolvedDeployment) {
+    protected SamlSessionStore getSessionStore(Request request, HttpFacade facade, SamlDeployment resolvedDeployment) {
         SamlSessionStore store = (SamlSessionStore)request.getNote(TOKEN_STORE_NOTE);
         if (store != null) {
             return store;
         }
 
-        store = new CatalinaSamlSessionStore(userSessionManagement, createPrincipalFactory(), mapper, request, this, facade);
+        store = createSessionStore(request, facade, resolvedDeployment);
 
         request.setNote(TOKEN_STORE_NOTE, store);
         return store;
     }
 
+    protected SamlSessionStore createSessionStore(Request request, HttpFacade facade, SamlDeployment resolvedDeployment) {
+        SamlSessionStore store;
+        store = new CatalinaSamlSessionStore(userSessionManagement, createPrincipalFactory(), mapper, request, this, facade, resolvedDeployment);
+        return store;
+    }
+
 }

adapters/saml/tomcat/tomcat-core/src/main/java/org/keycloak/adapters/saml/CatalinaSamlSessionStore.java

@@ -32,15 +32,18 @@ public class CatalinaSamlSessionStore implements SamlSessionStore {
     protected final Request request;
     protected final AbstractSamlAuthenticatorValve valve;
     protected final HttpFacade facade;
+    protected final SamlDeployment deployment;
 
     public CatalinaSamlSessionStore(CatalinaUserSessionManagement sessionManagement, GenericPrincipalFactory principalFactory,
-                                    SessionIdMapper idMapper, Request request, AbstractSamlAuthenticatorValve valve, HttpFacade facade) {
+                                    SessionIdMapper idMapper, Request request, AbstractSamlAuthenticatorValve valve, HttpFacade facade,
+                                    SamlDeployment deployment) {
         this.sessionManagement = sessionManagement;
         this.principalFactory = principalFactory;
         this.idMapper = idMapper;
         this.request = request;
         this.valve = valve;
         this.facade = facade;
+        this.deployment = deployment;
     }
 
     @Override
@@ -173,10 +176,15 @@ public class CatalinaSamlSessionStore implements SamlSessionStore {
         }
         request.setUserPrincipal(principal);
         request.setAuthType("KEYCLOAK-SAML");
-        idMapper.map(account.getSessionIndex(), account.getPrincipal().getSamlSubject(), session.getId());
+        String newId = changeSessionId(session);
+        idMapper.map(account.getSessionIndex(), account.getPrincipal().getSamlSubject(), newId);
 
     }
 
+    protected String changeSessionId(Session session) {
+        return session.getId();
+    }
+
     @Override
     public SamlSession getAccount() {
         HttpSession session = getSession(true);

adapters/saml/tomcat/tomcat8/src/main/java/org/keycloak/adapters/saml/tomcat/SamlAuthenticatorValve.java

@@ -6,6 +6,10 @@ import org.apache.catalina.core.StandardContext;
 import org.apache.catalina.realm.GenericPrincipal;
 import org.apache.tomcat.util.descriptor.web.LoginConfig;
 import org.keycloak.adapters.saml.AbstractSamlAuthenticatorValve;
+import org.keycloak.adapters.saml.CatalinaSamlSessionStore;
+import org.keycloak.adapters.saml.SamlDeployment;
+import org.keycloak.adapters.saml.SamlSessionStore;
+import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.adapters.tomcat.GenericPrincipalFactory;
 
 import javax.servlet.http.HttpServletResponse;
@@ -68,4 +72,12 @@ public class SamlAuthenticatorValve extends AbstractSamlAuthenticatorValve {
             }
         };
     }
+
+    @Override
+    protected SamlSessionStore createSessionStore(Request request, HttpFacade facade, SamlDeployment resolvedDeployment) {
+        SamlSessionStore store;
+        store = new Tomcat8SamlSessionStore(userSessionManagement, createPrincipalFactory(), mapper, request, this, facade, resolvedDeployment);
+        return store;
+    }
+
 }

adapters/saml/tomcat/tomcat8/src/main/java/org/keycloak/adapters/saml/tomcat/Tomcat8SamlSessionStore.java

@@ -0,0 +1,28 @@
+package org.keycloak.adapters.saml.tomcat;
+
+import org.apache.catalina.Session;
+import org.apache.catalina.connector.Request;
+import org.keycloak.adapters.saml.AbstractSamlAuthenticatorValve;
+import org.keycloak.adapters.saml.CatalinaSamlSessionStore;
+import org.keycloak.adapters.saml.SamlDeployment;
+import org.keycloak.adapters.spi.HttpFacade;
+import org.keycloak.adapters.spi.SessionIdMapper;
+import org.keycloak.adapters.tomcat.CatalinaUserSessionManagement;
+import org.keycloak.adapters.tomcat.GenericPrincipalFactory;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class Tomcat8SamlSessionStore extends CatalinaSamlSessionStore {
+    public Tomcat8SamlSessionStore(CatalinaUserSessionManagement sessionManagement, GenericPrincipalFactory principalFactory, SessionIdMapper idMapper, Request request, AbstractSamlAuthenticatorValve valve, HttpFacade facade, SamlDeployment deployment) {
+        super(sessionManagement, principalFactory, idMapper, request, valve, facade, deployment);
+    }
+
+    @Override
+    protected String changeSessionId(Session session) {
+        Request request = this.request;
+        if (deployment.turnOffChangeSessionIdOnLogin() == false) return request.changeSessionId();
+        else return session.getId();
+    }
+}