From 74fab9734cb76cf3de872428ebf3966012e0f9d3 Mon Sep 17 00:00:00 2001 From: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> Date: Fri, 31 Jul 2026 09:31:25 +0800 Subject: [PATCH 1/2] feat(auth): add CAS 2.0 and 3.0 login adapter Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> --- .env.release.example | 22 + README.md | 1 + README_zh.md | 1 + charts/skillhub/README.md | 28 + charts/skillhub/templates/configmap.yaml | 16 + .../skillhub/templates/server-deployment.yaml | 80 +++ charts/skillhub/templates/validate.yaml | 18 + .../skillhub/tests/configuration-contracts.sh | 21 + charts/skillhub/values.schema.json | 32 +- charts/skillhub/values.yaml | 18 + compose.release.yml | 17 + deploy/k8s/README.md | 10 + deploy/k8s/base/backend-deployment.yaml | 82 +++ deploy/k8s/base/configmap.yaml | 20 + docs/21-unified-identity-federation-design.md | 24 +- docs/23-cas-integration.md | 170 +++++ scripts/validate-release-config.sh | 38 + .../controller/CasLoginController.java | 111 +++ .../skillhub/service/AuthMethodCatalog.java | 23 +- .../skillhub/service/CasLoginAppService.java | 226 ++++++ .../skillhub/service/CasLoginFailure.java | 15 + .../service/CasLoginFlowException.java | 21 + .../skillhub/service/CasLoginStateStore.java | 171 +++++ .../src/main/resources/application.yml | 19 + .../controller/CasLoginControllerTest.java | 71 ++ .../service/AuthMethodCatalogTest.java | 34 + .../service/CasLoginAppServiceTest.java | 298 ++++++++ .../service/CasLoginStateStoreTest.java | 151 ++++ .../auth/cas/CasAuthenticationAdapter.java | 169 +++++ .../auth/cas/CasAuthenticationExchange.java | 40 ++ .../skillhub/auth/cas/CasBrowserClient.java | 16 + .../skillhub/auth/cas/CasLoginInitiation.java | 21 + .../skillhub/auth/cas/CasProperties.java | 183 +++++ .../skillhub/auth/cas/CasProtocolClient.java | 676 ++++++++++++++++++ .../skillhub/auth/cas/CasProtocolVersion.java | 43 ++ .../auth/cas/CasProviderConfiguration.java | 242 +++++++ .../skillhub/auth/cas/package-info.java | 4 + .../identity/IdentityProviderLoginMethod.java | 3 +- .../IdentityProviderLoginMethodType.java | 1 + .../identity/IdentityProviderRegistry.java | 29 + .../ReconciledIdentityProviderCatalog.java | 115 ++- .../auth/oauth/OAuthClaimsExtractor.java | 9 +- .../policy/RouteSecurityPolicyRegistry.java | 1 + .../BrowserAuthenticationAdapter.java | 6 + .../provider/BrowserAuthenticationMethod.java | 10 + .../cas/CasAuthenticationAdapterTest.java | 143 ++++ .../CasProtocolClientHttpIntegrationTest.java | 190 +++++ .../auth/cas/CasProtocolClientTest.java | 350 +++++++++ .../cas/CasProviderConfigurationTest.java | 128 ++++ .../auth/cas/CasTestConfiguration.java | 31 + ...ReconciledIdentityProviderCatalogTest.java | 77 ++ .../RouteSecurityPolicyRegistryTest.java | 13 + .../auth/provider/ProviderConformanceKit.java | 4 +- .../provider/ProviderConformanceKitTest.java | 24 +- web/src/api/types.ts | 2 +- web/src/features/auth/login-button.test.ts | 42 +- web/src/features/auth/login-button.tsx | 31 +- web/src/features/auth/login-failure.test.ts | 19 + web/src/features/auth/login-failure.ts | 13 + web/src/i18n/locales/en.json | 12 +- web/src/i18n/locales/zh.json | 12 +- web/src/pages/login.tsx | 8 +- 62 files changed, 4356 insertions(+), 49 deletions(-) create mode 100644 docs/23-cas-integration.md create mode 100644 server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/CasLoginController.java create mode 100644 server/skillhub-app/src/main/java/com/iflytek/skillhub/service/CasLoginAppService.java create mode 100644 server/skillhub-app/src/main/java/com/iflytek/skillhub/service/CasLoginFailure.java create mode 100644 server/skillhub-app/src/main/java/com/iflytek/skillhub/service/CasLoginFlowException.java create mode 100644 server/skillhub-app/src/main/java/com/iflytek/skillhub/service/CasLoginStateStore.java create mode 100644 server/skillhub-app/src/test/java/com/iflytek/skillhub/controller/CasLoginControllerTest.java create mode 100644 server/skillhub-app/src/test/java/com/iflytek/skillhub/service/CasLoginAppServiceTest.java create mode 100644 server/skillhub-app/src/test/java/com/iflytek/skillhub/service/CasLoginStateStoreTest.java create mode 100644 server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasAuthenticationAdapter.java create mode 100644 server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasAuthenticationExchange.java create mode 100644 server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasBrowserClient.java create mode 100644 server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasLoginInitiation.java create mode 100644 server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasProperties.java create mode 100644 server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasProtocolClient.java create mode 100644 server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasProtocolVersion.java create mode 100644 server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasProviderConfiguration.java create mode 100644 server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/package-info.java create mode 100644 server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/provider/BrowserAuthenticationMethod.java create mode 100644 server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/cas/CasAuthenticationAdapterTest.java create mode 100644 server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/cas/CasProtocolClientHttpIntegrationTest.java create mode 100644 server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/cas/CasProtocolClientTest.java create mode 100644 server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/cas/CasProviderConfigurationTest.java create mode 100644 server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/cas/CasTestConfiguration.java create mode 100644 web/src/features/auth/login-failure.test.ts create mode 100644 web/src/features/auth/login-failure.ts diff --git a/.env.release.example b/.env.release.example index 59387e0f..45df33ec 100644 --- a/.env.release.example +++ b/.env.release.example @@ -104,6 +104,28 @@ SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_SCOPE=openid,profile,email SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_CLIENT_NAME=OIDC SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_OIDC_ISSUER_URI= +# Optional: CAS 2.0/3.0 browser login. The provider remains hidden until +# enabled and every required field is valid. Keep provider code and authority +# stable after users have created identity bindings. +SKILLHUB_AUTH_CAS_ENABLED=false +SKILLHUB_AUTH_CAS_PROVIDER_CODE=cas-main +SKILLHUB_AUTH_CAS_DISPLAY_NAME=Corporate CAS +SKILLHUB_AUTH_CAS_AUTHORITY=corp-cas +SKILLHUB_AUTH_CAS_SERVER_URL=https://cas.example.com/cas +SKILLHUB_AUTH_CAS_SERVICE_URL=https://skillhub.example.com/api/v1/auth/cas/cas-main/callback +SKILLHUB_AUTH_CAS_PROTOCOL_VERSION=3.0 +SKILLHUB_AUTH_CAS_SUBJECT_TYPE=cas_principal +SKILLHUB_AUTH_CAS_ALLOW_INSECURE_FOR_TESTING=false +SKILLHUB_AUTH_CAS_CONNECT_TIMEOUT=PT5S +SKILLHUB_AUTH_CAS_READ_TIMEOUT=PT10S +SKILLHUB_AUTH_CAS_STATE_TTL=PT5M +SKILLHUB_AUTH_CAS_MAX_RESPONSE_BYTES=1048576 +# Optional CAS attribute mappings. If subject is blank, the CAS principal is used. +SKILLHUB_AUTH_CAS_ATTRIBUTES_SUBJECT= +SKILLHUB_AUTH_CAS_ATTRIBUTES_DISPLAY_NAME=displayName +SKILLHUB_AUTH_CAS_ATTRIBUTES_EMAIL=mail +SKILLHUB_AUTH_CAS_ATTRIBUTES_AVATAR_URL= + # Direct (username/password) authentication for environments without OAuth2. # To enable, set BOTH: # - SKILLHUB_AUTH_DIRECT_ENABLED=true (server: enables the /api/v1/auth/direct endpoint) diff --git a/README.md b/README.md index 23b959c0..cd410882 100644 --- a/README.md +++ b/README.md @@ -50,6 +50,7 @@ firewall, with the same polish you'd expect from a public registry. - 📖 **[User Guide](https://iflytek.github.io/skillhub/)** — Skill publishing, search, CLI usage and other user guides - 🛠️ **[Developer Docs](https://zread.ai/iflytek/skillhub)** — Architecture, API reference, local development, deployment and operations +- 🔐 **[CAS 2.0/3.0 Integration](./docs/23-cas-integration.md)** — Provider configuration, identity mapping, deployment and verification ## Highlights diff --git a/README_zh.md b/README_zh.md index 20217483..d545de76 100644 --- a/README_zh.md +++ b/README_zh.md @@ -39,6 +39,7 @@ SkillHub 是一个自托管平台，为团队提供私有的、受治理的智 - 📖 **[用户指南](https://iflytek.github.io/skillhub/)** — 技能发布、搜索、CLI 使用等用户操作指南 - 🛠️ **[开发者文档](https://zread.ai/iflytek/skillhub)** — 架构设计、API 参考、本地开发、部署运维等技术文档 +- 🔐 **[CAS 2.0/3.0 接入](./docs/23-cas-integration.md)** — Provider 配置、身份映射、部署与验证 ## 核心特性 diff --git a/charts/skillhub/README.md b/charts/skillhub/README.md index 4d071b88..9c736f0c 100644 --- a/charts/skillhub/README.md +++ b/charts/skillhub/README.md @@ -157,6 +157,34 @@ redis: ## 配置参考 +### CAS 2.0/3.0 + +```yaml +auth: + cas: + enabled: true + providerCode: cas-main + displayName: Corporate CAS + authority: corp-cas + serverUrl: https://cas.example.com/cas + serviceUrl: https://skills.example.com/api/v1/auth/cas/cas-main/callback + protocolVersion: "3.0" + subjectType: cas_principal + connectTimeout: PT5S + readTimeout: PT10S + stateTtl: PT5M + maxResponseBytes: 1048576 + attributes: + subject: "" + displayName: displayName + email: mail + avatarUrl: "" +``` + +`serviceUrl` 必须使用 HTTPS，并以当前 `providerCode` 对应的精确 callback 结尾。 +普通 CAS email attribute 只按 asserted 处理。完整说明见 +[`docs/23-cas-integration.md`](../../docs/23-cas-integration.md)。 + ### 副本数配置 | 参数 | 描述 | 默认值 | diff --git a/charts/skillhub/templates/configmap.yaml b/charts/skillhub/templates/configmap.yaml index 78e9e016..258c8dd5 100644 --- a/charts/skillhub/templates/configmap.yaml +++ b/charts/skillhub/templates/configmap.yaml @@ -54,4 +54,20 @@ data: device-auth-verification-uri: {{ $deviceAuthVerificationUri | quote }} auth-direct-enabled: {{ .Values.auth.direct.enabled | quote }} auth-direct-provider: {{ .Values.auth.direct.provider | quote }} + auth-cas-enabled: {{ .Values.auth.cas.enabled | quote }} + auth-cas-provider-code: {{ .Values.auth.cas.providerCode | quote }} + auth-cas-display-name: {{ .Values.auth.cas.displayName | quote }} + auth-cas-authority: {{ .Values.auth.cas.authority | quote }} + auth-cas-server-url: {{ .Values.auth.cas.serverUrl | quote }} + auth-cas-service-url: {{ .Values.auth.cas.serviceUrl | quote }} + auth-cas-protocol-version: {{ .Values.auth.cas.protocolVersion | quote }} + auth-cas-subject-type: {{ .Values.auth.cas.subjectType | quote }} + auth-cas-connect-timeout: {{ .Values.auth.cas.connectTimeout | quote }} + auth-cas-read-timeout: {{ .Values.auth.cas.readTimeout | quote }} + auth-cas-state-ttl: {{ .Values.auth.cas.stateTtl | quote }} + auth-cas-max-response-bytes: {{ .Values.auth.cas.maxResponseBytes | quote }} + auth-cas-attribute-subject: {{ .Values.auth.cas.attributes.subject | quote }} + auth-cas-attribute-display-name: {{ .Values.auth.cas.attributes.displayName | quote }} + auth-cas-attribute-email: {{ .Values.auth.cas.attributes.email | quote }} + auth-cas-attribute-avatar-url: {{ .Values.auth.cas.attributes.avatarUrl | quote }} builtin-skills-enabled: {{ .Values.builtinSkills.enabled | quote }} diff --git a/charts/skillhub/templates/server-deployment.yaml b/charts/skillhub/templates/server-deployment.yaml index 149cb203..b589f9ab 100644 --- a/charts/skillhub/templates/server-deployment.yaml +++ b/charts/skillhub/templates/server-deployment.yaml @@ -295,6 +295,86 @@ spec: configMapKeyRef: name: {{ include "skillhub.fullname" . }}-config key: auth-direct-enabled + - name: SKILLHUB_AUTH_CAS_ENABLED + valueFrom: + configMapKeyRef: + name: {{ include "skillhub.fullname" . }}-config + key: auth-cas-enabled + - name: SKILLHUB_AUTH_CAS_PROVIDER_CODE + valueFrom: + configMapKeyRef: + name: {{ include "skillhub.fullname" . }}-config + key: auth-cas-provider-code + - name: SKILLHUB_AUTH_CAS_DISPLAY_NAME + valueFrom: + configMapKeyRef: + name: {{ include "skillhub.fullname" . }}-config + key: auth-cas-display-name + - name: SKILLHUB_AUTH_CAS_AUTHORITY + valueFrom: + configMapKeyRef: + name: {{ include "skillhub.fullname" . }}-config + key: auth-cas-authority + - name: SKILLHUB_AUTH_CAS_SERVER_URL + valueFrom: + configMapKeyRef: + name: {{ include "skillhub.fullname" . }}-config + key: auth-cas-server-url + - name: SKILLHUB_AUTH_CAS_SERVICE_URL + valueFrom: + configMapKeyRef: + name: {{ include "skillhub.fullname" . }}-config + key: auth-cas-service-url + - name: SKILLHUB_AUTH_CAS_PROTOCOL_VERSION + valueFrom: + configMapKeyRef: + name: {{ include "skillhub.fullname" . }}-config + key: auth-cas-protocol-version + - name: SKILLHUB_AUTH_CAS_SUBJECT_TYPE + valueFrom: + configMapKeyRef: + name: {{ include "skillhub.fullname" . }}-config + key: auth-cas-subject-type + - name: SKILLHUB_AUTH_CAS_CONNECT_TIMEOUT + valueFrom: + configMapKeyRef: + name: {{ include "skillhub.fullname" . }}-config + key: auth-cas-connect-timeout + - name: SKILLHUB_AUTH_CAS_READ_TIMEOUT + valueFrom: + configMapKeyRef: + name: {{ include "skillhub.fullname" . }}-config + key: auth-cas-read-timeout + - name: SKILLHUB_AUTH_CAS_STATE_TTL + valueFrom: + configMapKeyRef: + name: {{ include "skillhub.fullname" . }}-config + key: auth-cas-state-ttl + - name: SKILLHUB_AUTH_CAS_MAX_RESPONSE_BYTES + valueFrom: + configMapKeyRef: + name: {{ include "skillhub.fullname" . }}-config + key: auth-cas-max-response-bytes + - name: SKILLHUB_AUTH_CAS_ATTRIBUTES_SUBJECT + valueFrom: + configMapKeyRef: + name: {{ include "skillhub.fullname" . }}-config + key: auth-cas-attribute-subject + - name: SKILLHUB_AUTH_CAS_ATTRIBUTES_DISPLAY_NAME + valueFrom: + configMapKeyRef: + name: {{ include "skillhub.fullname" . }}-config + key: auth-cas-attribute-display-name + - name: SKILLHUB_AUTH_CAS_ATTRIBUTES_EMAIL + valueFrom: + configMapKeyRef: + name: {{ include "skillhub.fullname" . }}-config + key: auth-cas-attribute-email + - name: SKILLHUB_AUTH_CAS_ATTRIBUTES_AVATAR_URL + valueFrom: + configMapKeyRef: + name: {{ include "skillhub.fullname" . }}-config + key: auth-cas-attribute-avatar-url - name: SKILLHUB_BUILTIN_SKILLS_ENABLED valueFrom: configMapKeyRef: diff --git a/charts/skillhub/templates/validate.yaml b/charts/skillhub/templates/validate.yaml index db34c848..03af8ecf 100644 --- a/charts/skillhub/templates/validate.yaml +++ b/charts/skillhub/templates/validate.yaml @@ -6,6 +6,24 @@ {{- if and .Values.auth.direct.enabled (not .Values.auth.direct.provider) -}} {{- fail "auth.direct.enabled=true requires auth.direct.provider" -}} {{- end -}} +{{- if .Values.auth.cas.enabled -}} +{{- if not .Values.auth.cas.serverUrl -}} +{{- fail "auth.cas.enabled=true requires auth.cas.serverUrl" -}} +{{- end -}} +{{- if not .Values.auth.cas.serviceUrl -}} +{{- fail "auth.cas.enabled=true requires auth.cas.serviceUrl" -}} +{{- end -}} +{{- if not (regexMatch "^https://[^[:space:]]+$" .Values.auth.cas.serverUrl) -}} +{{- fail "auth.cas.serverUrl must be an absolute HTTPS URL" -}} +{{- end -}} +{{- if not (regexMatch "^https://[^[:space:]?#]+$" .Values.auth.cas.serviceUrl) -}} +{{- fail "auth.cas.serviceUrl must be an absolute HTTPS URL without query or fragment" -}} +{{- end -}} +{{- $expectedCasCallback := printf "/api/v1/auth/cas/%s/callback" .Values.auth.cas.providerCode -}} +{{- if not (hasSuffix $expectedCasCallback .Values.auth.cas.serviceUrl) -}} +{{- fail (printf "auth.cas.serviceUrl must end with %s" $expectedCasCallback) -}} +{{- end -}} +{{- end -}} {{- if and .Values.ingress.enabled (not .Values.server.service.enabled) -}} {{- fail "ingress.enabled=true requires server.service.enabled=true" -}} diff --git a/charts/skillhub/tests/configuration-contracts.sh b/charts/skillhub/tests/configuration-contracts.sh index 94df9733..cb456cd9 100755 --- a/charts/skillhub/tests/configuration-contracts.sh +++ b/charts/skillhub/tests/configuration-contracts.sh @@ -192,6 +192,16 @@ render device "$CHART_DIR" \ --show-only templates/configmap.yaml >"$TMP_DIR/device.yaml" grep -Fq 'device-auth-verification-uri: "https://skills.example.com/cli/auth"' "$TMP_DIR/device.yaml" +render cas "$CHART_DIR" \ + --set auth.cas.enabled=true \ + --set auth.cas.serverUrl=https://cas.example.com/cas \ + --set auth.cas.serviceUrl=https://skills.example.com/api/v1/auth/cas/cas-main/callback \ + --show-only templates/configmap.yaml \ + --show-only templates/server-deployment.yaml >"$TMP_DIR/cas.yaml" +grep -Fq 'auth-cas-enabled: "true"' "$TMP_DIR/cas.yaml" +grep -Fq 'auth-cas-server-url: "https://cas.example.com/cas"' "$TMP_DIR/cas.yaml" +grep -Fq 'name: SKILLHUB_AUTH_CAS_SERVICE_URL' "$TMP_DIR/cas.yaml" + render tls "$CHART_DIR" \ --set ingress.enabled=true \ --set-json 'ingress.tls=[{"hosts":["skills.example.com"],"secretName":"skills-tls"}]' \ @@ -265,6 +275,17 @@ assert_rejected server-off --set server.enabled=false assert_rejected direct-auth-without-provider \ --set auth.direct.enabled=true \ --set-string auth.direct.provider= +assert_rejected cas-without-server \ + --set auth.cas.enabled=true \ + --set auth.cas.serviceUrl=https://skills.example.com/api/v1/auth/cas/cas-main/callback +assert_rejected cas-with-insecure-server \ + --set auth.cas.enabled=true \ + --set auth.cas.serverUrl=http://cas.example.com/cas \ + --set auth.cas.serviceUrl=https://skills.example.com/api/v1/auth/cas/cas-main/callback +assert_rejected cas-with-wrong-callback \ + --set auth.cas.enabled=true \ + --set auth.cas.serverUrl=https://cas.example.com/cas \ + --set auth.cas.serviceUrl=https://skills.example.com/api/v1/auth/cas/other/callback assert_rejected ingress-without-server-service --set ingress.enabled=true --set server.service.enabled=false assert_rejected ingress-without-web-service --set ingress.enabled=true --set web.service.enabled=false assert_rejected multi-without-rwx --set server.replicaCount=2 diff --git a/charts/skillhub/values.schema.json b/charts/skillhub/values.schema.json index 19be6440..10950c7a 100644 --- a/charts/skillhub/values.schema.json +++ b/charts/skillhub/values.schema.json @@ -21,7 +21,7 @@ "auth": { "type": "object", "additionalProperties": false, - "required": ["direct"], + "required": ["direct", "cas"], "properties": { "direct": { "type": "object", @@ -31,6 +31,36 @@ "enabled": { "type": "boolean" }, "provider": { "type": "string" } } + }, + "cas": { + "type": "object", + "additionalProperties": false, + "required": ["enabled", "providerCode", "displayName", "authority", "serverUrl", "serviceUrl", "protocolVersion", "subjectType", "connectTimeout", "readTimeout", "stateTtl", "maxResponseBytes", "attributes"], + "properties": { + "enabled": { "type": "boolean" }, + "providerCode": { "type": "string", "pattern": "^[a-z0-9][a-z0-9._-]{0,63}$" }, + "displayName": { "type": "string", "minLength": 1, "maxLength": 128 }, + "authority": { "type": "string", "pattern": "^[a-z0-9][a-z0-9._:-]{0,127}$" }, + "serverUrl": { "type": "string" }, + "serviceUrl": { "type": "string" }, + "protocolVersion": { "enum": ["2.0", "3.0"] }, + "subjectType": { "type": "string", "pattern": "^[a-z][a-z0-9_]{0,63}$" }, + "connectTimeout": { "type": "string", "minLength": 1 }, + "readTimeout": { "type": "string", "minLength": 1 }, + "stateTtl": { "type": "string", "minLength": 1 }, + "maxResponseBytes": { "type": "integer", "minimum": 1024, "maximum": 1048576 }, + "attributes": { + "type": "object", + "additionalProperties": false, + "required": ["subject", "displayName", "email", "avatarUrl"], + "properties": { + "subject": { "type": "string" }, + "displayName": { "type": "string" }, + "email": { "type": "string" }, + "avatarUrl": { "type": "string" } + } + } + } } } }, diff --git a/charts/skillhub/values.yaml b/charts/skillhub/values.yaml index 059ff73c..06c84251 100644 --- a/charts/skillhub/values.yaml +++ b/charts/skillhub/values.yaml @@ -21,6 +21,24 @@ auth: direct: enabled: true provider: local + cas: + enabled: false + providerCode: cas-main + displayName: "Corporate CAS" + authority: corp-cas + serverUrl: "" + serviceUrl: "" + protocolVersion: "3.0" + subjectType: cas_principal + connectTimeout: PT5S + readTimeout: PT10S + stateTtl: PT5M + maxResponseBytes: 1048576 + attributes: + subject: "" + displayName: displayName + email: mail + avatarUrl: "" builtinSkills: enabled: true diff --git a/compose.release.yml b/compose.release.yml index 73318768..f99cb635 100644 --- a/compose.release.yml +++ b/compose.release.yml @@ -88,6 +88,23 @@ services: SKILLHUB_SECURITY_SCANNER_URL: http://skill-scanner:8000 SKILLHUB_SECURITY_SCANNER_MODE: upload SKILLHUB_AUTH_DIRECT_ENABLED: ${SKILLHUB_AUTH_DIRECT_ENABLED:-false} + SKILLHUB_AUTH_CAS_ENABLED: ${SKILLHUB_AUTH_CAS_ENABLED:-false} + SKILLHUB_AUTH_CAS_PROVIDER_CODE: ${SKILLHUB_AUTH_CAS_PROVIDER_CODE:-cas} + SKILLHUB_AUTH_CAS_DISPLAY_NAME: ${SKILLHUB_AUTH_CAS_DISPLAY_NAME:-CAS} + SKILLHUB_AUTH_CAS_AUTHORITY: ${SKILLHUB_AUTH_CAS_AUTHORITY:-} + SKILLHUB_AUTH_CAS_SERVER_URL: ${SKILLHUB_AUTH_CAS_SERVER_URL:-} + SKILLHUB_AUTH_CAS_SERVICE_URL: ${SKILLHUB_AUTH_CAS_SERVICE_URL:-} + SKILLHUB_AUTH_CAS_PROTOCOL_VERSION: ${SKILLHUB_AUTH_CAS_PROTOCOL_VERSION:-3.0} + SKILLHUB_AUTH_CAS_SUBJECT_TYPE: ${SKILLHUB_AUTH_CAS_SUBJECT_TYPE:-cas_principal} + SKILLHUB_AUTH_CAS_ALLOW_INSECURE_FOR_TESTING: ${SKILLHUB_AUTH_CAS_ALLOW_INSECURE_FOR_TESTING:-false} + SKILLHUB_AUTH_CAS_CONNECT_TIMEOUT: ${SKILLHUB_AUTH_CAS_CONNECT_TIMEOUT:-PT5S} + SKILLHUB_AUTH_CAS_READ_TIMEOUT: ${SKILLHUB_AUTH_CAS_READ_TIMEOUT:-PT10S} + SKILLHUB_AUTH_CAS_STATE_TTL: ${SKILLHUB_AUTH_CAS_STATE_TTL:-PT5M} + SKILLHUB_AUTH_CAS_MAX_RESPONSE_BYTES: ${SKILLHUB_AUTH_CAS_MAX_RESPONSE_BYTES:-1048576} + SKILLHUB_AUTH_CAS_ATTRIBUTES_SUBJECT: ${SKILLHUB_AUTH_CAS_ATTRIBUTES_SUBJECT:-} + SKILLHUB_AUTH_CAS_ATTRIBUTES_DISPLAY_NAME: ${SKILLHUB_AUTH_CAS_ATTRIBUTES_DISPLAY_NAME:-} + SKILLHUB_AUTH_CAS_ATTRIBUTES_EMAIL: ${SKILLHUB_AUTH_CAS_ATTRIBUTES_EMAIL:-} + SKILLHUB_AUTH_CAS_ATTRIBUTES_AVATAR_URL: ${SKILLHUB_AUTH_CAS_ATTRIBUTES_AVATAR_URL:-} BOOTSTRAP_ADMIN_ENABLED: ${BOOTSTRAP_ADMIN_ENABLED:-false} BOOTSTRAP_ADMIN_USER_ID: ${BOOTSTRAP_ADMIN_USER_ID:-docker-admin} BOOTSTRAP_ADMIN_USERNAME: ${BOOTSTRAP_ADMIN_USERNAME:-admin} diff --git a/deploy/k8s/README.md b/deploy/k8s/README.md index 0ed6db14..b2d5acf6 100644 --- a/deploy/k8s/README.md +++ b/deploy/k8s/README.md @@ -68,6 +68,16 @@ cp secret.yaml.example secret.yaml | skill-scanner-llm-base-url | 本地/自定义 LLM 服务地址 | 否 | | skill-scanner-llm-model | Scanner 使用的 LLM 模型名 | 否 | +CAS 2.0/3.0 不需要额外 Secret。启用时修改 `base/configmap.yaml` 中的 +`auth-cas-*` 配置；`auth-cas-service-url` 必须是精确 callback： + +```text +https:///api/v1/auth/cas//callback +``` + +完整字段、身份映射和验证步骤见 +[`docs/23-cas-integration.md`](../../docs/23-cas-integration.md)。 + ### 3. 选择部署方式 **方式一：完整部署（包含 PostgreSQL + Redis）** diff --git a/deploy/k8s/base/backend-deployment.yaml b/deploy/k8s/base/backend-deployment.yaml index 52ddc185..60eb97d3 100644 --- a/deploy/k8s/base/backend-deployment.yaml +++ b/deploy/k8s/base/backend-deployment.yaml @@ -168,6 +168,88 @@ spec: name: skillhub-config key: session-cookie-secure + # CAS 2.0/3.0 browser login + - name: SKILLHUB_AUTH_CAS_ENABLED + valueFrom: + configMapKeyRef: + name: skillhub-config + key: auth-cas-enabled + - name: SKILLHUB_AUTH_CAS_PROVIDER_CODE + valueFrom: + configMapKeyRef: + name: skillhub-config + key: auth-cas-provider-code + - name: SKILLHUB_AUTH_CAS_DISPLAY_NAME + valueFrom: + configMapKeyRef: + name: skillhub-config + key: auth-cas-display-name + - name: SKILLHUB_AUTH_CAS_AUTHORITY + valueFrom: + configMapKeyRef: + name: skillhub-config + key: auth-cas-authority + - name: SKILLHUB_AUTH_CAS_SERVER_URL + valueFrom: + configMapKeyRef: + name: skillhub-config + key: auth-cas-server-url + - name: SKILLHUB_AUTH_CAS_SERVICE_URL + valueFrom: + configMapKeyRef: + name: skillhub-config + key: auth-cas-service-url + - name: SKILLHUB_AUTH_CAS_PROTOCOL_VERSION + valueFrom: + configMapKeyRef: + name: skillhub-config + key: auth-cas-protocol-version + - name: SKILLHUB_AUTH_CAS_SUBJECT_TYPE + valueFrom: + configMapKeyRef: + name: skillhub-config + key: auth-cas-subject-type + - name: SKILLHUB_AUTH_CAS_CONNECT_TIMEOUT + valueFrom: + configMapKeyRef: + name: skillhub-config + key: auth-cas-connect-timeout + - name: SKILLHUB_AUTH_CAS_READ_TIMEOUT + valueFrom: + configMapKeyRef: + name: skillhub-config + key: auth-cas-read-timeout + - name: SKILLHUB_AUTH_CAS_STATE_TTL + valueFrom: + configMapKeyRef: + name: skillhub-config + key: auth-cas-state-ttl + - name: SKILLHUB_AUTH_CAS_MAX_RESPONSE_BYTES + valueFrom: + configMapKeyRef: + name: skillhub-config + key: auth-cas-max-response-bytes + - name: SKILLHUB_AUTH_CAS_ATTRIBUTES_SUBJECT + valueFrom: + configMapKeyRef: + name: skillhub-config + key: auth-cas-attribute-subject + - name: SKILLHUB_AUTH_CAS_ATTRIBUTES_DISPLAY_NAME + valueFrom: + configMapKeyRef: + name: skillhub-config + key: auth-cas-attribute-display-name + - name: SKILLHUB_AUTH_CAS_ATTRIBUTES_EMAIL + valueFrom: + configMapKeyRef: + name: skillhub-config + key: auth-cas-attribute-email + - name: SKILLHUB_AUTH_CAS_ATTRIBUTES_AVATAR_URL + valueFrom: + configMapKeyRef: + name: skillhub-config + key: auth-cas-attribute-avatar-url + # Bootstrap Admin (non-sensitive from ConfigMap) - name: BOOTSTRAP_ADMIN_ENABLED valueFrom: diff --git a/deploy/k8s/base/configmap.yaml b/deploy/k8s/base/configmap.yaml index 06dbbaa5..903a019c 100644 --- a/deploy/k8s/base/configmap.yaml +++ b/deploy/k8s/base/configmap.yaml @@ -46,6 +46,26 @@ data: # Session 配置 # HTTP 环境设为 false，HTTPS 环境设为 true session-cookie-secure: "false" + + # CAS 2.0/3.0 登录（默认关闭） + # service-url 必须是浏览器可访问的精确回调地址，且 provider code + # 必须与路径中的值一致。 + auth-cas-enabled: "false" + auth-cas-provider-code: cas-main + auth-cas-display-name: Corporate CAS + auth-cas-authority: corp-cas + auth-cas-server-url: https://cas.example.com/cas + auth-cas-service-url: https://skillhub.example.com/api/v1/auth/cas/cas-main/callback + auth-cas-protocol-version: "3.0" + auth-cas-subject-type: cas_principal + auth-cas-connect-timeout: PT5S + auth-cas-read-timeout: PT10S + auth-cas-state-ttl: PT5M + auth-cas-max-response-bytes: "1048576" + auth-cas-attribute-subject: "" + auth-cas-attribute-display-name: displayName + auth-cas-attribute-email: mail + auth-cas-attribute-avatar-url: "" --- apiVersion: v1 kind: PersistentVolumeClaim diff --git a/docs/21-unified-identity-federation-design.md b/docs/21-unified-identity-federation-design.md index 657a998c..0ef599a7 100644 --- a/docs/21-unified-identity-federation-design.md +++ b/docs/21-unified-identity-federation-design.md @@ -1794,7 +1794,10 @@ GET login start 要求： -- 使用成熟 CAS Client 或 Spring Security CAS 集成，不自行维护不安全 XML parser。 +- 优先使用成熟 CAS Client 或 Spring Security CAS 集成；如果兼容性与安全 spike 证明 + 其违反本文更高优先级的不变量（例如记录 Ticket/完整响应，或 XML parser 不能 + fail closed），可以使用最小、受限且经过安全 Review 的内部 transport/parser，并 + 必须在设计和协议测试中记录证据。 - Ticket validation 必须绑定发起时精确 service URL。 - state 和 Ticket 一次性消费。 - CAS 2 XML 禁止 XXE。 @@ -1803,6 +1806,22 @@ GET login start - CAS email attribute 默认不是 verified。 - 强制 HTTPS 的规则要支持明确的本地测试例外，生产 fail closed。 +当前 Spring Boot 3.2 / Java 21 兼容性 spike 的结论： + +- Spring Security CAS 使用 Apereo Java CAS Client 的 `TicketValidator`。 +- Apereo Java CAS Client 4.1.1 的 `AbstractUrlBasedTicketValidator` 在 DEBUG 记录包含 + Ticket 的完整 validation URL 和完整上游响应，违反 7.6 和 17.2 节。 +- 同版本 `Cas20ServiceTicketValidator.extractCustomAttributes` 的独立 SAX 路径没有显式 + 关闭全部外部实体能力，不能作为本项目 CAS 2 属性解析的安全边界。 +- 因此 PR 9 使用 JDK `HttpClient` 的受限 transport 和显式 hardening 的 JSON/XML parser： + 禁止 redirect、限制连接/请求超时与响应大小、XML 禁止 DOCTYPE/外部实体/DTD/schema， + 且 Ticket、URL、完整响应和属性不进入日志或异常。 + +参考： + +- [Apereo validator logging](https://github.com/apereo/java-cas-client/blob/cas-client-4.1.1/cas-client-core/src/main/java/org/apereo/cas/client/validation/AbstractUrlBasedTicketValidator.java) +- [Apereo CAS 2 attribute parser](https://github.com/apereo/java-cas-client/blob/cas-client-4.1.1/cas-client-core/src/main/java/org/apereo/cas/client/validation/Cas20ServiceTicketValidator.java) + ### 14.5 SAML 2.0 首选路径： @@ -2424,7 +2443,8 @@ DingTalk 的目标支持等级是 Native Tier 1。实现可以来自社区，但 #### PR 9：CAS Adapter - 从 #464 复用协议和测试思路。 -- 使用成熟 CAS Client。 +- 按 14.4 节 spike 结论使用成熟 Client，或使用经过安全 Review、不会泄露 Ticket 且对 + XML/响应边界 fail closed 的最小内部 Client。 - 不复用仅把 `OAuthClaims` 泛化为浅 `IdentityClaims` 的核心方式。 LDAP 和 DingTalk 不要求必须由维护者亲自编码。更准确的规则是： diff --git a/docs/23-cas-integration.md b/docs/23-cas-integration.md new file mode 100644 index 00000000..8862ef31 --- /dev/null +++ b/docs/23-cas-integration.md @@ -0,0 +1,170 @@ +# CAS 2.0/3.0 接入指南 + +本文说明如何把一个 CAS Provider Instance 接入 SkillHub 统一身份核心。CAS 登录默认关闭， +配置不完整或 Authority 状态异常时不会出现在登录方法目录中。 + +## 1. 前置条件 + +- SkillHub 的公开入口和 CAS Server 使用 HTTPS。 +- Redis 可用。CAS state 使用 Redis 原子消费，以支持多 Pod 和重放保护。 +- CAS Server 已允许下面的精确 Service URL： + + ```text + https:///api/v1/auth/cas//callback + ``` + +- 已确认可作为稳定身份键的 CAS principal 或 immutable attribute。 + +`provider-code` 和 `authority` 是持久身份绑定的一部分。产生 Identity Binding 后不能通过 +普通配置变更切换到另一个身份域。 + +## 2. 配置 + +| 环境变量 | 必填 | 默认值 | 说明 | +|---|---:|---|---| +| `SKILLHUB_AUTH_CAS_ENABLED` | 是 | `false` | 显式启用 CAS | +| `SKILLHUB_AUTH_CAS_PROVIDER_CODE` | 是 | `cas` | Provider Instance code，需长期稳定 | +| `SKILLHUB_AUTH_CAS_DISPLAY_NAME` | 是 | `CAS` | 登录页展示名 | +| `SKILLHUB_AUTH_CAS_AUTHORITY` | 是 | 空 | 稳定 CAS 身份域 ID | +| `SKILLHUB_AUTH_CAS_SERVER_URL` | 是 | 空 | CAS Server 根地址，例如 `https://cas.example.com/cas` | +| `SKILLHUB_AUTH_CAS_SERVICE_URL` | 是 | 空 | 精确 SkillHub callback，不含 query/fragment | +| `SKILLHUB_AUTH_CAS_PROTOCOL_VERSION` | 是 | `3.0` | `2.0` 或 `3.0` | +| `SKILLHUB_AUTH_CAS_SUBJECT_TYPE` | 是 | `cas_principal` | 统一身份核心中的 Subject type | +| `SKILLHUB_AUTH_CAS_ATTRIBUTES_SUBJECT` | 否 | 空 | 为空时使用 CAS principal；否则使用唯一 immutable attribute | +| `SKILLHUB_AUTH_CAS_ATTRIBUTES_DISPLAY_NAME` | 否 | 空 | display name attribute | +| `SKILLHUB_AUTH_CAS_ATTRIBUTES_EMAIL` | 否 | 空 | email attribute，固定按 asserted 处理 | +| `SKILLHUB_AUTH_CAS_ATTRIBUTES_AVATAR_URL` | 否 | 空 | avatar URL attribute | +| `SKILLHUB_AUTH_CAS_CONNECT_TIMEOUT` | 否 | `PT5S` | 连接超时 | +| `SKILLHUB_AUTH_CAS_READ_TIMEOUT` | 否 | `PT10S` | 请求总超时 | +| `SKILLHUB_AUTH_CAS_STATE_TTL` | 否 | `PT5M` | 登录 state 有效期，最大 15 分钟 | +| `SKILLHUB_AUTH_CAS_MAX_RESPONSE_BYTES` | 否 | `1048576` | validation 响应上限，1 KiB–1 MiB | + +CAS 返回的普通 email attribute 不是 verified email，不能用于 +`EMAIL_DOMAIN` 准入或静默账号绑定。 + +### Docker Compose + +编辑 `.env.release`： + +```dotenv +SKILLHUB_AUTH_CAS_ENABLED=true +SKILLHUB_AUTH_CAS_PROVIDER_CODE=cas-main +SKILLHUB_AUTH_CAS_DISPLAY_NAME=Corporate CAS +SKILLHUB_AUTH_CAS_AUTHORITY=corp-cas +SKILLHUB_AUTH_CAS_SERVER_URL=https://cas.example.com/cas +SKILLHUB_AUTH_CAS_SERVICE_URL=https://skills.example.com/api/v1/auth/cas/cas-main/callback +SKILLHUB_AUTH_CAS_PROTOCOL_VERSION=3.0 +SKILLHUB_AUTH_CAS_SUBJECT_TYPE=cas_principal +SKILLHUB_AUTH_CAS_ATTRIBUTES_DISPLAY_NAME=displayName +SKILLHUB_AUTH_CAS_ATTRIBUTES_EMAIL=mail +``` + +启动前运行： + +```bash +./scripts/validate-release-config.sh .env.release +``` + +### Helm + +```yaml +auth: + cas: + enabled: true + providerCode: cas-main + displayName: Corporate CAS + authority: corp-cas + serverUrl: https://cas.example.com/cas + serviceUrl: https://skills.example.com/api/v1/auth/cas/cas-main/callback + protocolVersion: "3.0" + subjectType: cas_principal + connectTimeout: PT5S + readTimeout: PT10S + stateTtl: PT5M + maxResponseBytes: 1048576 + attributes: + subject: "" + displayName: displayName + email: mail + avatarUrl: "" +``` + +Chart 在渲染阶段拒绝 HTTP endpoint、缺失 URL 和 provider code 不匹配的 callback。 + +### Kustomize + +修改 `deploy/k8s/base/configmap.yaml` 中的 `auth-cas-*` 字段，然后重新应用 overlay。 +CAS 配置不包含 client secret；若企业扩展引入凭证，必须放入 Kubernetes Secret，不能放 +在 ConfigMap。 + +## 3. 身份映射 + +默认映射： + +```text +primary subject = CAS principal +subject type = cas_principal +email assurance = PROVIDER_ASSERTED +aliases = none +``` + +如果 CAS principal 可能随用户名变更，必须配置 +`SKILLHUB_AUTH_CAS_ATTRIBUTES_SUBJECT` 指向 CAS Server 明确定义且实际返回的 immutable +attribute，并为该属性选择稳定的 `subject-type`。属性缺失、多值或空值时登录 fail closed。 + +不要把 email、display name 或临时用户名当作稳定 Subject。 + +## 4. 验证 + +1. 匿名请求登录方法目录： + + ```bash + curl -fsS 'https://skills.example.com/api/v1/auth/methods' + ``` + + 只在 Provider 为 `READY` 时应出现 `CAS_REDIRECT`。 + +2. 在浏览器点击 CAS 登录，确认重定向到 CAS `/login`，其 `service` 解码后与配置的 + callback 加一次性 `state` 完全一致。 +3. 完成 CAS 登录，确认返回原始 `returnTo` 或默认页面，并能请求 + `/api/v1/auth/me`。 +4. 再次请求相同 callback，必须得到 `casInvalidState` 或 CAS Ticket 验证失败，不能建立 + 第二个 Session。 +5. 检查应用日志中不包含 `ST-` Ticket、validation URL、上游完整响应或用户属性。 +6. 禁用 Provider 后，方法目录不再显示 CAS，且点击旧 URL 不应连接 CAS Server。 + +建议分别验证 CAS 2 XML、CAS 3 JSON、CAS 3 XML fallback、无效 Ticket、错误 Service、 +超时、TLS 失败、XXE、超大响应和 Redis 不可用。 + +## 5. 升级与回滚 + +- 新配置默认关闭，不影响现有本地密码、GitHub、GitLab 或 OIDC 登录。 +- 本次接入不修改 `PlatformPrincipal` 或现有 Session 序列化结构。 +- 旧版本回滚后会忽略 CAS 环境变量；现有非 CAS 登录仍可使用。 +- CAS 已产生 Binding 后回滚会暂时失去 CAS 登录入口，但不会删除账号、Binding 或业务 + 数据。 +- 修改 CAS endpoint 可以保持同一 Authority；修改 Authority 必须走统一身份设计中的 + 显式 Authority 迁移流程。 + +## 6. 安全实现说明 + +实现阶段验证了 Spring Security CAS 所依赖的 Apereo Java CAS Client。其 4.1.1 +`AbstractUrlBasedTicketValidator` 仍会在 DEBUG 记录包含 Ticket 的 validation URL 和完整 +响应；CAS 2 自定义属性解析路径也没有满足本项目要求的全部 XML parser fail-closed +设置。因此当前实现没有调用该库的 URL validator，而是使用受限 JDK HTTP transport 和 +严格 parser： + +- 禁止 redirect； +- 明确连接、请求和响应大小上限； +- XML 禁止 DOCTYPE、外部实体、外部 DTD 和外部 schema； +- Ticket、完整响应和属性不写日志或异常； +- CAS 3 优先 JSON，并支持受限 XML fallback。 + +上游参考： + +- [Spring Security CAS reference](https://docs.spring.io/spring-security/reference/servlet/authentication/cas.html) +- [Apereo validator logging](https://github.com/apereo/java-cas-client/blob/cas-client-4.1.1/cas-client-core/src/main/java/org/apereo/cas/client/validation/AbstractUrlBasedTicketValidator.java) +- [Apereo CAS 2 attribute parser](https://github.com/apereo/java-cas-client/blob/cas-client-4.1.1/cas-client-core/src/main/java/org/apereo/cas/client/validation/Cas20ServiceTicketValidator.java) + +如果上游版本修复这些问题，可以在保持错误分类、响应上限和无敏感日志测试的前提下重新 +评估替换 transport/parser。 diff --git a/scripts/validate-release-config.sh b/scripts/validate-release-config.sh index 7c7940a3..780602e3 100755 --- a/scripts/validate-release-config.sh +++ b/scripts/validate-release-config.sh @@ -222,9 +222,47 @@ validate_boolean BOOTSTRAP_ADMIN_ENABLED validate_boolean SKILLHUB_TRUST_FORWARDED_PROTO validate_boolean SKILLHUB_STORAGE_S3_FORCE_PATH_STYLE validate_boolean SKILLHUB_STORAGE_S3_AUTO_CREATE_BUCKET +validate_boolean SKILLHUB_AUTH_CAS_ENABLED +validate_boolean SKILLHUB_AUTH_CAS_ALLOW_INSECURE_FOR_TESTING validate_boolean SPRING_DATA_REDIS_SSL_ENABLED validate_boolean SKILLHUB_REDIS_SENTINEL_CHECK_SENTINELS_LIST +if [ "${SKILLHUB_AUTH_CAS_ENABLED:-false}" = "true" ]; then + require_non_empty SKILLHUB_AUTH_CAS_PROVIDER_CODE + require_non_empty SKILLHUB_AUTH_CAS_DISPLAY_NAME + require_non_empty SKILLHUB_AUTH_CAS_AUTHORITY + require_non_empty SKILLHUB_AUTH_CAS_SERVER_URL + require_non_empty SKILLHUB_AUTH_CAS_SERVICE_URL + validate_url SKILLHUB_AUTH_CAS_SERVER_URL + validate_url SKILLHUB_AUTH_CAS_SERVICE_URL + case "${SKILLHUB_AUTH_CAS_SERVER_URL:-}" in + *\?*|*\#*) error "SKILLHUB_AUTH_CAS_SERVER_URL must not contain a query or fragment" ;; + esac + case "${SKILLHUB_AUTH_CAS_SERVICE_URL:-}" in + *\?*|*\#*) error "SKILLHUB_AUTH_CAS_SERVICE_URL must not contain a query or fragment" ;; + esac + case "${SKILLHUB_AUTH_CAS_SERVER_URL:-}" in + https://*) ;; + *) error "SKILLHUB_AUTH_CAS_SERVER_URL must use https in release deployments" ;; + esac + case "${SKILLHUB_AUTH_CAS_SERVICE_URL:-}" in + https://*) ;; + *) error "SKILLHUB_AUTH_CAS_SERVICE_URL must use https in release deployments" ;; + esac + case "${SKILLHUB_AUTH_CAS_PROTOCOL_VERSION:-3.0}" in + 2.0|3.0) ;; + *) error "SKILLHUB_AUTH_CAS_PROTOCOL_VERSION must be 2.0 or 3.0" ;; + esac + expected_cas_callback="/api/v1/auth/cas/${SKILLHUB_AUTH_CAS_PROVIDER_CODE}/callback" + case "${SKILLHUB_AUTH_CAS_SERVICE_URL:-}" in + *"$expected_cas_callback") ;; + *) error "SKILLHUB_AUTH_CAS_SERVICE_URL must end with $expected_cas_callback" ;; + esac + if [ "${SKILLHUB_AUTH_CAS_ALLOW_INSECURE_FOR_TESTING:-false}" = "true" ]; then + error "SKILLHUB_AUTH_CAS_ALLOW_INSECURE_FOR_TESTING cannot be true in release deployments" + fi +fi + validate_port POSTGRES_PORT validate_port REDIS_PORT validate_port API_PORT diff --git a/server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/CasLoginController.java b/server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/CasLoginController.java new file mode 100644 index 00000000..49620397 --- /dev/null +++ b/server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/CasLoginController.java @@ -0,0 +1,111 @@ +package com.iflytek.skillhub.controller; + +import com.iflytek.skillhub.service.CasLoginAppService; +import com.iflytek.skillhub.service.CasLoginFailure; +import com.iflytek.skillhub.service.CasLoginFlowException; +import jakarta.servlet.http.HttpServletRequest; +import java.net.URI; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.slf4j.MDC; +import org.springframework.http.HttpStatus; +import org.springframework.http.ResponseEntity; +import org.springframework.stereotype.Controller; +import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.PathVariable; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestParam; + +/** + * CAS browser transport. Protocol verification and identity resolution are + * delegated to application and auth services. + */ +@Controller +@RequestMapping("/api/v1/auth/cas/{providerCode}") +public class CasLoginController { + + private static final Logger log = LoggerFactory.getLogger( + CasLoginController.class); + + private final CasLoginAppService loginAppService; + + public CasLoginController( + CasLoginAppService loginAppService) { + this.loginAppService = loginAppService; + } + + @GetMapping("/login") + public ResponseEntity login( + @PathVariable String providerCode, + @RequestParam(required = false) String returnTo, + HttpServletRequest request) { + try { + return redirect(loginAppService.begin( + providerCode, + returnTo, + request)); + } catch (CasLoginFlowException exception) { + return redirect(failureTarget(exception.failure())); + } catch (RuntimeException exception) { + logUnexpected(providerCode, exception); + return redirect(failureTarget( + CasLoginFailure.INTERNAL_ERROR)); + } + } + + @GetMapping("/callback") + public ResponseEntity callback( + @PathVariable String providerCode, + @RequestParam(required = false) String ticket, + @RequestParam(required = false) String state, + HttpServletRequest request) { + try { + return redirect(URI.create(loginAppService.complete( + providerCode, + ticket, + state, + request))); + } catch (CasLoginFlowException exception) { + return redirect(failureTarget(exception.failure())); + } catch (RuntimeException exception) { + logUnexpected(providerCode, exception); + return redirect(failureTarget( + CasLoginFailure.INTERNAL_ERROR)); + } + } + + private ResponseEntity redirect(URI target) { + return ResponseEntity.status(HttpStatus.FOUND) + .location(target) + .build(); + } + + private URI failureTarget(CasLoginFailure failure) { + return switch (failure) { + case ACCOUNT_PENDING -> URI.create("/pending-approval"); + case ACCESS_DENIED -> URI.create("/access-denied"); + case LINK_REQUIRED -> + URI.create("/login?reason=linkRequired"); + case INVALID_STATE -> + URI.create("/login?reason=casInvalidState"); + case TICKET_MISSING -> + URI.create("/login?reason=casTicketMissing"); + case VALIDATION_FAILED -> + URI.create("/login?reason=casValidationFailed"); + case PROVIDER_UNAVAILABLE -> + URI.create("/login?reason=casUnavailable"); + case INTERNAL_ERROR -> + URI.create("/login?reason=internalError"); + }; + } + + private void logUnexpected( + String providerCode, + RuntimeException exception) { + log.error( + "CAS browser flow failed unexpectedly [requestId={}, provider={}, failure={}]", + MDC.get("requestId"), + providerCode, + exception.getClass().getSimpleName()); + } +} diff --git a/server/skillhub-app/src/main/java/com/iflytek/skillhub/service/AuthMethodCatalog.java b/server/skillhub-app/src/main/java/com/iflytek/skillhub/service/AuthMethodCatalog.java index 3c53b781..7b651b1b 100644 --- a/server/skillhub-app/src/main/java/com/iflytek/skillhub/service/AuthMethodCatalog.java +++ b/server/skillhub-app/src/main/java/com/iflytek/skillhub/service/AuthMethodCatalog.java @@ -83,7 +83,7 @@ public class AuthMethodCatalog { private boolean isMethodEnabled(IdentityProviderLoginMethod method) { return switch (method.methodType()) { - case OAUTH_REDIRECT -> true; + case OAUTH_REDIRECT, CAS_REDIRECT -> true; case DIRECT_PASSWORD -> directAuthProperties.isEnabled(); case SESSION_BOOTSTRAP -> sessionBootstrapProperties.isEnabled(); }; @@ -101,6 +101,13 @@ public class AuthMethodCatalog { method.displayName(), buildAuthorizationUrl(providerCode, returnTo) ); + case CAS_REDIRECT -> new AuthMethodResponse( + "cas-" + providerCode, + IdentityProviderLoginMethodType.CAS_REDIRECT.name(), + providerCode, + method.displayName(), + buildCasAuthorizationUrl(providerCode, returnTo) + ); case DIRECT_PASSWORD -> new AuthMethodResponse( "direct-" + providerCode, IdentityProviderLoginMethodType.DIRECT_PASSWORD.name(), @@ -125,4 +132,18 @@ public class AuthMethodCatalog { } return baseUrl + "?returnTo=" + URLEncoder.encode(returnTo, StandardCharsets.UTF_8); } + + private String buildCasAuthorizationUrl( + String providerCode, + String returnTo) { + String baseUrl = "/api/v1/auth/cas/" + + providerCode + + "/login"; + if (returnTo == null) { + return baseUrl; + } + return baseUrl + "?returnTo=" + URLEncoder.encode( + returnTo, + StandardCharsets.UTF_8); + } } diff --git a/server/skillhub-app/src/main/java/com/iflytek/skillhub/service/CasLoginAppService.java b/server/skillhub-app/src/main/java/com/iflytek/skillhub/service/CasLoginAppService.java new file mode 100644 index 00000000..c66872c1 --- /dev/null +++ b/server/skillhub-app/src/main/java/com/iflytek/skillhub/service/CasLoginAppService.java @@ -0,0 +1,226 @@ +package com.iflytek.skillhub.service; + +import com.iflytek.skillhub.auth.cas.CasAuthenticationExchange; +import com.iflytek.skillhub.auth.cas.CasBrowserClient; +import com.iflytek.skillhub.auth.cas.CasLoginInitiation; +import com.iflytek.skillhub.auth.exception.AuthFlowException; +import com.iflytek.skillhub.auth.identity.IdentityCoreException; +import com.iflytek.skillhub.auth.identity.IdentityProviderRegistry; +import com.iflytek.skillhub.auth.oauth.OAuthLoginRedirectSupport; +import com.iflytek.skillhub.auth.provider.ProviderAuthenticationException; +import com.iflytek.skillhub.auth.provider.ProviderAuthenticationFailureCode; +import com.iflytek.skillhub.auth.rbac.PlatformPrincipal; +import com.iflytek.skillhub.auth.session.PlatformSessionService; +import jakarta.servlet.http.HttpServletRequest; +import jakarta.servlet.http.HttpSession; +import java.net.URI; +import java.security.SecureRandom; +import java.util.Base64; +import java.util.function.Supplier; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.stereotype.Service; + +/** + * Orchestrates the CAS browser flow while keeping the remote ticket exchange + * outside the unified identity transaction. + */ +@Service +public class CasLoginAppService { + + private static final SecureRandom SECURE_RANDOM = + new SecureRandom(); + + private final IdentityProviderRegistry providerRegistry; + private final CasBrowserClient protocolClient; + private final ProviderLoginAppService providerLoginAppService; + private final PlatformSessionService platformSessionService; + private final CasLoginStateStore stateStore; + private final Supplier stateSupplier; + + @Autowired + public CasLoginAppService( + IdentityProviderRegistry providerRegistry, + CasBrowserClient protocolClient, + ProviderLoginAppService providerLoginAppService, + PlatformSessionService platformSessionService, + CasLoginStateStore stateStore) { + this( + providerRegistry, + protocolClient, + providerLoginAppService, + platformSessionService, + stateStore, + CasLoginAppService::newState); + } + + CasLoginAppService( + IdentityProviderRegistry providerRegistry, + CasBrowserClient protocolClient, + ProviderLoginAppService providerLoginAppService, + PlatformSessionService platformSessionService, + CasLoginStateStore stateStore, + Supplier stateSupplier) { + this.providerRegistry = providerRegistry; + this.protocolClient = protocolClient; + this.providerLoginAppService = providerLoginAppService; + this.platformSessionService = platformSessionService; + this.stateStore = stateStore; + this.stateSupplier = stateSupplier; + } + + public URI begin( + String providerCode, + String returnTo, + HttpServletRequest request) { + requireRoute(providerCode); + HttpSession session = request.getSession(true); + String state = stateSupplier.get(); + CasLoginInitiation initiation; + try { + initiation = protocolClient.begin( + providerCode, + state); + } catch (ProviderAuthenticationException exception) { + throw failure(CasLoginFailure.PROVIDER_UNAVAILABLE); + } + + try { + stateStore.save( + session.getId(), + state, + providerCode, + initiation.serviceUrl(), + OAuthLoginRedirectSupport.sanitizeReturnTo(returnTo), + initiation.stateTtl()); + } catch (CasLoginStateStore.CasLoginStateStoreException exception) { + throw failure(CasLoginFailure.INTERNAL_ERROR); + } + return initiation.loginUri(); + } + + public String complete( + String providerCode, + String ticket, + String state, + HttpServletRequest request) { + CasLoginStateStore.CasLoginState loginState = + consumeState(providerCode, state, request); + if (ticket == null || ticket.isBlank()) { + throw failure(CasLoginFailure.TICKET_MISSING); + } + + IdentityProviderRegistry.BrowserRoute + route = requireRoute(providerCode); + try { + CasAuthenticationExchange exchange = + protocolClient.validate( + providerCode, + ticket, + loginState.serviceUrl()); + var result = route.adapter().authenticate(exchange); + PlatformPrincipal principal = + providerLoginAppService.authenticate( + route.provider(), + result, + request); + platformSessionService.establishSession( + principal, + request); + } catch (ProviderAuthenticationException exception) { + throw mapProviderFailure(exception); + } catch (AuthFlowException exception) { + throw mapIdentityFailure(exception); + } + + String returnTo = OAuthLoginRedirectSupport.sanitizeReturnTo( + loginState.returnTo()); + return returnTo == null + ? OAuthLoginRedirectSupport.DEFAULT_TARGET_URL + : returnTo; + } + + private IdentityProviderRegistry.BrowserRoute + requireRoute( + String providerCode) { + try { + return providerRegistry.requireBrowserRoute( + providerCode, + CasAuthenticationExchange.class); + } catch (IdentityCoreException exception) { + throw failure(CasLoginFailure.PROVIDER_UNAVAILABLE); + } + } + + private CasLoginStateStore.CasLoginState consumeState( + String providerCode, + String presentedState, + HttpServletRequest request) { + HttpSession session = request.getSession(false); + if (session == null || presentedState == null) { + throw failure(CasLoginFailure.INVALID_STATE); + } + CasLoginStateStore.CasLoginState stored; + try { + stored = stateStore.consume( + session.getId(), + presentedState) + .orElseThrow(() -> failure( + CasLoginFailure.INVALID_STATE)); + } catch (CasLoginStateStore.CasLoginStateStoreException exception) { + throw failure(CasLoginFailure.INTERNAL_ERROR); + } + if (!stored.providerCode().equals(providerCode)) { + throw failure(CasLoginFailure.INVALID_STATE); + } + return stored; + } + + private CasLoginFlowException mapProviderFailure( + ProviderAuthenticationException exception) { + ProviderAuthenticationFailureCode code = + exception.getReasonCode(); + return switch (code) { + case UPSTREAM_INVALID_CREDENTIALS, + REPLAY_DETECTED -> + failure(CasLoginFailure.VALIDATION_FAILED); + case UPSTREAM_ACCESS_DENIED -> + failure(CasLoginFailure.ACCESS_DENIED); + case UPSTREAM_UNAVAILABLE, + UPSTREAM_MISCONFIGURED, + TLS_VALIDATION_FAILED, + UPSTREAM_INVALID_RESPONSE -> + failure(CasLoginFailure.PROVIDER_UNAVAILABLE); + }; + } + + private CasLoginFlowException mapIdentityFailure( + AuthFlowException exception) { + return switch (exception.getMessageCode()) { + case "error.auth.external.accountPending" -> + failure(CasLoginFailure.ACCOUNT_PENDING); + case "error.auth.external.accessDenied" -> + failure(CasLoginFailure.ACCESS_DENIED); + case "error.auth.external.linkRequired" -> + failure(CasLoginFailure.LINK_REQUIRED); + case "error.auth.external.providerUnavailable" -> + failure(CasLoginFailure.PROVIDER_UNAVAILABLE); + case "error.auth.external.invalidAssertion" -> + failure(CasLoginFailure.VALIDATION_FAILED); + default -> failure(CasLoginFailure.INTERNAL_ERROR); + }; + } + + private CasLoginFlowException failure( + CasLoginFailure failure) { + return new CasLoginFlowException(failure); + } + + private static String newState() { + byte[] bytes = new byte[32]; + SECURE_RANDOM.nextBytes(bytes); + return Base64.getUrlEncoder() + .withoutPadding() + .encodeToString(bytes); + } + +} diff --git a/server/skillhub-app/src/main/java/com/iflytek/skillhub/service/CasLoginFailure.java b/server/skillhub-app/src/main/java/com/iflytek/skillhub/service/CasLoginFailure.java new file mode 100644 index 00000000..a9b1fbc6 --- /dev/null +++ b/server/skillhub-app/src/main/java/com/iflytek/skillhub/service/CasLoginFailure.java @@ -0,0 +1,15 @@ +package com.iflytek.skillhub.service; + +/** + * Stable, credential-free browser failure reported by the CAS login flow. + */ +public enum CasLoginFailure { + INVALID_STATE, + TICKET_MISSING, + VALIDATION_FAILED, + PROVIDER_UNAVAILABLE, + ACCESS_DENIED, + ACCOUNT_PENDING, + LINK_REQUIRED, + INTERNAL_ERROR +} diff --git a/server/skillhub-app/src/main/java/com/iflytek/skillhub/service/CasLoginFlowException.java b/server/skillhub-app/src/main/java/com/iflytek/skillhub/service/CasLoginFlowException.java new file mode 100644 index 00000000..d45f88a2 --- /dev/null +++ b/server/skillhub-app/src/main/java/com/iflytek/skillhub/service/CasLoginFlowException.java @@ -0,0 +1,21 @@ +package com.iflytek.skillhub.service; + +import java.util.Objects; + +/** + * Browser-flow control exception that never carries a ticket, state, upstream + * payload, or user identifier. + */ +public final class CasLoginFlowException extends RuntimeException { + + private final CasLoginFailure failure; + + public CasLoginFlowException(CasLoginFailure failure) { + super(Objects.requireNonNull(failure, "failure").name()); + this.failure = failure; + } + + public CasLoginFailure failure() { + return failure; + } +} diff --git a/server/skillhub-app/src/main/java/com/iflytek/skillhub/service/CasLoginStateStore.java b/server/skillhub-app/src/main/java/com/iflytek/skillhub/service/CasLoginStateStore.java new file mode 100644 index 00000000..457377f0 --- /dev/null +++ b/server/skillhub-app/src/main/java/com/iflytek/skillhub/service/CasLoginStateStore.java @@ -0,0 +1,171 @@ +package com.iflytek.skillhub.service; + +import com.fasterxml.jackson.core.JsonProcessingException; +import com.fasterxml.jackson.databind.ObjectMapper; +import java.nio.charset.StandardCharsets; +import java.security.MessageDigest; +import java.security.NoSuchAlgorithmException; +import java.time.Clock; +import java.time.Duration; +import java.time.Instant; +import java.util.HexFormat; +import java.util.Objects; +import java.util.Optional; +import java.util.regex.Pattern; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.data.redis.core.StringRedisTemplate; +import org.springframework.stereotype.Component; + +/** + * Stores CAS browser state in Redis and consumes it atomically across + * application instances. + */ +@Component +public class CasLoginStateStore { + + private static final String KEY_PREFIX = + "skillhub:auth:cas:state:"; + private static final Pattern STATE_PATTERN = + Pattern.compile("[A-Za-z0-9_-]{32,128}"); + + private final StringRedisTemplate redisTemplate; + private final ObjectMapper objectMapper; + private final Clock clock; + + @Autowired + public CasLoginStateStore( + StringRedisTemplate redisTemplate, + ObjectMapper objectMapper) { + this(redisTemplate, objectMapper, Clock.systemUTC()); + } + + CasLoginStateStore( + StringRedisTemplate redisTemplate, + ObjectMapper objectMapper, + Clock clock) { + this.redisTemplate = redisTemplate; + this.objectMapper = objectMapper; + this.clock = clock; + } + + void save( + String sessionId, + String state, + String providerCode, + String serviceUrl, + String returnTo, + Duration ttl) { + requireSessionAndState(sessionId, state); + if (ttl == null || ttl.isZero() || ttl.isNegative()) { + throw new CasLoginStateStoreException(); + } + CasLoginState loginState = new CasLoginState( + providerCode, + serviceUrl, + returnTo, + clock.instant().plus(ttl)); + try { + redisTemplate.opsForValue().set( + key(sessionId, state), + objectMapper.writeValueAsString(loginState), + ttl); + } catch (RuntimeException + | JsonProcessingException exception) { + throw new CasLoginStateStoreException(); + } + } + + Optional consume( + String sessionId, + String state) { + if (!validSessionAndState(sessionId, state)) { + return Optional.empty(); + } + String serialized; + try { + serialized = redisTemplate.opsForValue() + .getAndDelete(key(sessionId, state)); + } catch (RuntimeException exception) { + throw new CasLoginStateStoreException(); + } + if (serialized == null) { + return Optional.empty(); + } + try { + CasLoginState loginState = objectMapper.readValue( + serialized, + CasLoginState.class); + if (!loginState.expiresAt().isAfter(clock.instant())) { + return Optional.empty(); + } + return Optional.of(loginState); + } catch (RuntimeException + | JsonProcessingException exception) { + throw new CasLoginStateStoreException(); + } + } + + private void requireSessionAndState( + String sessionId, + String state) { + if (!validSessionAndState(sessionId, state)) { + throw new CasLoginStateStoreException(); + } + } + + private boolean validSessionAndState( + String sessionId, + String state) { + return sessionId != null + && !sessionId.isBlank() + && state != null + && STATE_PATTERN.matcher(state).matches(); + } + + private String key( + String sessionId, + String state) { + try { + MessageDigest digest = + MessageDigest.getInstance("SHA-256"); + byte[] hash = digest.digest( + (sessionId + "\n" + state) + .getBytes(StandardCharsets.UTF_8)); + return KEY_PREFIX + HexFormat.of().formatHex(hash); + } catch (NoSuchAlgorithmException exception) { + throw new CasLoginStateStoreException(); + } + } + + record CasLoginState( + String providerCode, + String serviceUrl, + String returnTo, + Instant expiresAt + ) { + CasLoginState { + Objects.requireNonNull( + providerCode, + "providerCode"); + Objects.requireNonNull( + serviceUrl, + "serviceUrl"); + Objects.requireNonNull( + expiresAt, + "expiresAt"); + if (providerCode.isBlank() + || serviceUrl.isBlank()) { + throw new IllegalArgumentException( + "CAS state fields must not be blank"); + } + } + } + + static final class CasLoginStateStoreException + extends RuntimeException { + + private CasLoginStateStoreException() { + super("CAS_LOGIN_STATE_STORE_FAILURE"); + } + } +} diff --git a/server/skillhub-app/src/main/resources/application.yml b/server/skillhub-app/src/main/resources/application.yml index 3cccb5dc..8d570567 100644 --- a/server/skillhub-app/src/main/resources/application.yml +++ b/server/skillhub-app/src/main/resources/application.yml @@ -112,6 +112,25 @@ skillhub: enabled: ${SKILLHUB_AUTH_DIRECT_ENABLED:false} session-bootstrap: enabled: ${SKILLHUB_AUTH_SESSION_BOOTSTRAP_ENABLED:false} + cas: + enabled: ${SKILLHUB_AUTH_CAS_ENABLED:false} + provider-code: ${SKILLHUB_AUTH_CAS_PROVIDER_CODE:cas} + display-name: ${SKILLHUB_AUTH_CAS_DISPLAY_NAME:CAS} + authority: ${SKILLHUB_AUTH_CAS_AUTHORITY:} + server-url: ${SKILLHUB_AUTH_CAS_SERVER_URL:} + service-url: ${SKILLHUB_AUTH_CAS_SERVICE_URL:} + protocol-version: ${SKILLHUB_AUTH_CAS_PROTOCOL_VERSION:3.0} + subject-type: ${SKILLHUB_AUTH_CAS_SUBJECT_TYPE:cas_principal} + allow-insecure-for-testing: ${SKILLHUB_AUTH_CAS_ALLOW_INSECURE_FOR_TESTING:false} + connect-timeout: ${SKILLHUB_AUTH_CAS_CONNECT_TIMEOUT:PT5S} + read-timeout: ${SKILLHUB_AUTH_CAS_READ_TIMEOUT:PT10S} + state-ttl: ${SKILLHUB_AUTH_CAS_STATE_TTL:PT5M} + max-response-bytes: ${SKILLHUB_AUTH_CAS_MAX_RESPONSE_BYTES:1048576} + attributes: + subject: ${SKILLHUB_AUTH_CAS_ATTRIBUTES_SUBJECT:} + display-name: ${SKILLHUB_AUTH_CAS_ATTRIBUTES_DISPLAY_NAME:} + email: ${SKILLHUB_AUTH_CAS_ATTRIBUTES_EMAIL:} + avatar-url: ${SKILLHUB_AUTH_CAS_ATTRIBUTES_AVATAR_URL:} password-reset: code-expiry: ${SKILLHUB_AUTH_PASSWORD_RESET_CODE_EXPIRY:PT10M} email-from-address: ${SKILLHUB_AUTH_PASSWORD_RESET_FROM_ADDRESS:noreply@skillhub.local} diff --git a/server/skillhub-app/src/test/java/com/iflytek/skillhub/controller/CasLoginControllerTest.java b/server/skillhub-app/src/test/java/com/iflytek/skillhub/controller/CasLoginControllerTest.java new file mode 100644 index 00000000..105840a6 --- /dev/null +++ b/server/skillhub-app/src/test/java/com/iflytek/skillhub/controller/CasLoginControllerTest.java @@ -0,0 +1,71 @@ +package com.iflytek.skillhub.controller; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; + +import com.iflytek.skillhub.service.CasLoginAppService; +import com.iflytek.skillhub.service.CasLoginFailure; +import com.iflytek.skillhub.service.CasLoginFlowException; +import java.net.URI; +import org.junit.jupiter.api.Test; +import org.springframework.http.HttpStatus; +import org.springframework.mock.web.MockHttpServletRequest; + +class CasLoginControllerTest { + + private final CasLoginAppService loginAppService = + mock(CasLoginAppService.class); + private final CasLoginController controller = + new CasLoginController(loginAppService); + + @Test + void loginRedirectsOnlyToApplicationServiceTarget() { + MockHttpServletRequest request = + new MockHttpServletRequest(); + URI target = URI.create( + "https://cas.example/login?service=opaque"); + when(loginAppService.begin( + "cas-main", + "/dashboard", + request)).thenReturn(target); + + var response = controller.login( + "cas-main", + "/dashboard", + request); + + assertThat(response.getStatusCode()) + .isEqualTo(HttpStatus.FOUND); + assertThat(response.getHeaders().getLocation()) + .isEqualTo(target); + } + + @Test + void callbackMapsStableFailureWithoutReflectingTicketOrState() { + MockHttpServletRequest request = + new MockHttpServletRequest(); + when(loginAppService.complete( + "cas-main", + "ST-secret", + "state-secret", + request)).thenThrow( + new CasLoginFlowException( + CasLoginFailure.VALIDATION_FAILED)); + + var response = controller.callback( + "cas-main", + "ST-secret", + "state-secret", + request); + + assertThat(response.getStatusCode()) + .isEqualTo(HttpStatus.FOUND); + assertThat(response.getHeaders().getLocation()) + .hasToString( + "/login?reason=casValidationFailed"); + assertThat(response.getHeaders().getLocation().toString()) + .doesNotContain("ST-secret") + .doesNotContain("state-secret"); + } +} diff --git a/server/skillhub-app/src/test/java/com/iflytek/skillhub/service/AuthMethodCatalogTest.java b/server/skillhub-app/src/test/java/com/iflytek/skillhub/service/AuthMethodCatalogTest.java index 60cf5d86..50a81e7c 100644 --- a/server/skillhub-app/src/test/java/com/iflytek/skillhub/service/AuthMethodCatalogTest.java +++ b/server/skillhub-app/src/test/java/com/iflytek/skillhub/service/AuthMethodCatalogTest.java @@ -111,4 +111,38 @@ class AuthMethodCatalogTest { .containsExactly("local-password", "oauth-github"); } + @Test + void projectsCasAsFixedFirstPartyLoginRoute() { + IdentityProviderRegistry registry = + mock(IdentityProviderRegistry.class); + when(registry.listReadyLoginMethods()).thenReturn(List.of( + new IdentityProviderLoginMethod( + "cas-main", + "Corporate CAS", + IdentityProviderLoginMethodType.CAS_REDIRECT + ) + )); + + AuthMethodCatalog catalog = new AuthMethodCatalog( + registry, + new DirectAuthProperties(), + new AuthSessionBootstrapProperties() + ); + + assertThat(catalog.listMethods("/skills?sort=updated")) + .filteredOn(method -> "cas-cas-main".equals(method.id())) + .singleElement() + .satisfies(method -> { + assertThat(method.methodType()) + .isEqualTo("CAS_REDIRECT"); + assertThat(method.provider()) + .isEqualTo("cas-main"); + assertThat(method.actionUrl()) + .isEqualTo( + "/api/v1/auth/cas/cas-main/login" + + "?returnTo=%2Fskills%3Fsort%3Dupdated" + ); + }); + } + } diff --git a/server/skillhub-app/src/test/java/com/iflytek/skillhub/service/CasLoginAppServiceTest.java b/server/skillhub-app/src/test/java/com/iflytek/skillhub/service/CasLoginAppServiceTest.java new file mode 100644 index 00000000..c5c3090d --- /dev/null +++ b/server/skillhub-app/src/test/java/com/iflytek/skillhub/service/CasLoginAppServiceTest.java @@ -0,0 +1,298 @@ +package com.iflytek.skillhub.service; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatThrownBy; +import static org.mockito.ArgumentMatchers.any; +import static org.mockito.ArgumentMatchers.isNull; +import static org.mockito.Mockito.inOrder; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.never; +import static org.mockito.Mockito.verify; +import static org.mockito.Mockito.verifyNoInteractions; +import static org.mockito.Mockito.when; + +import com.iflytek.skillhub.auth.cas.CasAuthenticationExchange; +import com.iflytek.skillhub.auth.cas.CasBrowserClient; +import com.iflytek.skillhub.auth.cas.CasLoginInitiation; +import com.iflytek.skillhub.auth.identity.IdentityProviderRegistry; +import com.iflytek.skillhub.auth.identity.ProtocolAuthenticationEvidence; +import com.iflytek.skillhub.auth.identity.ProviderAuthenticationResult; +import com.iflytek.skillhub.auth.identity.SubjectCandidate; +import com.iflytek.skillhub.auth.provider.BrowserAuthenticationAdapter; +import com.iflytek.skillhub.auth.provider.ProviderAuthenticationException; +import com.iflytek.skillhub.auth.provider.ProviderAuthenticationFailureCode; +import com.iflytek.skillhub.auth.rbac.PlatformPrincipal; +import com.iflytek.skillhub.auth.session.PlatformSessionService; +import java.net.URI; +import java.time.Duration; +import java.time.Instant; +import java.util.List; +import java.util.Map; +import java.util.Optional; +import java.util.Set; +import org.junit.jupiter.api.Test; +import org.mockito.InOrder; +import org.springframework.mock.web.MockHttpServletRequest; +import org.springframework.mock.web.MockHttpSession; + +class CasLoginAppServiceTest { + + private static final String PROVIDER = "cas-main"; + private static final String STATE = + "abcdefghijklmnopqrstuvwxyzABCDEF0123456789_-"; + private static final String SERVICE = + "https://skill.example/api/v1/auth/cas/cas-main/callback" + + "?state=" + + STATE; + + @Test + void completesVerifiedExchangeThroughCoreBeforeEstablishingSession() { + Fixture fixture = new Fixture(); + MockHttpServletRequest request = request(); + CasAuthenticationExchange exchange = + new CasAuthenticationExchange( + "user-1", + Map.of(), + Instant.parse("2026-07-31T00:00:00Z")); + ProviderAuthenticationResult result = result(); + PlatformPrincipal principal = principal(); + when(fixture.stateStore.consume( + request.getSession().getId(), + STATE)).thenReturn(Optional.of(loginState())); + when(fixture.protocolClient.validate( + PROVIDER, + "ST-1", + SERVICE)).thenReturn(exchange); + when(fixture.route.adapter()).thenReturn(fixture.adapter); + when(fixture.adapter.authenticate(exchange)) + .thenReturn(result); + when(fixture.providerLogin.authenticate( + isNull(), + org.mockito.ArgumentMatchers.eq(result), + org.mockito.ArgumentMatchers.eq(request))) + .thenReturn(principal); + + assertThat(fixture.service.complete( + PROVIDER, + "ST-1", + STATE, + request)).isEqualTo("/skills"); + + InOrder order = inOrder( + fixture.stateStore, + fixture.registry, + fixture.protocolClient, + fixture.adapter, + fixture.providerLogin, + fixture.sessions); + order.verify(fixture.stateStore).consume( + request.getSession().getId(), + STATE); + order.verify(fixture.registry).requireBrowserRoute( + PROVIDER, + CasAuthenticationExchange.class); + order.verify(fixture.protocolClient).validate( + PROVIDER, + "ST-1", + SERVICE); + order.verify(fixture.adapter).authenticate(exchange); + order.verify(fixture.providerLogin).authenticate( + isNull(), + org.mockito.ArgumentMatchers.eq(result), + org.mockito.ArgumentMatchers.eq(request)); + order.verify(fixture.sessions) + .establishSession(principal, request); + } + + @Test + void beginsWithReadyRouteAndPersistsStateBeforeRedirect() { + Fixture fixture = new Fixture(); + MockHttpServletRequest request = request(); + URI loginUri = URI.create( + "https://cas.example/login?service=fixture"); + when(fixture.protocolClient.begin(PROVIDER, STATE)) + .thenReturn(new CasLoginInitiation( + loginUri, + SERVICE, + Duration.ofMinutes(5))); + + assertThat(fixture.service.begin( + PROVIDER, + "/dashboard", + request)).isEqualTo(loginUri); + + InOrder order = inOrder( + fixture.registry, + fixture.protocolClient, + fixture.stateStore); + order.verify(fixture.registry).requireBrowserRoute( + PROVIDER, + CasAuthenticationExchange.class); + order.verify(fixture.protocolClient).begin( + PROVIDER, + STATE); + order.verify(fixture.stateStore).save( + request.getSession().getId(), + STATE, + PROVIDER, + SERVICE, + "/dashboard", + Duration.ofMinutes(5)); + } + + @Test + void missingOrReplayedStateNeverReachesCasServer() { + Fixture fixture = new Fixture(); + MockHttpServletRequest request = request(); + when(fixture.stateStore.consume( + request.getSession().getId(), + STATE)).thenReturn(Optional.empty()); + + assertThatThrownBy(() -> fixture.service.complete( + PROVIDER, + "ST-1", + STATE, + request)) + .isInstanceOf(CasLoginFlowException.class) + .extracting("failure") + .isEqualTo(CasLoginFailure.INVALID_STATE); + verifyNoInteractions( + fixture.protocolClient, + fixture.adapter, + fixture.providerLogin, + fixture.sessions); + } + + @Test + void missingTicketConsumesStateButNeverCallsProvider() { + Fixture fixture = new Fixture(); + MockHttpServletRequest request = request(); + when(fixture.stateStore.consume( + request.getSession().getId(), + STATE)).thenReturn(Optional.of(loginState())); + + assertThatThrownBy(() -> fixture.service.complete( + PROVIDER, + null, + STATE, + request)) + .isInstanceOf(CasLoginFlowException.class) + .extracting("failure") + .isEqualTo(CasLoginFailure.TICKET_MISSING); + verify(fixture.stateStore).consume( + request.getSession().getId(), + STATE); + verify(fixture.registry, never()).requireBrowserRoute( + any(), + any()); + verifyNoInteractions( + fixture.protocolClient, + fixture.adapter, + fixture.providerLogin, + fixture.sessions); + } + + @Test + void mapsStableUpstreamFailureWithoutCreatingSession() { + Fixture fixture = new Fixture(); + MockHttpServletRequest request = request(); + when(fixture.stateStore.consume( + request.getSession().getId(), + STATE)).thenReturn(Optional.of(loginState())); + when(fixture.protocolClient.validate( + PROVIDER, + "ST-1", + SERVICE)).thenThrow( + new ProviderAuthenticationException( + ProviderAuthenticationFailureCode + .TLS_VALIDATION_FAILED)); + + assertThatThrownBy(() -> fixture.service.complete( + PROVIDER, + "ST-1", + STATE, + request)) + .isInstanceOf(CasLoginFlowException.class) + .extracting("failure") + .isEqualTo(CasLoginFailure.PROVIDER_UNAVAILABLE); + verifyNoInteractions( + fixture.adapter, + fixture.providerLogin, + fixture.sessions); + } + + private static CasLoginStateStore.CasLoginState loginState() { + return new CasLoginStateStore.CasLoginState( + PROVIDER, + SERVICE, + "/skills", + Instant.parse("2026-07-31T00:05:00Z")); + } + + private static ProviderAuthenticationResult result() { + return new ProviderAuthenticationResult( + new SubjectCandidate( + "cas_principal", + "user-1"), + List.of(), + Map.of(), + new ProtocolAuthenticationEvidence( + "cas", + Instant.parse("2026-07-31T00:00:00Z"), + Set.of("cas_service_ticket"))); + } + + private static PlatformPrincipal principal() { + return new PlatformPrincipal( + "usr_cas", + "CAS User", + null, + null, + PROVIDER, + Set.of("USER")); + } + + private static MockHttpServletRequest request() { + MockHttpServletRequest request = + new MockHttpServletRequest(); + request.setSession(new MockHttpSession()); + return request; + } + + private static final class Fixture { + + private final IdentityProviderRegistry registry = + mock(IdentityProviderRegistry.class); + private final CasBrowserClient protocolClient = + mock(CasBrowserClient.class); + private final ProviderLoginAppService providerLogin = + mock(ProviderLoginAppService.class); + private final PlatformSessionService sessions = + mock(PlatformSessionService.class); + private final CasLoginStateStore stateStore = + mock(CasLoginStateStore.class); + @SuppressWarnings("unchecked") + private final IdentityProviderRegistry.BrowserRoute + route = + mock(IdentityProviderRegistry.BrowserRoute.class); + @SuppressWarnings("unchecked") + private final BrowserAuthenticationAdapter + adapter = + mock(BrowserAuthenticationAdapter.class); + private final CasLoginAppService service = + new CasLoginAppService( + registry, + protocolClient, + providerLogin, + sessions, + stateStore, + () -> STATE); + + private Fixture() { + when(registry.requireBrowserRoute( + PROVIDER, + CasAuthenticationExchange.class)) + .thenReturn(route); + } + } +} diff --git a/server/skillhub-app/src/test/java/com/iflytek/skillhub/service/CasLoginStateStoreTest.java b/server/skillhub-app/src/test/java/com/iflytek/skillhub/service/CasLoginStateStoreTest.java new file mode 100644 index 00000000..2aae5aca --- /dev/null +++ b/server/skillhub-app/src/test/java/com/iflytek/skillhub/service/CasLoginStateStoreTest.java @@ -0,0 +1,151 @@ +package com.iflytek.skillhub.service; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatThrownBy; +import static org.mockito.ArgumentMatchers.anyString; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.verify; +import static org.mockito.Mockito.when; + +import com.fasterxml.jackson.databind.ObjectMapper; +import java.time.Clock; +import java.time.Duration; +import java.time.Instant; +import java.time.ZoneOffset; +import org.junit.jupiter.api.Test; +import org.mockito.ArgumentCaptor; +import org.springframework.data.redis.core.StringRedisTemplate; +import org.springframework.data.redis.core.ValueOperations; + +class CasLoginStateStoreTest { + + private static final Instant NOW = + Instant.parse("2026-07-31T00:00:00Z"); + private static final String SESSION_ID = + "session-secret"; + private static final String STATE = + "abcdefghijklmnopqrstuvwxyzABCDEF0123456789_-"; + + @Test + void savesHashedKeyAndConsumesStateAtomically() { + StringRedisTemplate redis = mock( + StringRedisTemplate.class); + @SuppressWarnings("unchecked") + ValueOperations values = + mock(ValueOperations.class); + when(redis.opsForValue()).thenReturn(values); + ObjectMapper objectMapper = new ObjectMapper() + .findAndRegisterModules(); + CasLoginStateStore store = new CasLoginStateStore( + redis, + objectMapper, + Clock.fixed(NOW, ZoneOffset.UTC)); + Duration ttl = Duration.ofMinutes(5); + + store.save( + SESSION_ID, + STATE, + "cas-main", + "https://skill.example/api/v1/auth/cas/cas-main/callback" + + "?state=" + + STATE, + "/dashboard", + ttl); + + ArgumentCaptor key = + ArgumentCaptor.forClass(String.class); + ArgumentCaptor serialized = + ArgumentCaptor.forClass(String.class); + verify(values).set( + key.capture(), + serialized.capture(), + org.mockito.ArgumentMatchers.eq(ttl)); + assertThat(key.getValue()) + .startsWith("skillhub:auth:cas:state:") + .doesNotContain(SESSION_ID) + .doesNotContain(STATE); + + when(values.getAndDelete(key.getValue())) + .thenReturn(serialized.getValue()) + .thenReturn((String) null); + + assertThat(store.consume(SESSION_ID, STATE)) + .get() + .extracting( + CasLoginStateStore.CasLoginState::providerCode, + CasLoginStateStore.CasLoginState::returnTo) + .containsExactly("cas-main", "/dashboard"); + assertThat(store.consume(SESSION_ID, STATE)).isEmpty(); + verify(values, org.mockito.Mockito.times(2)) + .getAndDelete(key.getValue()); + } + + @Test + void rejectsExpiredOrMalformedStateWithoutReturningIt() throws Exception { + StringRedisTemplate redis = mock( + StringRedisTemplate.class); + @SuppressWarnings("unchecked") + ValueOperations values = + mock(ValueOperations.class); + when(redis.opsForValue()).thenReturn(values); + ObjectMapper objectMapper = new ObjectMapper() + .findAndRegisterModules(); + CasLoginStateStore store = new CasLoginStateStore( + redis, + objectMapper, + Clock.fixed(NOW, ZoneOffset.UTC)); + String expired = objectMapper.writeValueAsString( + new CasLoginStateStore.CasLoginState( + "cas-main", + "https://skill.example/callback", + null, + NOW.minusSeconds(1))); + when(values.getAndDelete(anyString())) + .thenReturn(expired); + + assertThat(store.consume(SESSION_ID, STATE)).isEmpty(); + assertThat(store.consume(SESSION_ID, "not valid")).isEmpty(); + } + + @Test + void failsClosedWhenRedisCannotPersistOrConsumeState() { + StringRedisTemplate redis = mock( + StringRedisTemplate.class); + @SuppressWarnings("unchecked") + ValueOperations values = + mock(ValueOperations.class); + when(redis.opsForValue()).thenReturn(values); + CasLoginStateStore store = new CasLoginStateStore( + redis, + new ObjectMapper().findAndRegisterModules(), + Clock.fixed(NOW, ZoneOffset.UTC)); + org.mockito.Mockito.doThrow( + new IllegalStateException("redis unavailable")) + .when(values) + .set( + anyString(), + anyString(), + org.mockito.ArgumentMatchers.any( + Duration.class)); + + assertThatThrownBy(() -> store.save( + SESSION_ID, + STATE, + "cas-main", + "https://skill.example/callback", + null, + Duration.ofMinutes(5))) + .isInstanceOf( + CasLoginStateStore + .CasLoginStateStoreException.class); + + when(values.getAndDelete(anyString())) + .thenThrow(new IllegalStateException( + "redis unavailable")); + assertThatThrownBy( + () -> store.consume(SESSION_ID, STATE)) + .isInstanceOf( + CasLoginStateStore + .CasLoginStateStoreException.class); + } +} diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasAuthenticationAdapter.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasAuthenticationAdapter.java new file mode 100644 index 00000000..c3f17f58 --- /dev/null +++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasAuthenticationAdapter.java @@ -0,0 +1,169 @@ +package com.iflytek.skillhub.auth.cas; + +import com.iflytek.skillhub.auth.identity.EmailAssurance; +import com.iflytek.skillhub.auth.identity.ProtocolAuthenticationEvidence; +import com.iflytek.skillhub.auth.identity.ProviderAttributeTrust; +import com.iflytek.skillhub.auth.identity.ProviderAttributeValue; +import com.iflytek.skillhub.auth.identity.ProviderAuthenticationResult; +import com.iflytek.skillhub.auth.identity.SubjectCandidate; +import com.iflytek.skillhub.auth.provider.BrowserAuthenticationAdapter; +import com.iflytek.skillhub.auth.provider.BrowserAuthenticationMethod; +import com.iflytek.skillhub.auth.provider.ProviderAuthenticationException; +import com.iflytek.skillhub.auth.provider.ProviderAuthenticationFailureCode; +import com.iflytek.skillhub.auth.provider.ProviderInstanceDefinition; +import com.iflytek.skillhub.auth.provider.SubjectNormalization; +import java.util.LinkedHashMap; +import java.util.List; +import java.util.Map; +import java.util.Optional; +import java.util.Set; +import org.springframework.stereotype.Component; + +/** + * Maps one verified CAS exchange into provider facts consumed by the unified + * identity core. + */ +@Component +public final class CasAuthenticationAdapter + implements BrowserAuthenticationAdapter { + + static final String DISPLAY_NAME_ATTRIBUTE = "cas_display_name"; + static final String EMAIL_ATTRIBUTE = "cas_email"; + static final String AVATAR_ATTRIBUTE = "cas_avatar_url"; + private static final int MAX_SUBJECT_LENGTH = 4096; + + private final CasProviderConfiguration configuration; + + CasAuthenticationAdapter( + CasProviderConfiguration configuration) { + this.configuration = configuration; + } + + @Override + public ProviderInstanceDefinition provider() { + if (!configuration.enabled()) { + return new ProviderInstanceDefinition( + "cas", + "cas", + "disabled", + "CAS", + "cas_principal", + "cas_principal", + Map.of( + "cas_principal", + SubjectNormalization.EXACT), + List.of(DISPLAY_NAME_ATTRIBUTE), + List.of(EMAIL_ATTRIBUTE), + List.of(AVATAR_ATTRIBUTE), + EmailAssurance.PROVIDER_ASSERTED, + false); + } + CasProviderConfiguration.ResolvedCasProvider resolved = + configuration.requireResolved(); + return new ProviderInstanceDefinition( + resolved.providerCode(), + "cas", + resolved.authority(), + resolved.displayName(), + resolved.subjectType(), + resolved.subjectType(), + Map.of( + resolved.subjectType(), + SubjectNormalization.EXACT), + List.of(DISPLAY_NAME_ATTRIBUTE), + List.of(EMAIL_ATTRIBUTE), + List.of(AVATAR_ATTRIBUTE), + EmailAssurance.PROVIDER_ASSERTED); + } + + @Override + public Class exchangeType() { + return CasAuthenticationExchange.class; + } + + @Override + public BrowserAuthenticationMethod loginMethod() { + return BrowserAuthenticationMethod.CAS_REDIRECT; + } + + @Override + public ProviderAuthenticationResult authenticate( + CasAuthenticationExchange exchange) { + CasProviderConfiguration.ResolvedCasProvider resolved = + configuration.requireResolved(); + String subject = resolved.subjectAttribute() + .map(attribute -> requireUniqueSubject( + exchange.attributes().get(attribute))) + .orElse(exchange.principal()); + + Map> attributes = + new LinkedHashMap<>(); + putMapped( + attributes, + DISPLAY_NAME_ATTRIBUTE, + resolved.displayNameAttribute(), + exchange.attributes(), + ProviderAttributeTrust.ASSERTED); + putMapped( + attributes, + EMAIL_ATTRIBUTE, + resolved.emailAttribute(), + exchange.attributes(), + ProviderAttributeTrust.ASSERTED); + putMapped( + attributes, + AVATAR_ATTRIBUTE, + resolved.avatarAttribute(), + exchange.attributes(), + ProviderAttributeTrust.ASSERTED); + + return new ProviderAuthenticationResult( + new SubjectCandidate( + resolved.subjectType(), + subject), + List.of(), + attributes, + new ProtocolAuthenticationEvidence( + "cas", + exchange.authenticatedAt(), + Set.of("cas_service_ticket"))); + } + + private String requireUniqueSubject(List values) { + if (values == null || values.size() != 1 + || values.getFirst().isBlank() + || values.getFirst().length() + > MAX_SUBJECT_LENGTH) { + throw new ProviderAuthenticationException( + ProviderAuthenticationFailureCode + .UPSTREAM_INVALID_RESPONSE); + } + return values.getFirst(); + } + + private void putMapped( + Map> target, + String targetKey, + Optional sourceKey, + Map> source, + ProviderAttributeTrust trust) { + if (sourceKey.isEmpty()) { + return; + } + List values = source.get(sourceKey.orElseThrow()); + if (values == null) { + return; + } + String first = values.stream() + .filter(value -> !value.isBlank()) + .findFirst() + .orElse(null); + if (first != null) { + target.put( + targetKey, + List.of(new ProviderAttributeValue( + first, + trust))); + } + } +} diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasAuthenticationExchange.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasAuthenticationExchange.java new file mode 100644 index 00000000..d63bf869 --- /dev/null +++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasAuthenticationExchange.java @@ -0,0 +1,40 @@ +package com.iflytek.skillhub.auth.cas; + +import java.time.Instant; +import java.util.LinkedHashMap; +import java.util.List; +import java.util.Map; +import java.util.Objects; + +/** + * Verified CAS service response. It intentionally contains no service ticket, + * raw response, platform identity, role, or session object. + */ +public record CasAuthenticationExchange( + String principal, + Map> attributes, + Instant authenticatedAt +) { + public CasAuthenticationExchange { + Objects.requireNonNull(principal, "principal"); + Objects.requireNonNull(attributes, "attributes"); + Objects.requireNonNull(authenticatedAt, "authenticatedAt"); + if (principal.isBlank()) { + throw new IllegalArgumentException( + "CAS principal is required"); + } + + LinkedHashMap> copied = + new LinkedHashMap<>(); + attributes.forEach((key, values) -> { + Objects.requireNonNull(key, "CAS attribute key"); + List copiedValues = List.copyOf(values); + if (copiedValues.stream().anyMatch(Objects::isNull)) { + throw new IllegalArgumentException( + "CAS attribute values cannot contain null"); + } + copied.put(key, copiedValues); + }); + attributes = Map.copyOf(copied); + } +} diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasBrowserClient.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasBrowserClient.java new file mode 100644 index 00000000..cb61d344 --- /dev/null +++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasBrowserClient.java @@ -0,0 +1,16 @@ +package com.iflytek.skillhub.auth.cas; + +/** + * Application-facing CAS browser protocol boundary. + */ +public interface CasBrowserClient { + + CasLoginInitiation begin( + String providerCode, + String state); + + CasAuthenticationExchange validate( + String providerCode, + String ticket, + String expectedServiceUrl); +} diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasLoginInitiation.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasLoginInitiation.java new file mode 100644 index 00000000..2eae9bd8 --- /dev/null +++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasLoginInitiation.java @@ -0,0 +1,21 @@ +package com.iflytek.skillhub.auth.cas; + +import java.net.URI; +import java.time.Duration; +import java.util.Objects; + +/** + * First-party CAS login projection and the exact service value that must be + * reused for service-ticket validation. + */ +public record CasLoginInitiation( + URI loginUri, + String serviceUrl, + Duration stateTtl +) { + public CasLoginInitiation { + Objects.requireNonNull(loginUri, "loginUri"); + Objects.requireNonNull(serviceUrl, "serviceUrl"); + Objects.requireNonNull(stateTtl, "stateTtl"); + } +} diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasProperties.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasProperties.java new file mode 100644 index 00000000..164036c8 --- /dev/null +++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasProperties.java @@ -0,0 +1,183 @@ +package com.iflytek.skillhub.auth.cas; + +import java.time.Duration; +import org.springframework.boot.context.properties.ConfigurationProperties; +import org.springframework.stereotype.Component; + +/** + * Static configuration for the built-in CAS provider instance. + */ +@Component +@ConfigurationProperties(prefix = "skillhub.auth.cas") +public class CasProperties { + + private boolean enabled; + private String providerCode = "cas"; + private String displayName = "CAS"; + private String authority; + private String serverUrl; + private String serviceUrl; + private String protocolVersion = "3.0"; + private String subjectType = "cas_principal"; + private boolean allowInsecureForTesting; + private Duration connectTimeout = Duration.ofSeconds(5); + private Duration readTimeout = Duration.ofSeconds(10); + private Duration stateTtl = Duration.ofMinutes(5); + private int maxResponseBytes = 1024 * 1024; + private Attributes attributes = new Attributes(); + + public boolean isEnabled() { + return enabled; + } + + public void setEnabled(boolean enabled) { + this.enabled = enabled; + } + + public String getProviderCode() { + return providerCode; + } + + public void setProviderCode(String providerCode) { + this.providerCode = providerCode; + } + + public String getDisplayName() { + return displayName; + } + + public void setDisplayName(String displayName) { + this.displayName = displayName; + } + + public String getAuthority() { + return authority; + } + + public void setAuthority(String authority) { + this.authority = authority; + } + + public String getServerUrl() { + return serverUrl; + } + + public void setServerUrl(String serverUrl) { + this.serverUrl = serverUrl; + } + + public String getServiceUrl() { + return serviceUrl; + } + + public void setServiceUrl(String serviceUrl) { + this.serviceUrl = serviceUrl; + } + + public String getProtocolVersion() { + return protocolVersion; + } + + public void setProtocolVersion(String protocolVersion) { + this.protocolVersion = protocolVersion; + } + + public String getSubjectType() { + return subjectType; + } + + public void setSubjectType(String subjectType) { + this.subjectType = subjectType; + } + + public boolean isAllowInsecureForTesting() { + return allowInsecureForTesting; + } + + public void setAllowInsecureForTesting( + boolean allowInsecureForTesting) { + this.allowInsecureForTesting = allowInsecureForTesting; + } + + public Duration getConnectTimeout() { + return connectTimeout; + } + + public void setConnectTimeout(Duration connectTimeout) { + this.connectTimeout = connectTimeout; + } + + public Duration getReadTimeout() { + return readTimeout; + } + + public void setReadTimeout(Duration readTimeout) { + this.readTimeout = readTimeout; + } + + public Duration getStateTtl() { + return stateTtl; + } + + public void setStateTtl(Duration stateTtl) { + this.stateTtl = stateTtl; + } + + public int getMaxResponseBytes() { + return maxResponseBytes; + } + + public void setMaxResponseBytes(int maxResponseBytes) { + this.maxResponseBytes = maxResponseBytes; + } + + public Attributes getAttributes() { + return attributes; + } + + public void setAttributes(Attributes attributes) { + this.attributes = attributes == null + ? new Attributes() + : attributes; + } + + public static final class Attributes { + + private String subject; + private String displayName; + private String email; + private String avatarUrl; + + public String getSubject() { + return subject; + } + + public void setSubject(String subject) { + this.subject = subject; + } + + public String getDisplayName() { + return displayName; + } + + public void setDisplayName(String displayName) { + this.displayName = displayName; + } + + public String getEmail() { + return email; + } + + public void setEmail(String email) { + this.email = email; + } + + public String getAvatarUrl() { + return avatarUrl; + } + + public void setAvatarUrl(String avatarUrl) { + this.avatarUrl = avatarUrl; + } + } +} diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasProtocolClient.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasProtocolClient.java new file mode 100644 index 00000000..4163da2c --- /dev/null +++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasProtocolClient.java @@ -0,0 +1,676 @@ +package com.iflytek.skillhub.auth.cas; + +import com.fasterxml.jackson.core.JsonProcessingException; +import com.fasterxml.jackson.databind.JsonNode; +import com.fasterxml.jackson.databind.ObjectMapper; +import com.iflytek.skillhub.auth.provider.ProviderAuthenticationException; +import com.iflytek.skillhub.auth.provider.ProviderAuthenticationFailureCode; +import java.io.IOException; +import java.io.InputStream; +import java.io.StringReader; +import java.net.ConnectException; +import java.net.URI; +import java.net.http.HttpClient; +import java.net.http.HttpRequest; +import java.net.http.HttpResponse; +import java.net.http.HttpTimeoutException; +import java.nio.charset.StandardCharsets; +import java.time.Clock; +import java.time.Duration; +import java.util.ArrayList; +import java.util.LinkedHashMap; +import java.util.List; +import java.util.Map; +import java.util.regex.Pattern; +import javax.net.ssl.SSLException; +import javax.xml.XMLConstants; +import javax.xml.parsers.DocumentBuilderFactory; +import javax.xml.parsers.ParserConfigurationException; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.stereotype.Component; +import org.springframework.web.util.UriComponents; +import org.springframework.web.util.UriComponentsBuilder; +import org.w3c.dom.Element; +import org.w3c.dom.Node; +import org.xml.sax.ErrorHandler; +import org.xml.sax.InputSource; +import org.xml.sax.SAXException; +import org.xml.sax.SAXParseException; + +/** + * CAS redirect construction and service-ticket validation. + * + *

The implementation intentionally does not use Apereo's URL-based + * validator because that client logs the full validation URL and response at + * DEBUG level. The URL contains the one-time service ticket. This client keeps + * transport, parsing and failures credential-free while preserving CAS + * 2.0/3.0 protocol behavior.

+ */ +@Component +public final class CasProtocolClient implements CasBrowserClient { + + private static final int MAX_TICKET_LENGTH = 2048; + private static final int MAX_SERVICE_LENGTH = 4096; + private static final int MAX_ATTRIBUTE_COUNT = 128; + private static final int MAX_VALUES_PER_ATTRIBUTE = 32; + private static final int MAX_ATTRIBUTE_VALUE_LENGTH = 4096; + private static final String CAS_NAMESPACE = + "http://www.yale.edu/tp/cas"; + private static final Pattern STATE_PATTERN = + Pattern.compile("[A-Za-z0-9_-]{32,128}"); + + private final CasProviderConfiguration configuration; + private final ObjectMapper objectMapper; + private final CasValidationTransport transport; + private final Clock clock; + + @Autowired + CasProtocolClient( + CasProviderConfiguration configuration, + ObjectMapper objectMapper) { + this( + configuration, + objectMapper, + JdkCasValidationTransport::exchange, + Clock.systemUTC()); + } + + CasProtocolClient( + CasProviderConfiguration configuration, + ObjectMapper objectMapper, + CasValidationTransport transport, + Clock clock) { + this.configuration = configuration; + this.objectMapper = objectMapper; + this.transport = transport; + this.clock = clock; + } + + @Override + public CasLoginInitiation begin( + String providerCode, + String state) { + CasProviderConfiguration.ResolvedCasProvider resolved = + requireProvider(providerCode); + if (state == null + || !STATE_PATTERN.matcher(state).matches()) { + throw invalidResponse(); + } + + String serviceUrl = resolved.serviceUri().toASCIIString() + + "?state=" + + state; + URI loginEndpoint = appendPath( + resolved.serverUri(), + "/login"); + URI loginUri = UriComponentsBuilder + .fromUri(loginEndpoint) + .queryParam("service", serviceUrl) + .build() + .encode() + .toUri(); + return new CasLoginInitiation( + loginUri, + serviceUrl, + resolved.stateTtl()); + } + + @Override + public CasAuthenticationExchange validate( + String providerCode, + String ticket, + String expectedServiceUrl) { + CasProviderConfiguration.ResolvedCasProvider resolved = + requireProvider(providerCode); + requireTicket(ticket); + requireExpectedService(resolved, expectedServiceUrl); + + URI endpoint = appendPath( + resolved.serverUri(), + resolved.protocolVersion().validationPath()); + UriComponentsBuilder validationUri = + UriComponentsBuilder.fromUri(endpoint) + .queryParam("ticket", ticket) + .queryParam("service", expectedServiceUrl); + if (resolved.protocolVersion().jsonPreferred()) { + validationUri.queryParam("format", "JSON"); + } + + CasValidationResponse response; + try { + response = transport.exchange( + validationUri.build().encode().toUri(), + resolved.connectTimeout(), + resolved.readTimeout(), + resolved.maximumResponseBytes()); + } catch (CasTransportFailure failure) { + throw new ProviderAuthenticationException( + failure.reasonCode()); + } + + requireSuccessStatus(response.statusCode()); + if (response.body() == null || response.body().isBlank()) { + throw invalidResponse(); + } + return parseResponse( + resolved.protocolVersion(), + response.body()); + } + + private CasProviderConfiguration.ResolvedCasProvider requireProvider( + String providerCode) { + CasProviderConfiguration.ResolvedCasProvider resolved; + try { + resolved = configuration.requireResolved(); + } catch (RuntimeException exception) { + throw new ProviderAuthenticationException( + ProviderAuthenticationFailureCode + .UPSTREAM_MISCONFIGURED); + } + if (!resolved.providerCode().equals(providerCode)) { + throw new ProviderAuthenticationException( + ProviderAuthenticationFailureCode + .UPSTREAM_MISCONFIGURED); + } + return resolved; + } + + private void requireTicket(String ticket) { + if (ticket == null + || ticket.isBlank() + || ticket.length() > MAX_TICKET_LENGTH + || ticket.chars().anyMatch(character -> + Character.isISOControl(character) + || Character.isWhitespace(character))) { + throw new ProviderAuthenticationException( + ProviderAuthenticationFailureCode + .UPSTREAM_INVALID_CREDENTIALS); + } + } + + private void requireExpectedService( + CasProviderConfiguration.ResolvedCasProvider resolved, + String expectedServiceUrl) { + if (expectedServiceUrl == null + || expectedServiceUrl.length() > MAX_SERVICE_LENGTH) { + throw invalidResponse(); + } + UriComponents expected; + try { + expected = UriComponentsBuilder + .fromUriString(expectedServiceUrl) + .build(); + } catch (RuntimeException exception) { + throw invalidResponse(); + } + URI base = resolved.serviceUri(); + if (!base.getScheme().equals(expected.getScheme()) + || !base.getHost().equals(expected.getHost()) + || base.getPort() != expected.getPort() + || !base.getPath().equals(expected.getPath()) + || expected.getFragment() != null + || expected.getQueryParams().size() != 1 + || expected.getQueryParams().get("state") == null + || expected.getQueryParams().get("state").size() != 1 + || !STATE_PATTERN.matcher(expected.getQueryParams() + .getFirst("state")).matches()) { + throw invalidResponse(); + } + } + + private void requireSuccessStatus(int statusCode) { + if (statusCode >= 200 && statusCode < 300) { + return; + } + ProviderAuthenticationFailureCode code; + if (statusCode == 401) { + code = ProviderAuthenticationFailureCode + .UPSTREAM_INVALID_CREDENTIALS; + } else if (statusCode == 403) { + code = ProviderAuthenticationFailureCode + .UPSTREAM_ACCESS_DENIED; + } else if (statusCode >= 500) { + code = ProviderAuthenticationFailureCode + .UPSTREAM_UNAVAILABLE; + } else { + code = ProviderAuthenticationFailureCode + .UPSTREAM_INVALID_RESPONSE; + } + throw new ProviderAuthenticationException(code); + } + + private CasAuthenticationExchange parseResponse( + CasProtocolVersion protocolVersion, + String response) { + try { + String stripped = response.stripLeading(); + if (protocolVersion.jsonPreferred() + && stripped.startsWith("{")) { + return parseJson(response); + } + if (stripped.startsWith("<")) { + return parseXml(response); + } + throw invalidResponse(); + } catch (CasAuthenticationFailure failure) { + throw new ProviderAuthenticationException( + failureCode(failure.code())); + } catch (ProviderAuthenticationException exception) { + throw exception; + } catch (RuntimeException exception) { + throw invalidResponse(); + } + } + + private CasAuthenticationExchange parseJson(String response) { + JsonNode root; + try { + root = objectMapper.readTree(response); + } catch (JsonProcessingException exception) { + throw invalidResponse(); + } + JsonNode serviceResponse = root.path("serviceResponse"); + JsonNode success = + serviceResponse.path("authenticationSuccess"); + JsonNode failure = + serviceResponse.path("authenticationFailure"); + if (!success.isMissingNode() && !failure.isMissingNode()) { + throw invalidResponse(); + } + if (!failure.isMissingNode()) { + throw new CasAuthenticationFailure( + textValue(failure.path("code"), "UNKNOWN")); + } + if (!success.isObject()) { + throw invalidResponse(); + } + String principal = requiredText(success.path("user")); + Map> attributes = + parseJsonAttributes(success.path("attributes")); + return new CasAuthenticationExchange( + principal, + attributes, + clock.instant()); + } + + private Map> parseJsonAttributes( + JsonNode attributesNode) { + if (attributesNode.isMissingNode() || attributesNode.isNull()) { + return Map.of(); + } + if (!attributesNode.isObject() + || attributesNode.size() > MAX_ATTRIBUTE_COUNT) { + throw invalidResponse(); + } + Map> attributes = new LinkedHashMap<>(); + attributesNode.fields().forEachRemaining(entry -> { + JsonNode raw = entry.getValue(); + List values = new ArrayList<>(); + if (raw.isValueNode() && !raw.isNull()) { + values.add(scalarValue(raw)); + } else if (raw.isArray() + && raw.size() <= MAX_VALUES_PER_ATTRIBUTE) { + raw.forEach(value -> { + if (!value.isValueNode() || value.isNull()) { + throw invalidResponse(); + } + values.add(scalarValue(value)); + }); + } else { + throw invalidResponse(); + } + attributes.put(entry.getKey(), List.copyOf(values)); + }); + return Map.copyOf(attributes); + } + + private String scalarValue(JsonNode node) { + String value = node.asText(); + if (value.length() > MAX_ATTRIBUTE_VALUE_LENGTH) { + throw invalidResponse(); + } + return value; + } + + private CasAuthenticationExchange parseXml(String response) { + DocumentBuilderFactory factory = + DocumentBuilderFactory.newInstance(); + configureSecureXml(factory); + try { + var builder = factory.newDocumentBuilder(); + builder.setErrorHandler(new StrictXmlErrorHandler()); + var document = builder.parse( + new InputSource(new StringReader(response))); + Element root = document.getDocumentElement(); + if (root == null + || !"serviceResponse".equals( + root.getLocalName()) + || !CAS_NAMESPACE.equals( + root.getNamespaceURI())) { + throw invalidResponse(); + } + List successes = childElements( + root, + "authenticationSuccess"); + List failures = childElements( + root, + "authenticationFailure"); + if (!successes.isEmpty() && !failures.isEmpty()) { + throw invalidResponse(); + } + if (!failures.isEmpty()) { + throw new CasAuthenticationFailure( + failures.getFirst().getAttribute("code")); + } + if (successes.size() != 1) { + throw invalidResponse(); + } + Element success = successes.getFirst(); + List users = childElements(success, "user"); + if (users.size() != 1) { + throw invalidResponse(); + } + String principal = users.getFirst().getTextContent(); + if (principal == null + || principal.isBlank() + || principal.length() + > MAX_ATTRIBUTE_VALUE_LENGTH) { + throw invalidResponse(); + } + List attributesElements = + childElements(success, "attributes"); + if (attributesElements.size() > 1) { + throw invalidResponse(); + } + Map> attributes = + attributesElements.isEmpty() + ? Map.of() + : parseXmlAttributes( + attributesElements.getFirst()); + return new CasAuthenticationExchange( + principal, + attributes, + clock.instant()); + } catch (CasAuthenticationFailure failure) { + throw failure; + } catch (ProviderAuthenticationException exception) { + throw exception; + } catch (Exception exception) { + throw invalidResponse(); + } + } + + private void configureSecureXml( + DocumentBuilderFactory factory) { + factory.setNamespaceAware(true); + factory.setXIncludeAware(false); + factory.setExpandEntityReferences(false); + try { + factory.setFeature( + XMLConstants.FEATURE_SECURE_PROCESSING, + true); + factory.setFeature( + "http://apache.org/xml/features/disallow-doctype-decl", + true); + factory.setFeature( + "http://xml.org/sax/features/external-general-entities", + false); + factory.setFeature( + "http://xml.org/sax/features/external-parameter-entities", + false); + factory.setFeature( + "http://apache.org/xml/features/nonvalidating/load-external-dtd", + false); + factory.setAttribute( + XMLConstants.ACCESS_EXTERNAL_DTD, + ""); + factory.setAttribute( + XMLConstants.ACCESS_EXTERNAL_SCHEMA, + ""); + } catch (ParserConfigurationException + | IllegalArgumentException exception) { + throw invalidResponse(); + } + } + + private Map> parseXmlAttributes( + Element attributesElement) { + Map> attributes = + new LinkedHashMap<>(); + for (Element element : childElements(attributesElement, null)) { + String name = element.getLocalName(); + String value = element.getTextContent(); + if (name == null + || value == null + || value.length() > MAX_ATTRIBUTE_VALUE_LENGTH) { + throw invalidResponse(); + } + List existing = attributes.getOrDefault( + name, + List.of()); + if (existing.size() >= MAX_VALUES_PER_ATTRIBUTE) { + throw invalidResponse(); + } + List values = new ArrayList<>(existing); + values.add(value); + attributes.put(name, List.copyOf(values)); + if (attributes.size() > MAX_ATTRIBUTE_COUNT) { + throw invalidResponse(); + } + } + return Map.copyOf(attributes); + } + + private List childElements( + Element parent, + String localName) { + List elements = new ArrayList<>(); + for (Node node = parent.getFirstChild(); + node != null; + node = node.getNextSibling()) { + if (node instanceof Element element + && (localName == null + || localName.equals(element.getLocalName()) + && CAS_NAMESPACE.equals( + element.getNamespaceURI()))) { + elements.add(element); + } + } + return elements; + } + + private String requiredText(JsonNode node) { + if (!node.isTextual() + || node.textValue().isBlank() + || node.textValue().length() + > MAX_ATTRIBUTE_VALUE_LENGTH) { + throw invalidResponse(); + } + return node.textValue(); + } + + private String textValue( + JsonNode node, + String fallback) { + return node.isTextual() && !node.textValue().isBlank() + ? node.textValue() + : fallback; + } + + private ProviderAuthenticationFailureCode failureCode( + String casCode) { + if ("INVALID_TICKET".equals(casCode)) { + return ProviderAuthenticationFailureCode + .UPSTREAM_INVALID_CREDENTIALS; + } + if ("INVALID_SERVICE".equals(casCode) + || "INVALID_REQUEST".equals(casCode)) { + return ProviderAuthenticationFailureCode + .UPSTREAM_MISCONFIGURED; + } + if ("UNAUTHORIZED_SERVICE".equals(casCode)) { + return ProviderAuthenticationFailureCode + .UPSTREAM_ACCESS_DENIED; + } + return ProviderAuthenticationFailureCode + .UPSTREAM_UNAVAILABLE; + } + + private URI appendPath(URI base, String path) { + String value = base.toASCIIString(); + while (value.endsWith("/")) { + value = value.substring(0, value.length() - 1); + } + return URI.create(value + path); + } + + private ProviderAuthenticationException invalidResponse() { + return new ProviderAuthenticationException( + ProviderAuthenticationFailureCode + .UPSTREAM_INVALID_RESPONSE); + } + + @FunctionalInterface + interface CasValidationTransport { + + CasValidationResponse exchange( + URI uri, + Duration connectTimeout, + Duration readTimeout, + int maximumResponseBytes); + } + + record CasValidationResponse( + int statusCode, + String body + ) { + } + + private static final class CasAuthenticationFailure + extends RuntimeException { + + private final String code; + + private CasAuthenticationFailure(String code) { + super("CAS_AUTHENTICATION_FAILURE"); + this.code = code == null || code.isBlank() + ? "UNKNOWN" + : code; + } + + private String code() { + return code; + } + } + + private static final class CasTransportFailure + extends RuntimeException { + + private final ProviderAuthenticationFailureCode reasonCode; + + private CasTransportFailure( + ProviderAuthenticationFailureCode reasonCode) { + super(reasonCode.name()); + this.reasonCode = reasonCode; + } + + private ProviderAuthenticationFailureCode reasonCode() { + return reasonCode; + } + } + + private static final class JdkCasValidationTransport { + + private JdkCasValidationTransport() { + } + + private static CasValidationResponse exchange( + URI uri, + Duration connectTimeout, + Duration readTimeout, + int maximumResponseBytes) { + HttpClient client = HttpClient.newBuilder() + .connectTimeout(connectTimeout) + .followRedirects(HttpClient.Redirect.NEVER) + .build(); + HttpRequest request = HttpRequest.newBuilder(uri) + .timeout(readTimeout) + .header("Accept", "application/json, application/xml") + .GET() + .build(); + try { + HttpResponse response = client.send( + request, + HttpResponse.BodyHandlers.ofInputStream()); + try (InputStream body = response.body()) { + byte[] bytes = body.readNBytes( + maximumResponseBytes + 1); + if (bytes.length > maximumResponseBytes) { + throw new CasTransportFailure( + ProviderAuthenticationFailureCode + .UPSTREAM_INVALID_RESPONSE); + } + return new CasValidationResponse( + response.statusCode(), + new String( + bytes, + StandardCharsets.UTF_8)); + } + } catch (CasTransportFailure failure) { + throw failure; + } catch (HttpTimeoutException + | ConnectException exception) { + throw new CasTransportFailure( + ProviderAuthenticationFailureCode + .UPSTREAM_UNAVAILABLE); + } catch (IOException exception) { + if (hasTlsCause(exception)) { + throw new CasTransportFailure( + ProviderAuthenticationFailureCode + .TLS_VALIDATION_FAILED); + } + throw new CasTransportFailure( + ProviderAuthenticationFailureCode + .UPSTREAM_UNAVAILABLE); + } catch (InterruptedException exception) { + Thread.currentThread().interrupt(); + throw new CasTransportFailure( + ProviderAuthenticationFailureCode + .UPSTREAM_UNAVAILABLE); + } + } + + private static boolean hasTlsCause(Throwable failure) { + for (Throwable current = failure; + current != null; + current = current.getCause()) { + if (current instanceof SSLException) { + return true; + } + } + return false; + } + } + + private static final class StrictXmlErrorHandler + implements ErrorHandler { + + @Override + public void warning(SAXParseException exception) + throws SAXException { + throw exception; + } + + @Override + public void error(SAXParseException exception) + throws SAXException { + throw exception; + } + + @Override + public void fatalError(SAXParseException exception) + throws SAXException { + throw exception; + } + } +} diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasProtocolVersion.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasProtocolVersion.java new file mode 100644 index 00000000..ceda88c9 --- /dev/null +++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasProtocolVersion.java @@ -0,0 +1,43 @@ +package com.iflytek.skillhub.auth.cas; + +/** + * CAS service-ticket validation endpoint and preferred response format. + */ +public enum CasProtocolVersion { + V2_0("2.0", "/serviceValidate", false), + V3_0("3.0", "/p3/serviceValidate", true); + + private final String wireValue; + private final String validationPath; + private final boolean jsonPreferred; + + CasProtocolVersion( + String wireValue, + String validationPath, + boolean jsonPreferred) { + this.wireValue = wireValue; + this.validationPath = validationPath; + this.jsonPreferred = jsonPreferred; + } + + public String wireValue() { + return wireValue; + } + + String validationPath() { + return validationPath; + } + + boolean jsonPreferred() { + return jsonPreferred; + } + + static CasProtocolVersion parse(String value) { + return switch (value) { + case "2.0" -> V2_0; + case "3.0" -> V3_0; + default -> throw new IllegalArgumentException( + "Unsupported CAS protocol version"); + }; + } +} diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasProviderConfiguration.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasProviderConfiguration.java new file mode 100644 index 00000000..6a0af98d --- /dev/null +++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/CasProviderConfiguration.java @@ -0,0 +1,242 @@ +package com.iflytek.skillhub.auth.cas; + +import java.net.URI; +import java.net.URISyntaxException; +import java.time.Duration; +import java.util.Objects; +import java.util.Optional; +import java.util.regex.Pattern; +import org.springframework.core.env.Environment; +import org.springframework.core.env.Profiles; +import org.springframework.stereotype.Component; + +/** + * Fail-closed resolver for the trusted CAS provider configuration. + */ +@Component +final class CasProviderConfiguration { + + private static final Pattern PROVIDER_CODE_PATTERN = + Pattern.compile("[a-z0-9][a-z0-9._-]{0,63}"); + private static final Pattern AUTHORITY_PATTERN = + Pattern.compile("[a-z0-9][a-z0-9._:-]{0,127}"); + private static final Pattern SUBJECT_TYPE_PATTERN = + Pattern.compile("[a-z][a-z0-9_]{0,63}"); + private static final Pattern ATTRIBUTE_PATTERN = + Pattern.compile("[A-Za-z][A-Za-z0-9_.:-]{0,127}"); + private static final Duration MAX_NETWORK_TIMEOUT = + Duration.ofMinutes(1); + private static final Duration MAX_STATE_TTL = + Duration.ofMinutes(15); + + private final CasProperties properties; + private final Environment environment; + + CasProviderConfiguration( + CasProperties properties, + Environment environment) { + this.properties = properties; + this.environment = environment; + } + + boolean enabled() { + return properties.isEnabled(); + } + + String configuredProviderCode() { + return properties.getProviderCode(); + } + + ResolvedCasProvider requireResolved() { + if (!properties.isEnabled()) { + throw invalidConfiguration(); + } + + String providerCode = requireMatching( + properties.getProviderCode(), + PROVIDER_CODE_PATTERN); + String displayName = requireText( + properties.getDisplayName(), + 128); + String authority = requireMatching( + properties.getAuthority(), + AUTHORITY_PATTERN); + String subjectType = requireMatching( + properties.getSubjectType(), + SUBJECT_TYPE_PATTERN); + URI serverUri = requireEndpoint( + properties.getServerUrl(), + false); + URI serviceUri = requireEndpoint( + properties.getServiceUrl(), + true); + requireCallbackPath(serviceUri, providerCode); + + CasProtocolVersion protocolVersion; + try { + protocolVersion = CasProtocolVersion.parse( + properties.getProtocolVersion()); + } catch (RuntimeException exception) { + throw invalidConfiguration(); + } + + CasProperties.Attributes attributes = + Objects.requireNonNull(properties.getAttributes()); + Optional subjectAttribute = + optionalAttribute(attributes.getSubject()); + Optional displayNameAttribute = + optionalAttribute(attributes.getDisplayName()); + Optional emailAttribute = + optionalAttribute(attributes.getEmail()); + Optional avatarAttribute = + optionalAttribute(attributes.getAvatarUrl()); + + Duration connectTimeout = requireDuration( + properties.getConnectTimeout(), + MAX_NETWORK_TIMEOUT); + Duration readTimeout = requireDuration( + properties.getReadTimeout(), + MAX_NETWORK_TIMEOUT); + Duration stateTtl = requireDuration( + properties.getStateTtl(), + MAX_STATE_TTL); + int maximumResponseBytes = properties.getMaxResponseBytes(); + if (maximumResponseBytes < 1024 + || maximumResponseBytes > 1024 * 1024) { + throw invalidConfiguration(); + } + + return new ResolvedCasProvider( + providerCode, + displayName, + authority, + serverUri, + serviceUri, + protocolVersion, + subjectType, + subjectAttribute, + displayNameAttribute, + emailAttribute, + avatarAttribute, + connectTimeout, + readTimeout, + stateTtl, + maximumResponseBytes); + } + + private URI requireEndpoint( + String value, + boolean service) { + if (value == null || value.isBlank() + || !value.equals(value.strip())) { + throw invalidConfiguration(); + } + URI uri; + try { + uri = new URI(value); + } catch (URISyntaxException exception) { + throw invalidConfiguration(); + } + if (!uri.isAbsolute() + || uri.getHost() == null + || uri.getUserInfo() != null + || uri.getFragment() != null + || uri.getQuery() != null + || uri.getPort() == 0 + || uri.getPort() > 65535) { + throw invalidConfiguration(); + } + String scheme = uri.getScheme(); + if ("https".equalsIgnoreCase(scheme)) { + return uri; + } + if (!"http".equalsIgnoreCase(scheme) + || !properties.isAllowInsecureForTesting() + || !environment.acceptsProfiles(Profiles.of( + "local", + "test", + "staging"))) { + throw invalidConfiguration(); + } + return uri; + } + + private void requireCallbackPath( + URI serviceUri, + String providerCode) { + String expectedSuffix = "/api/v1/auth/cas/" + + providerCode + + "/callback"; + if (!serviceUri.getPath().endsWith(expectedSuffix)) { + throw invalidConfiguration(); + } + } + + private String requireMatching( + String value, + Pattern pattern) { + if (value == null || !pattern.matcher(value).matches()) { + throw invalidConfiguration(); + } + return value; + } + + private String requireText( + String value, + int maximumLength) { + if (value == null + || value.isBlank() + || value.length() > maximumLength + || !value.equals(value.strip())) { + throw invalidConfiguration(); + } + return value; + } + + private Optional optionalAttribute(String value) { + if (value == null || value.isEmpty()) { + return Optional.empty(); + } + if (!value.equals(value.strip()) + || !ATTRIBUTE_PATTERN.matcher(value).matches()) { + throw invalidConfiguration(); + } + return Optional.of(value); + } + + private Duration requireDuration( + Duration value, + Duration maximum) { + if (value == null + || value.isZero() + || value.isNegative() + || value.compareTo(maximum) > 0) { + throw invalidConfiguration(); + } + return value; + } + + private IllegalArgumentException invalidConfiguration() { + return new IllegalArgumentException( + "Invalid CAS provider configuration"); + } + + record ResolvedCasProvider( + String providerCode, + String displayName, + String authority, + URI serverUri, + URI serviceUri, + CasProtocolVersion protocolVersion, + String subjectType, + Optional subjectAttribute, + Optional displayNameAttribute, + Optional emailAttribute, + Optional avatarAttribute, + Duration connectTimeout, + Duration readTimeout, + Duration stateTtl, + int maximumResponseBytes + ) { + } +} diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/package-info.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/package-info.java new file mode 100644 index 00000000..2d8a2ebd --- /dev/null +++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/cas/package-info.java @@ -0,0 +1,4 @@ +/** + * Standard CAS 2.0/3.0 protocol transport and identity-result adapter. + */ +package com.iflytek.skillhub.auth.cas; diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/identity/IdentityProviderLoginMethod.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/identity/IdentityProviderLoginMethod.java index 8fa56fc7..4bf616bb 100644 --- a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/identity/IdentityProviderLoginMethod.java +++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/identity/IdentityProviderLoginMethod.java @@ -33,7 +33,8 @@ public record IdentityProviderLoginMethod( public ProviderCapability capability() { return switch (methodType) { - case OAUTH_REDIRECT -> ProviderCapability.BROWSER; + case OAUTH_REDIRECT, CAS_REDIRECT -> + ProviderCapability.BROWSER; case DIRECT_PASSWORD -> ProviderCapability.CREDENTIAL; case SESSION_BOOTSTRAP -> ProviderCapability.PASSIVE; }; diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/identity/IdentityProviderLoginMethodType.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/identity/IdentityProviderLoginMethodType.java index 7cd2b4e4..2f6e502e 100644 --- a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/identity/IdentityProviderLoginMethodType.java +++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/identity/IdentityProviderLoginMethodType.java @@ -5,6 +5,7 @@ package com.iflytek.skillhub.auth.identity; */ public enum IdentityProviderLoginMethodType { OAUTH_REDIRECT, + CAS_REDIRECT, DIRECT_PASSWORD, SESSION_BOOTSTRAP } diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/identity/IdentityProviderRegistry.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/identity/IdentityProviderRegistry.java index 30c279ee..73292642 100644 --- a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/identity/IdentityProviderRegistry.java +++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/identity/IdentityProviderRegistry.java @@ -1,5 +1,6 @@ package com.iflytek.skillhub.auth.identity; +import com.iflytek.skillhub.auth.provider.BrowserAuthenticationAdapter; import com.iflytek.skillhub.auth.provider.CredentialAuthenticationAdapter; import com.iflytek.skillhub.auth.provider.PassiveAuthenticationAdapter; import java.util.List; @@ -13,10 +14,38 @@ public interface IdentityProviderRegistry extends IdentityProviderCatalog { List listReadyLoginMethods(); + BrowserRoute requireBrowserRoute( + String providerCode, + Class exchangeType); + CredentialRoute requireCredentialRoute(String providerCode); PassiveRoute requirePassiveRoute(String providerCode); + class BrowserRoute { + private final ResolvedProviderHandle provider; + private final BrowserAuthenticationAdapter adapter; + + public BrowserRoute( + ResolvedProviderHandle provider, + BrowserAuthenticationAdapter adapter) { + this.provider = Objects.requireNonNull( + provider, + "provider"); + this.adapter = Objects.requireNonNull( + adapter, + "adapter"); + } + + public ResolvedProviderHandle provider() { + return provider; + } + + public BrowserAuthenticationAdapter adapter() { + return adapter; + } + } + class CredentialRoute { private final ResolvedProviderHandle provider; private final CredentialAuthenticationAdapter adapter; diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/identity/ReconciledIdentityProviderCatalog.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/identity/ReconciledIdentityProviderCatalog.java index 8de8fcf0..99db2dbd 100644 --- a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/identity/ReconciledIdentityProviderCatalog.java +++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/identity/ReconciledIdentityProviderCatalog.java @@ -1,5 +1,7 @@ package com.iflytek.skillhub.auth.identity; +import com.iflytek.skillhub.auth.provider.BrowserAuthenticationAdapter; +import com.iflytek.skillhub.auth.provider.BrowserAuthenticationMethod; import com.iflytek.skillhub.auth.provider.CredentialAuthenticationAdapter; import com.iflytek.skillhub.auth.provider.PassiveAuthenticationAdapter; import com.iflytek.skillhub.auth.provider.ProviderInstanceDefinition; @@ -42,6 +44,7 @@ class ReconciledIdentityProviderCatalog private final ProviderAuthorityLockService authorityLockService; private final IdentityBindingPreflightService bindingPreflightService; private final IdentityProviderPolicyProperties policyProperties; + private final List> browserAdapters; private final List credentialAdapters; private final List passiveAdapters; private final AtomicReference snapshot = @@ -52,12 +55,14 @@ class ReconciledIdentityProviderCatalog ProviderAuthorityLockService authorityLockService, IdentityBindingPreflightService bindingPreflightService, IdentityProviderPolicyProperties policyProperties, + List> browserAdapters, List credentialAdapters, List passiveAdapters) { this.descriptorSource = descriptorSource; this.authorityLockService = authorityLockService; this.bindingPreflightService = bindingPreflightService; this.policyProperties = policyProperties; + this.browserAdapters = List.copyOf(browserAdapters); this.credentialAdapters = List.copyOf(credentialAdapters); this.passiveAdapters = List.copyOf(passiveAdapters); } @@ -97,7 +102,9 @@ class ReconciledIdentityProviderCatalog private RegistrySnapshot assembleSnapshot() { Map descriptors = new LinkedHashMap<>(); - Set browserProviders = new HashSet<>(); + Set oauthBrowserProviders = new HashSet<>(); + Map> browsers = + new LinkedHashMap<>(); Map credentials = new LinkedHashMap<>(); Map passives = @@ -111,7 +118,7 @@ class ReconciledIdentityProviderCatalog descriptors, invalidProviders, descriptor); - browserProviders.add(descriptor.providerCode()); + oauthBrowserProviders.add(descriptor.providerCode()); } } catch (RuntimeException exception) { log.error( @@ -121,6 +128,37 @@ class ReconciledIdentityProviderCatalog exception.getClass().getSimpleName()); } + for (BrowserAuthenticationAdapter adapter + : browserAdapters) { + try { + ProviderInstanceDefinition definition = + adapter.provider(); + if (!definition.enabled()) { + continue; + } + ProviderDescriptor descriptor = + descriptorFrom(definition); + registerDescriptor( + descriptors, + invalidProviders, + descriptor); + BrowserRegistration previous = browsers.putIfAbsent( + descriptor.providerCode(), + new BrowserRegistration<>( + adapter, + definition.displayName())); + if (previous != null) { + invalidProviders.add(descriptor.providerCode()); + } + } catch (RuntimeException exception) { + log.warn( + "Browser provider adapter is hidden because its trusted definition is invalid"); + log.debug( + "Browser provider definition failure type: {}", + exception.getClass().getSimpleName()); + } + } + for (CredentialAuthenticationAdapter adapter : credentialAdapters) { try { @@ -184,7 +222,8 @@ class ReconciledIdentityProviderCatalog for (String providerCode : invalidProviders) { descriptors.remove(providerCode); - browserProviders.remove(providerCode); + oauthBrowserProviders.remove(providerCode); + browsers.remove(providerCode); credentials.remove(providerCode); passives.remove(providerCode); log.error( @@ -194,7 +233,8 @@ class ReconciledIdentityProviderCatalog return new RegistrySnapshot( Map.copyOf(descriptors), - Set.copyOf(browserProviders), + Set.copyOf(oauthBrowserProviders), + Map.copyOf(browsers), Map.copyOf(credentials), Map.copyOf(passives)); } @@ -269,7 +309,7 @@ class ReconciledIdentityProviderCatalog return current.descriptors().values().stream() .sorted(Comparator.comparing( ProviderDescriptor::providerCode)) - .filter(descriptor -> current.browserProviders() + .filter(descriptor -> current.oauthBrowserProviders() .contains(descriptor.providerCode())) .filter(this::isCurrentlyReady) .map(descriptor -> loginMethod( @@ -294,12 +334,20 @@ class ReconciledIdentityProviderCatalog continue; } String providerCode = descriptor.providerCode(); - if (current.browserProviders().contains(providerCode)) { + if (current.oauthBrowserProviders().contains(providerCode)) { methods.add(loginMethod( providerCode, descriptor.displayName(), IdentityProviderLoginMethodType.OAUTH_REDIRECT)); } + BrowserRegistration browser = + current.browsers().get(providerCode); + if (browser != null) { + methods.add(loginMethod( + providerCode, + browser.displayName(), + methodType(browser.adapter().loginMethod()))); + } CredentialRegistration credential = current.credentials().get(providerCode); if (credential != null) { @@ -320,6 +368,24 @@ class ReconciledIdentityProviderCatalog return List.copyOf(methods); } + @Override + public BrowserRoute requireBrowserRoute( + String providerCode, + Class exchangeType) { + RegistrySnapshot current = snapshot.get(); + ProviderDescriptor descriptor = + requireReadyDescriptor(current, providerCode); + BrowserRegistration registration = + current.browsers().get(providerCode); + if (registration == null + || !registration.adapter() + .exchangeType() + .equals(exchangeType)) { + throw providerDisabled(); + } + return browserRoute(descriptor, registration, exchangeType); + } + @Override public CredentialRoute requireCredentialRoute( String providerCode) { @@ -359,7 +425,7 @@ class ReconciledIdentityProviderCatalog String providerCode = descriptorSource.resolveBrowserProviderCode(registration); RegistrySnapshot current = snapshot.get(); - if (!current.browserProviders().contains(providerCode)) { + if (!current.oauthBrowserProviders().contains(providerCode)) { throw providerDisabled(); } ProviderDescriptor descriptor = @@ -418,6 +484,32 @@ class ReconciledIdentityProviderCatalog methodType); } + private IdentityProviderLoginMethodType methodType( + BrowserAuthenticationMethod method) { + return switch (method) { + case OAUTH_REDIRECT -> + IdentityProviderLoginMethodType.OAUTH_REDIRECT; + case CAS_REDIRECT -> + IdentityProviderLoginMethodType.CAS_REDIRECT; + }; + } + + @SuppressWarnings("unchecked") + private BrowserRoute browserRoute( + ProviderDescriptor descriptor, + BrowserRegistration registration, + Class exchangeType) { + BrowserAuthenticationAdapter adapter = + registration.adapter(); + if (!adapter.exchangeType().equals(exchangeType)) { + throw providerDisabled(); + } + return new BrowserRoute<>( + new DefaultResolvedProviderHandle( + descriptor.providerCode()), + (BrowserAuthenticationAdapter) adapter); + } + private boolean isCurrentlyReady(ProviderDescriptor descriptor) { try { authorityLockService.requirePinnedAuthority(descriptor); @@ -436,6 +528,11 @@ class ReconciledIdentityProviderCatalog IdentityFailureCode.PROVIDER_DISABLED); } + private record BrowserRegistration( + BrowserAuthenticationAdapter adapter, + String displayName) { + } + private record CredentialRegistration( CredentialAuthenticationAdapter adapter, String displayName) { @@ -448,7 +545,8 @@ class ReconciledIdentityProviderCatalog private record RegistrySnapshot( Map descriptors, - Set browserProviders, + Set oauthBrowserProviders, + Map> browsers, Map credentials, Map passives ) { @@ -457,6 +555,7 @@ class ReconciledIdentityProviderCatalog Map.of(), Set.of(), Map.of(), + Map.of(), Map.of()); } } diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/oauth/OAuthClaimsExtractor.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/oauth/OAuthClaimsExtractor.java index b32c3678..f0651d35 100644 --- a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/oauth/OAuthClaimsExtractor.java +++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/oauth/OAuthClaimsExtractor.java @@ -1,21 +1,22 @@ package com.iflytek.skillhub.auth.oauth; import com.iflytek.skillhub.auth.identity.ProviderAuthenticationResult; -import com.iflytek.skillhub.auth.provider.BrowserAuthenticationAdapter; import org.springframework.security.oauth2.client.userinfo.OAuth2UserRequest; import org.springframework.security.oauth2.core.user.OAuth2User; /** * Strategy interface for converting provider-specific OAuth user payloads into normalized claims. + * + *

The Spring Security client registration remains the registered browser + * provider. This extractor only maps its already verified exchange and is not + * independently routable.

*/ -public interface OAuthClaimsExtractor - extends BrowserAuthenticationAdapter { +public interface OAuthClaimsExtractor { String getProvider(); ProviderAuthenticationResult extract( OAuth2UserRequest request, OAuth2User oAuth2User); - @Override default ProviderAuthenticationResult authenticate( OAuthAuthenticationExchange exchange) { return extract(exchange.request(), exchange.user()); diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/policy/RouteSecurityPolicyRegistry.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/policy/RouteSecurityPolicyRegistry.java index c4c52fff..8beb7a3c 100644 --- a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/policy/RouteSecurityPolicyRegistry.java +++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/policy/RouteSecurityPolicyRegistry.java @@ -25,6 +25,7 @@ public class RouteSecurityPolicyRegistry { RouteAuthorizationPolicy.permitAll(null, "/api/v1/auth/me"), RouteAuthorizationPolicy.permitAll(null, "/api/v1/auth/session/bootstrap"), RouteAuthorizationPolicy.permitAll(null, "/api/v1/auth/direct/login"), + RouteAuthorizationPolicy.permitAll(HttpMethod.GET, "/api/v1/auth/cas/**"), RouteAuthorizationPolicy.permitAll(null, "/api/v1/auth/local/**"), RouteAuthorizationPolicy.permitAll(null, "/api/v1/auth/device/**"), RouteAuthorizationPolicy.permitAll(null, "/api/v1/check"), diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/provider/BrowserAuthenticationAdapter.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/provider/BrowserAuthenticationAdapter.java index ed72c081..e0bdd651 100644 --- a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/provider/BrowserAuthenticationAdapter.java +++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/provider/BrowserAuthenticationAdapter.java @@ -11,6 +11,12 @@ import com.iflytek.skillhub.auth.identity.ProviderAuthenticationResult; */ public interface BrowserAuthenticationAdapter { + ProviderInstanceDefinition provider(); + + Class exchangeType(); + + BrowserAuthenticationMethod loginMethod(); + /** * @throws ProviderAuthenticationException when the verified exchange * cannot be accepted or its upstream is unavailable diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/provider/BrowserAuthenticationMethod.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/provider/BrowserAuthenticationMethod.java new file mode 100644 index 00000000..44d06651 --- /dev/null +++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/provider/BrowserAuthenticationMethod.java @@ -0,0 +1,10 @@ +package com.iflytek.skillhub.auth.provider; + +/** + * Core-recognized browser interaction used to project a fixed first-party + * login route. Adapters do not provide arbitrary action URLs. + */ +public enum BrowserAuthenticationMethod { + OAUTH_REDIRECT, + CAS_REDIRECT +} diff --git a/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/cas/CasAuthenticationAdapterTest.java b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/cas/CasAuthenticationAdapterTest.java new file mode 100644 index 00000000..3fa585d2 --- /dev/null +++ b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/cas/CasAuthenticationAdapterTest.java @@ -0,0 +1,143 @@ +package com.iflytek.skillhub.auth.cas; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatThrownBy; + +import com.iflytek.skillhub.auth.identity.EmailAssurance; +import com.iflytek.skillhub.auth.identity.ProviderAttributeTrust; +import com.iflytek.skillhub.auth.provider.ProviderAuthenticationException; +import com.iflytek.skillhub.auth.provider.ProviderAuthenticationFailureCode; +import com.iflytek.skillhub.auth.provider.ProviderConformanceKit; +import java.io.IOException; +import java.time.Instant; +import java.util.List; +import java.util.Map; +import org.junit.jupiter.api.Test; + +class CasAuthenticationAdapterTest { + + @Test + void mapsVerifiedPrincipalAndOnlyConfiguredProfileAttributes() + throws IOException { + CasProperties properties = + CasTestConfiguration.validProperties(); + properties.getAttributes().setDisplayName("cn"); + properties.getAttributes().setEmail("mail"); + CasAuthenticationAdapter adapter = + new CasAuthenticationAdapter( + CasTestConfiguration.configuration(properties)); + CasAuthenticationExchange exchange = + new CasAuthenticationExchange( + "alice-123", + Map.of( + "cn", + List.of("Alice"), + "mail", + List.of("alice@example.com"), + "unmapped", + List.of("must-not-leak")), + Instant.parse("2026-07-31T00:00:00Z")); + + var result = ProviderConformanceKit.verifyBrowser( + adapter, + exchange); + + assertThat(result.primarySubject().type()) + .isEqualTo("cas_principal"); + assertThat(result.primarySubject().value()) + .isEqualTo("alice-123"); + assertThat(result.attributes()) + .containsOnlyKeys( + CasAuthenticationAdapter + .DISPLAY_NAME_ATTRIBUTE, + CasAuthenticationAdapter.EMAIL_ATTRIBUTE); + assertThat(result.attributes() + .get(CasAuthenticationAdapter.EMAIL_ATTRIBUTE) + .getFirst() + .trust()).isEqualTo( + ProviderAttributeTrust.ASSERTED); + assertThat(adapter.provider().emailAssuranceLimit()) + .isEqualTo(EmailAssurance.PROVIDER_ASSERTED); + ProviderConformanceKit.verifyAdapterBoundary( + CasAuthenticationAdapter.class); + } + + @Test + void explicitlyConfiguredImmutableAttributeBecomesSubject() { + CasProperties properties = + CasTestConfiguration.validProperties(); + properties.setSubjectType("cas_employee_id"); + properties.getAttributes().setSubject("employeeId"); + CasAuthenticationAdapter adapter = + new CasAuthenticationAdapter( + CasTestConfiguration.configuration(properties)); + + var result = adapter.authenticate( + new CasAuthenticationExchange( + "mutable-login", + Map.of( + "employeeId", + List.of("employee-42")), + Instant.parse("2026-07-31T00:00:00Z"))); + + assertThat(result.primarySubject().type()) + .isEqualTo("cas_employee_id"); + assertThat(result.primarySubject().value()) + .isEqualTo("employee-42"); + } + + @Test + void missingOrAmbiguousConfiguredSubjectFailsClosed() { + CasProperties properties = + CasTestConfiguration.validProperties(); + properties.setSubjectType("cas_employee_id"); + properties.getAttributes().setSubject("employeeId"); + CasAuthenticationAdapter adapter = + new CasAuthenticationAdapter( + CasTestConfiguration.configuration(properties)); + + assertThatThrownBy(() -> adapter.authenticate( + new CasAuthenticationExchange( + "alice", + Map.of(), + Instant.parse("2026-07-31T00:00:00Z")))) + .isInstanceOf(ProviderAuthenticationException.class) + .extracting("reasonCode") + .isEqualTo(ProviderAuthenticationFailureCode + .UPSTREAM_INVALID_RESPONSE); + + assertThatThrownBy(() -> adapter.authenticate( + new CasAuthenticationExchange( + "alice", + Map.of( + "employeeId", + List.of("one", "two")), + Instant.parse("2026-07-31T00:00:00Z")))) + .isInstanceOf(ProviderAuthenticationException.class) + .extracting("reasonCode") + .isEqualTo(ProviderAuthenticationFailureCode + .UPSTREAM_INVALID_RESPONSE); + + assertThatThrownBy(() -> adapter.authenticate( + new CasAuthenticationExchange( + "alice", + Map.of( + "employeeId", + List.of("x".repeat(4097))), + Instant.parse("2026-07-31T00:00:00Z")))) + .isInstanceOf(ProviderAuthenticationException.class) + .extracting("reasonCode") + .isEqualTo(ProviderAuthenticationFailureCode + .UPSTREAM_INVALID_RESPONSE); + } + + @Test + void disabledAdapterHasNoRoutableDefinition() { + CasProperties properties = new CasProperties(); + CasAuthenticationAdapter adapter = + new CasAuthenticationAdapter( + CasTestConfiguration.configuration(properties)); + + assertThat(adapter.provider().enabled()).isFalse(); + } +} diff --git a/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/cas/CasProtocolClientHttpIntegrationTest.java b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/cas/CasProtocolClientHttpIntegrationTest.java new file mode 100644 index 00000000..99fc5be1 --- /dev/null +++ b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/cas/CasProtocolClientHttpIntegrationTest.java @@ -0,0 +1,190 @@ +package com.iflytek.skillhub.auth.cas; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatThrownBy; + +import com.fasterxml.jackson.databind.ObjectMapper; +import com.iflytek.skillhub.auth.provider.ProviderAuthenticationException; +import com.iflytek.skillhub.auth.provider.ProviderAuthenticationFailureCode; +import com.sun.net.httpserver.HttpExchange; +import com.sun.net.httpserver.HttpServer; +import java.io.IOException; +import java.net.InetAddress; +import java.net.InetSocketAddress; +import java.net.URLDecoder; +import java.nio.charset.StandardCharsets; +import java.util.concurrent.atomic.AtomicInteger; +import java.util.concurrent.atomic.AtomicReference; +import org.junit.jupiter.api.AfterEach; +import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Test; +import org.springframework.mock.env.MockEnvironment; +import org.springframework.web.util.UriComponentsBuilder; + +class CasProtocolClientHttpIntegrationTest { + + private static final String STATE = + "abcdefghijklmnopqrstuvwxyz0123456789_ABCD"; + + private HttpServer server; + + @BeforeEach + void startServer() throws IOException { + server = HttpServer.create( + new InetSocketAddress( + InetAddress.getLoopbackAddress(), + 0), + 0); + server.start(); + } + + @AfterEach + void stopServer() { + server.stop(0); + } + + @Test + void validatesWithTheRealTransportAndExactServiceQuery() + throws IOException { + AtomicReference rawQuery = new AtomicReference<>(); + server.createContext( + "/cas/p3/serviceValidate", + exchange -> { + rawQuery.set(exchange.getRequestURI().getRawQuery()); + respond( + exchange, + 200, + """ + { + "serviceResponse": { + "authenticationSuccess": { + "user": "alice" + } + } + } + """); + }); + + CasProtocolClient client = client(1024); + String service = client.begin( + "cas-main", + STATE).serviceUrl(); + + CasAuthenticationExchange authentication = client.validate( + "cas-main", + "ST-real-transport", + service); + + assertThat(authentication.principal()).isEqualTo("alice"); + var query = UriComponentsBuilder + .fromUriString("http://localhost/?" + rawQuery.get()) + .build() + .getQueryParams(); + assertThat(query.getFirst("ticket")) + .isEqualTo("ST-real-transport"); + assertThat(decode(query.getFirst("service"))) + .isEqualTo(service); + assertThat(query.getFirst("format")).isEqualTo("JSON"); + } + + @Test + void realTransportNeverFollowsRedirects() throws IOException { + AtomicInteger redirectedRequests = new AtomicInteger(); + server.createContext( + "/cas/p3/serviceValidate", + exchange -> { + exchange.getResponseHeaders().add( + "Location", + "/cas/redirected"); + exchange.sendResponseHeaders(302, -1); + exchange.close(); + }); + server.createContext( + "/cas/redirected", + exchange -> { + redirectedRequests.incrementAndGet(); + respond( + exchange, + 200, + """ + { + "serviceResponse": { + "authenticationSuccess": { + "user": "redirected" + } + } + } + """); + }); + + CasProtocolClient client = client(1024); + + assertThatThrownBy(() -> client.validate( + "cas-main", + "ST-no-redirect", + client.begin("cas-main", STATE).serviceUrl())) + .isInstanceOf(ProviderAuthenticationException.class) + .extracting("reasonCode") + .isEqualTo(ProviderAuthenticationFailureCode + .UPSTREAM_INVALID_RESPONSE); + assertThat(redirectedRequests).hasValue(0); + } + + @Test + void realTransportRejectsOversizedResponses() { + server.createContext( + "/cas/p3/serviceValidate", + exchange -> respond( + exchange, + 200, + "x".repeat(1025))); + + CasProtocolClient client = client(1024); + + assertThatThrownBy(() -> client.validate( + "cas-main", + "ST-oversized", + client.begin("cas-main", STATE).serviceUrl())) + .isInstanceOf(ProviderAuthenticationException.class) + .extracting("reasonCode") + .isEqualTo(ProviderAuthenticationFailureCode + .UPSTREAM_INVALID_RESPONSE); + } + + private CasProtocolClient client(int maximumResponseBytes) { + CasProperties properties = + CasTestConfiguration.validProperties(); + properties.setAllowInsecureForTesting(true); + properties.setServerUrl( + "http://127.0.0.1:" + + server.getAddress().getPort() + + "/cas"); + properties.setServiceUrl( + "http://skillhub.test/api/v1/auth/cas/cas-main/callback"); + properties.setMaxResponseBytes(maximumResponseBytes); + MockEnvironment environment = new MockEnvironment(); + environment.setActiveProfiles("test"); + return new CasProtocolClient( + new CasProviderConfiguration( + properties, + environment), + new ObjectMapper()); + } + + private void respond( + HttpExchange exchange, + int status, + String response) throws IOException { + byte[] bytes = response.getBytes(StandardCharsets.UTF_8); + exchange.sendResponseHeaders(status, bytes.length); + try (var body = exchange.getResponseBody()) { + body.write(bytes); + } + } + + private String decode(String value) { + return URLDecoder.decode( + value, + StandardCharsets.UTF_8); + } +} diff --git a/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/cas/CasProtocolClientTest.java b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/cas/CasProtocolClientTest.java new file mode 100644 index 00000000..238e38be --- /dev/null +++ b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/cas/CasProtocolClientTest.java @@ -0,0 +1,350 @@ +package com.iflytek.skillhub.auth.cas; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatThrownBy; + +import com.fasterxml.jackson.databind.ObjectMapper; +import com.iflytek.skillhub.auth.provider.ProviderAuthenticationException; +import com.iflytek.skillhub.auth.provider.ProviderAuthenticationFailureCode; +import java.net.URI; +import java.net.URLDecoder; +import java.nio.charset.StandardCharsets; +import java.time.Clock; +import java.time.Instant; +import java.time.ZoneOffset; +import java.util.List; +import java.util.concurrent.atomic.AtomicReference; +import org.junit.jupiter.api.Test; +import org.springframework.web.util.UriComponentsBuilder; + +class CasProtocolClientTest { + + private static final String STATE = + "abcdefghijklmnopqrstuvwxyz0123456789_ABCD"; + private static final Instant AUTHENTICATED_AT = + Instant.parse("2026-07-31T00:00:00Z"); + + @Test + void beginsWithCoreGeneratedLoginRouteAndExactStateBoundService() { + CasProtocolClient client = client((uri, connect, read, maximum) -> + new CasProtocolClient.CasValidationResponse( + 500, + "")); + + CasLoginInitiation initiation = + client.begin("cas-main", STATE); + + assertThat(initiation.serviceUrl()).isEqualTo( + "https://skillhub.example.com/api/v1/auth/cas/cas-main/callback?state=" + + STATE); + assertThat(initiation.loginUri().getPath()) + .isEqualTo("/cas/login"); + assertThat(UriComponentsBuilder + .fromUri(initiation.loginUri()) + .build() + .getQueryParams() + .getFirst("service")) + .satisfies(value -> assertThat(decode(value)) + .isEqualTo(initiation.serviceUrl())); + } + + @Test + void validatesCas30JsonAgainstTheExactServiceUrl() { + AtomicReference requested = new AtomicReference<>(); + CasProtocolClient client = client((uri, connect, read, maximum) -> { + requested.set(uri); + return new CasProtocolClient.CasValidationResponse( + 200, + """ + { + "serviceResponse": { + "authenticationSuccess": { + "user": "alice", + "attributes": { + "cn": "Alice", + "memberOf": ["engineering", "reviewers"] + } + } + } + } + """); + }); + String service = client.begin( + "cas-main", + STATE).serviceUrl(); + + CasAuthenticationExchange exchange = client.validate( + "cas-main", + "ST-123", + service); + + assertThat(exchange.principal()).isEqualTo("alice"); + assertThat(exchange.attributes().get("memberOf")) + .containsExactly("engineering", "reviewers"); + assertThat(exchange.authenticatedAt()) + .isEqualTo(AUTHENTICATED_AT); + var query = UriComponentsBuilder + .fromUri(requested.get()) + .build() + .getQueryParams(); + assertThat(query.getFirst("ticket")).isEqualTo("ST-123"); + assertThat(decode(query.getFirst("service"))) + .isEqualTo(service); + assertThat(query.getFirst("format")).isEqualTo("JSON"); + } + + @Test + void parsesCas20XmlAndPreservesRepeatedAttributes() { + CasProperties properties = + CasTestConfiguration.validProperties(); + properties.setProtocolVersion("2.0"); + CasProtocolClient client = client( + properties, + (uri, connect, read, maximum) -> + new CasProtocolClient.CasValidationResponse( + 200, + """ + + + + alice + + engineering + reviewers + + + + """)); + + CasAuthenticationExchange exchange = client.validate( + "cas-main", + "ST-20", + client.begin("cas-main", STATE).serviceUrl()); + + assertThat(exchange.attributes().get("memberOf")) + .containsExactly("engineering", "reviewers"); + } + + @Test + void cas30AcceptsStandardsCompatibleXmlFallback() { + CasProtocolClient client = client((uri, connect, read, maximum) -> + new CasProtocolClient.CasValidationResponse( + 200, + """ + + + alice + + + """)); + + assertThat(client.validate( + "cas-main", + "ST-xml", + client.begin("cas-main", STATE).serviceUrl()) + .principal()).isEqualTo("alice"); + } + + @Test + void invalidStateBoundServiceNeverReachesTheCasServer() { + AtomicReference requested = new AtomicReference<>(); + CasProtocolClient client = client((uri, connect, read, maximum) -> { + requested.set(uri); + return new CasProtocolClient.CasValidationResponse( + 200, + ""); + }); + + assertThatThrownBy(() -> client.validate( + "cas-main", + "ST-123", + "https://evil.example/callback?state=" + STATE)) + .isInstanceOf(ProviderAuthenticationException.class) + .extracting("reasonCode") + .isEqualTo(ProviderAuthenticationFailureCode + .UPSTREAM_INVALID_RESPONSE); + assertThat(requested.get()).isNull(); + } + + @Test + void classifiesCasFailuresWithoutLeakingTicket() { + CasProtocolClient client = client((uri, connect, read, maximum) -> + new CasProtocolClient.CasValidationResponse( + 200, + """ + { + "serviceResponse": { + "authenticationFailure": { + "code": "INVALID_TICKET", + "description": "ticket rejected" + } + } + } + """)); + + assertThatThrownBy(() -> client.validate( + "cas-main", + "ST-secret-value", + client.begin("cas-main", STATE).serviceUrl())) + .isInstanceOf(ProviderAuthenticationException.class) + .hasMessage( + ProviderAuthenticationFailureCode + .UPSTREAM_INVALID_CREDENTIALS + .name()) + .hasMessageNotContaining("ST-secret-value") + .extracting("reasonCode") + .isEqualTo(ProviderAuthenticationFailureCode + .UPSTREAM_INVALID_CREDENTIALS); + } + + @Test + void rejectsXxeBeforeIdentityMapping() { + CasProperties properties = + CasTestConfiguration.validProperties(); + properties.setProtocolVersion("2.0"); + CasProtocolClient client = client( + properties, + (uri, connect, read, maximum) -> + new CasProtocolClient.CasValidationResponse( + 200, + """ + + + ]> + + + &xxe; + + + """)); + + assertThatThrownBy(() -> client.validate( + "cas-main", + "ST-xxe", + client.begin("cas-main", STATE).serviceUrl())) + .isInstanceOf(ProviderAuthenticationException.class) + .hasMessageNotContaining("root:") + .extracting("reasonCode") + .isEqualTo(ProviderAuthenticationFailureCode + .UPSTREAM_INVALID_RESPONSE); + } + + @Test + void rejectsWrongXmlNamespaceAndOversizedPrincipal() { + CasProperties properties = + CasTestConfiguration.validProperties(); + properties.setProtocolVersion("2.0"); + CasProtocolClient wrongNamespace = client( + properties, + (uri, connect, read, maximum) -> + new CasProtocolClient.CasValidationResponse( + 200, + """ + + + alice + + + """)); + + assertThatThrownBy(() -> wrongNamespace.validate( + "cas-main", + "ST-wrong-namespace", + wrongNamespace.begin( + "cas-main", + STATE).serviceUrl())) + .isInstanceOf(ProviderAuthenticationException.class) + .extracting("reasonCode") + .isEqualTo(ProviderAuthenticationFailureCode + .UPSTREAM_INVALID_RESPONSE); + + CasProtocolClient oversizedPrincipal = client( + (uri, connect, read, maximum) -> + new CasProtocolClient.CasValidationResponse( + 200, + """ + { + "serviceResponse": { + "authenticationSuccess": { + "user": "%s" + } + } + } + """.formatted("x".repeat(4097)))); + + assertThatThrownBy(() -> oversizedPrincipal.validate( + "cas-main", + "ST-oversized-principal", + oversizedPrincipal.begin( + "cas-main", + STATE).serviceUrl())) + .isInstanceOf(ProviderAuthenticationException.class) + .extracting("reasonCode") + .isEqualTo(ProviderAuthenticationFailureCode + .UPSTREAM_INVALID_RESPONSE); + } + + @Test + void mapsHttpAndMalformedResponseFailures() { + CasProtocolClient unavailable = client( + (uri, connect, read, maximum) -> + new CasProtocolClient.CasValidationResponse( + 503, + "")); + String service = unavailable.begin( + "cas-main", + STATE).serviceUrl(); + + assertThatThrownBy(() -> unavailable.validate( + "cas-main", + "ST-503", + service)) + .isInstanceOf(ProviderAuthenticationException.class) + .extracting("reasonCode") + .isEqualTo(ProviderAuthenticationFailureCode + .UPSTREAM_UNAVAILABLE); + + CasProtocolClient malformed = client( + (uri, connect, read, maximum) -> + new CasProtocolClient.CasValidationResponse( + 200, + "{\"unexpected\":true}")); + + assertThatThrownBy(() -> malformed.validate( + "cas-main", + "ST-malformed", + malformed.begin( + "cas-main", + STATE).serviceUrl())) + .isInstanceOf(ProviderAuthenticationException.class) + .extracting("reasonCode") + .isEqualTo(ProviderAuthenticationFailureCode + .UPSTREAM_INVALID_RESPONSE); + } + + private CasProtocolClient client( + CasProtocolClient.CasValidationTransport transport) { + return client( + CasTestConfiguration.validProperties(), + transport); + } + + private CasProtocolClient client( + CasProperties properties, + CasProtocolClient.CasValidationTransport transport) { + return new CasProtocolClient( + CasTestConfiguration.configuration(properties), + new ObjectMapper(), + transport, + Clock.fixed( + AUTHENTICATED_AT, + ZoneOffset.UTC)); + } + + private String decode(String value) { + return URLDecoder.decode( + value, + StandardCharsets.UTF_8); + } +} diff --git a/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/cas/CasProviderConfigurationTest.java b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/cas/CasProviderConfigurationTest.java new file mode 100644 index 00000000..32b93122 --- /dev/null +++ b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/cas/CasProviderConfigurationTest.java @@ -0,0 +1,128 @@ +package com.iflytek.skillhub.auth.cas; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatThrownBy; + +import java.time.Duration; +import org.junit.jupiter.api.Test; +import org.springframework.mock.env.MockEnvironment; + +class CasProviderConfigurationTest { + + @Test + void resolvesStableAuthorityAndProtocolEndpoints() { + CasProviderConfiguration.ResolvedCasProvider resolved = + CasTestConfiguration.configuration( + CasTestConfiguration.validProperties()) + .requireResolved(); + + assertThat(resolved.providerCode()).isEqualTo("cas-main"); + assertThat(resolved.authority()).isEqualTo("corp-cas"); + assertThat(resolved.serverUri().toString()) + .isEqualTo("https://cas.example.com/cas"); + assertThat(resolved.protocolVersion()) + .isEqualTo(CasProtocolVersion.V3_0); + assertThat(resolved.subjectType()) + .isEqualTo("cas_principal"); + } + + @Test + void productionCannotEnablePlainHttpEscapeHatch() { + CasProperties properties = + CasTestConfiguration.validProperties(); + properties.setServerUrl("http://cas.example.com/cas"); + properties.setServiceUrl( + "http://skillhub.example.com/api/v1/auth/cas/cas-main/callback"); + properties.setAllowInsecureForTesting(true); + CasProviderConfiguration configuration = + new CasProviderConfiguration( + properties, + new MockEnvironment().withProperty( + "spring.profiles.active", + "prod")); + + assertThatThrownBy(configuration::requireResolved) + .isInstanceOf(IllegalArgumentException.class) + .hasMessage("Invalid CAS provider configuration"); + } + + @Test + void stagingCanExplicitlyUseHttpForAnIsolatedFixture() { + CasProperties properties = + CasTestConfiguration.validProperties(); + properties.setServerUrl("http://127.0.0.1:18080/cas"); + properties.setServiceUrl( + "http://127.0.0.1:18081/api/v1/auth/cas/cas-main/callback"); + properties.setAllowInsecureForTesting(true); + CasProviderConfiguration configuration = + new CasProviderConfiguration( + properties, + new MockEnvironment().withProperty( + "spring.profiles.active", + "staging")); + + assertThat(configuration.requireResolved().serverUri() + .getScheme()).isEqualTo("http"); + } + + @Test + void rejectsUnstableAuthorityAndWrongCallbackPath() { + CasProperties properties = + CasTestConfiguration.validProperties(); + properties.setAuthority("Corporate CAS"); + + assertThatThrownBy(() -> CasTestConfiguration + .configuration(properties) + .requireResolved()) + .isInstanceOf(IllegalArgumentException.class); + + properties.setAuthority("corp-cas"); + properties.setServiceUrl( + "https://skillhub.example.com/api/v1/auth/cas/callback"); + + assertThatThrownBy(() -> CasTestConfiguration + .configuration(properties) + .requireResolved()) + .isInstanceOf(IllegalArgumentException.class); + } + + @Test + void rejectsQueryFragmentsAndInvalidExplicitPorts() { + CasProperties properties = + CasTestConfiguration.validProperties(); + properties.setServerUrl( + "https://cas.example.com/cas?tenant=corp"); + + assertThatThrownBy(() -> CasTestConfiguration + .configuration(properties) + .requireResolved()) + .isInstanceOf(IllegalArgumentException.class); + + properties.setServerUrl("https://cas.example.com:0/cas"); + + assertThatThrownBy(() -> CasTestConfiguration + .configuration(properties) + .requireResolved()) + .isInstanceOf(IllegalArgumentException.class); + } + + @Test + void rejectsUnboundedTimeoutsAndPayloads() { + CasProperties properties = + CasTestConfiguration.validProperties(); + properties.setReadTimeout(Duration.ofMinutes(2)); + + assertThatThrownBy(() -> CasTestConfiguration + .configuration(properties) + .requireResolved()) + .isInstanceOf(IllegalArgumentException.class); + + properties.setReadTimeout(Duration.ofSeconds(10)); + properties.setMaxResponseBytes(1024 * 1024 + 1); + + assertThatThrownBy(() -> CasTestConfiguration + .configuration(properties) + .requireResolved()) + .isInstanceOf(IllegalArgumentException.class); + } +} diff --git a/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/cas/CasTestConfiguration.java b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/cas/CasTestConfiguration.java new file mode 100644 index 00000000..e25fda44 --- /dev/null +++ b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/cas/CasTestConfiguration.java @@ -0,0 +1,31 @@ +package com.iflytek.skillhub.auth.cas; + +import org.springframework.mock.env.MockEnvironment; + +final class CasTestConfiguration { + + private CasTestConfiguration() { + } + + static CasProperties validProperties() { + CasProperties properties = new CasProperties(); + properties.setEnabled(true); + properties.setProviderCode("cas-main"); + properties.setDisplayName("Corporate CAS"); + properties.setAuthority("corp-cas"); + properties.setServerUrl("https://cas.example.com/cas"); + properties.setServiceUrl( + "https://skillhub.example.com/api/v1/auth/cas/cas-main/callback"); + properties.setProtocolVersion("3.0"); + return properties; + } + + static CasProviderConfiguration configuration( + CasProperties properties) { + return new CasProviderConfiguration( + properties, + new MockEnvironment().withProperty( + "spring.profiles.active", + "test")); + } +} diff --git a/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/identity/ReconciledIdentityProviderCatalogTest.java b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/identity/ReconciledIdentityProviderCatalogTest.java index 9d7af3a8..ca6d3bba 100644 --- a/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/identity/ReconciledIdentityProviderCatalogTest.java +++ b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/identity/ReconciledIdentityProviderCatalogTest.java @@ -12,6 +12,8 @@ import static org.mockito.Mockito.times; import static org.mockito.Mockito.verify; import static org.mockito.Mockito.when; +import com.iflytek.skillhub.auth.provider.BrowserAuthenticationAdapter; +import com.iflytek.skillhub.auth.provider.BrowserAuthenticationMethod; import com.iflytek.skillhub.auth.provider.CredentialAuthenticationAdapter; import com.iflytek.skillhub.auth.provider.CredentialAuthenticationRequest; import com.iflytek.skillhub.auth.provider.PassiveAuthenticationAdapter; @@ -49,6 +51,7 @@ class ReconciledIdentityProviderCatalogTest { bindingPreflightService, new IdentityProviderPolicyProperties(), List.of(), + List.of(), List.of()); } @@ -173,6 +176,7 @@ class ReconciledIdentityProviderCatalogTest { authorityLockService, bindingPreflightService, new IdentityProviderPolicyProperties(), + List.of(), List.of(credential), List.of(passive)); @@ -223,6 +227,7 @@ class ReconciledIdentityProviderCatalogTest { authorityLockService, bindingPreflightService, new IdentityProviderPolicyProperties(), + List.of(), List.of(adapter), List.of()); @@ -256,6 +261,7 @@ class ReconciledIdentityProviderCatalogTest { authorityLockService, bindingPreflightService, new IdentityProviderPolicyProperties(), + List.of(), List.of(credential), List.of(passive)); @@ -281,6 +287,7 @@ class ReconciledIdentityProviderCatalogTest { authorityLockService, bindingPreflightService, new IdentityProviderPolicyProperties(), + List.of(), List.of(adapter), List.of()); @@ -290,6 +297,76 @@ class ReconciledIdentityProviderCatalogTest { verify(adapter, never()).authenticate(any()); } + @Test + void registersAndRoutesReadyCasBrowserAdapterByExchangeType() { + BrowserAuthenticationAdapter adapter = + new BrowserAuthenticationAdapter<>() { + @Override + public ProviderInstanceDefinition provider() { + return new ProviderInstanceDefinition( + "cas-main", + "cas", + "corp-cas", + "Corporate CAS", + "cas_principal", + "cas_principal", + Map.of( + "cas_principal", + SubjectNormalization.EXACT), + List.of("display_name"), + List.of("email"), + List.of(), + EmailAssurance.PROVIDER_ASSERTED); + } + + @Override + public Class exchangeType() { + return String.class; + } + + @Override + public BrowserAuthenticationMethod loginMethod() { + return BrowserAuthenticationMethod.CAS_REDIRECT; + } + + @Override + public ProviderAuthenticationResult authenticate( + String exchange) { + throw new UnsupportedOperationException( + "not called"); + } + }; + when(descriptorSource.configuredDescriptors()) + .thenReturn(List.of()); + when(authorityLockService.isReady(any())) + .thenReturn(true); + catalog = new ReconciledIdentityProviderCatalog( + descriptorSource, + authorityLockService, + bindingPreflightService, + new IdentityProviderPolicyProperties(), + List.of(adapter), + List.of(), + List.of()); + + catalog.reconcile(); + + assertThat(catalog.listReadyLoginMethods()) + .containsExactly(new IdentityProviderLoginMethod( + "cas-main", + "Corporate CAS", + IdentityProviderLoginMethodType.CAS_REDIRECT)); + assertThat(catalog.requireBrowserRoute( + "cas-main", + String.class).adapter()).isSameAs(adapter); + assertThatThrownBy(() -> catalog.requireBrowserRoute( + "cas-main", + Integer.class)) + .isInstanceOf(IdentityCoreException.class) + .extracting("reasonCode") + .isEqualTo(IdentityFailureCode.PROVIDER_DISABLED); + } + private static ProviderDescriptor descriptor( String providerCode, String displayName) { diff --git a/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/policy/RouteSecurityPolicyRegistryTest.java b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/policy/RouteSecurityPolicyRegistryTest.java index efb5b0bd..890e1a63 100644 --- a/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/policy/RouteSecurityPolicyRegistryTest.java +++ b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/policy/RouteSecurityPolicyRegistryTest.java @@ -58,6 +58,19 @@ class RouteSecurityPolicyRegistryTest { assertTrue(matchedWeb); } + @Test + void authorizationPolicies_shouldAllowCasBrowserFlowAnonymously() { + boolean matched = registry.authorizationPolicies().stream() + .anyMatch(policy -> policy.method() == HttpMethod.GET + && "/api/v1/auth/cas/**".equals( + policy.pattern()) + && policy.accessLevel() + == RouteSecurityPolicyRegistry + .AccessLevel.PERMIT_ALL); + + assertTrue(matched); + } + @Test void authorizationPolicies_shouldRequireAuthenticationForNamespaceDiscovery() { boolean matchedV1 = registry.authorizationPolicies().stream() diff --git a/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/provider/ProviderConformanceKit.java b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/provider/ProviderConformanceKit.java index 6a564cd4..a3f31112 100644 --- a/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/provider/ProviderConformanceKit.java +++ b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/provider/ProviderConformanceKit.java @@ -41,10 +41,10 @@ public final class ProviderConformanceKit { } public static ProviderAuthenticationResult verifyBrowser( - ProviderInstanceDefinition provider, BrowserAuthenticationAdapter adapter, T fixture) { - assertThat(provider).isNotNull(); + ProviderInstanceDefinition provider = + verifyDefinition(adapter.provider(), adapter.provider()); ProviderAuthenticationResult result = adapter.authenticate(fixture); verifyResult(provider, result); diff --git a/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/provider/ProviderConformanceKitTest.java b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/provider/ProviderConformanceKitTest.java index 78c15ebc..cdff169e 100644 --- a/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/provider/ProviderConformanceKitTest.java +++ b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/provider/ProviderConformanceKitTest.java @@ -84,7 +84,28 @@ class ProviderConformanceKitTest { "X-Private-Assertion", List.of("fixture-assertion"))); BrowserAuthenticationAdapter browser = - exchange -> result; + new BrowserAuthenticationAdapter<>() { + @Override + public ProviderInstanceDefinition provider() { + return provider; + } + + @Override + public Class exchangeType() { + return String.class; + } + + @Override + public BrowserAuthenticationMethod loginMethod() { + return BrowserAuthenticationMethod.OAUTH_REDIRECT; + } + + @Override + public ProviderAuthenticationResult authenticate( + String exchange) { + return result; + } + }; PassiveAuthenticationAdapter passive = new PassiveAuthenticationAdapter() { @Override @@ -101,7 +122,6 @@ class ProviderConformanceKitTest { }; assertThat(ProviderConformanceKit.verifyBrowser( - provider, browser, "verified-exchange")).isSameAs(result); assertThat(ProviderConformanceKit.verifyPassive( diff --git a/web/src/api/types.ts b/web/src/api/types.ts index 60bef288..b61206ee 100644 --- a/web/src/api/types.ts +++ b/web/src/api/types.ts @@ -17,7 +17,7 @@ export type OAuthProvider = Omit { +function method(methodType: string): AuthMethod { + return { + id: methodType, + methodType, + provider: 'cas-main', + displayName: 'Corporate CAS', + actionUrl: '/api/v1/auth/cas/cas-main/login', + } +} + +describe('login-button browser method projection', () => { it('exports LoginButton component', () => { - expect(loginButton.LoginButton).toBeTypeOf('function') + expect(LoginButton).toBeTypeOf('function') + }) + + it('accepts OAuth and CAS redirect methods only', () => { + expect(isBrowserLoginMethod(method('OAUTH_REDIRECT'))).toBe(true) + expect(isBrowserLoginMethod(method('CAS_REDIRECT'))).toBe(true) + expect(isBrowserLoginMethod(method('PASSWORD'))).toBe(false) + }) + + it('uses bundled logos only for providers that have one', () => { + expect(providerLogoSource('GitHub')).toBe('/github-logo.svg') + expect(providerLogoSource('gitlab')).toBe('/gitlab-logo.svg') + expect(providerLogoSource('cas-main')).toBeNull() + expect(providerLogoSource('corp-oidc')).toBeNull() }) }) diff --git a/web/src/features/auth/login-button.tsx b/web/src/features/auth/login-button.tsx index cde4453f..37a1ac7b 100644 --- a/web/src/features/auth/login-button.tsx +++ b/web/src/features/auth/login-button.tsx @@ -1,4 +1,6 @@ import { useTranslation } from 'react-i18next' +import { ShieldCheck } from 'lucide-react' +import type { AuthMethod } from '@/api/types' import { Button } from '@/shared/ui/button' import { useAuthMethods } from './use-auth-methods' @@ -6,14 +8,26 @@ interface LoginButtonProps { returnTo?: string } -/** - * Returns the appropriate icon for a given OAuth provider. - */ -function OAuthIcon({ provider }: { provider: string }) { +export function providerLogoSource(provider: string) { const normalizedProvider = provider.toLowerCase() + if (normalizedProvider === 'github' || normalizedProvider === 'gitlab') { + return `/${normalizedProvider}-logo.svg` + } + return null +} + +export function isBrowserLoginMethod(method: AuthMethod) { + return method.methodType === 'OAUTH_REDIRECT' || method.methodType === 'CAS_REDIRECT' +} + +function ProviderIcon({ provider }: { provider: string }) { + const logoSource = providerLogoSource(provider) + if (!logoSource) { + return