diff --git a/adapters/saml/wildfly-elytron/pom.xml b/adapters/saml/wildfly-elytron/pom.xml index cc78c6e482b..bb5044321f0 100755 --- a/adapters/saml/wildfly-elytron/pom.xml +++ b/adapters/saml/wildfly-elytron/pom.xml @@ -68,7 +68,7 @@ org.jboss.spec.javax.servlet - jboss-servlet-api_3.0_spec + jboss-servlet-api_3.1_spec provided diff --git a/adapters/saml/wildfly-elytron/src/main/java/org/keycloak/adapters/saml/elytron/IdMapperUpdaterSessionListener.java b/adapters/saml/wildfly-elytron/src/main/java/org/keycloak/adapters/saml/elytron/IdMapperUpdaterSessionListener.java index d65d74a3085..b9e15f3db2f 100644 --- a/adapters/saml/wildfly-elytron/src/main/java/org/keycloak/adapters/saml/elytron/IdMapperUpdaterSessionListener.java +++ b/adapters/saml/wildfly-elytron/src/main/java/org/keycloak/adapters/saml/elytron/IdMapperUpdaterSessionListener.java @@ -24,6 +24,7 @@ import javax.servlet.http.HttpSession; import javax.servlet.http.HttpSessionAttributeListener; import javax.servlet.http.HttpSessionBindingEvent; import javax.servlet.http.HttpSessionEvent; +import javax.servlet.http.HttpSessionIdListener; import javax.servlet.http.HttpSessionListener; import org.jboss.logging.Logger; @@ -31,7 +32,7 @@ import org.jboss.logging.Logger; * * @author hmlnarik */ -public class IdMapperUpdaterSessionListener implements HttpSessionListener, HttpSessionAttributeListener { +public class IdMapperUpdaterSessionListener implements HttpSessionListener, HttpSessionAttributeListener, HttpSessionIdListener { private static final Logger LOG = Logger.getLogger(IdMapperUpdaterSessionListener.class); @@ -56,6 +57,15 @@ public class IdMapperUpdaterSessionListener implements HttpSessionListener, Http unmap(session.getId(), session.getAttribute(SamlSession.class.getName())); } + @Override + public void sessionIdChanged(HttpSessionEvent hse, String oldSessionId) { + LOG.debugf("Session changed ID from %s", oldSessionId); + HttpSession session = hse.getSession(); + Object value = session.getAttribute(SamlSession.class.getName()); + unmap(oldSessionId, value); + map(session.getId(), value); + } + @Override public void attributeAdded(HttpSessionBindingEvent hsbe) { HttpSession session = hsbe.getSession(); diff --git a/adapters/saml/wildfly-elytron/src/main/java/org/keycloak/adapters/saml/elytron/KeycloakConfigurationServletListener.java b/adapters/saml/wildfly-elytron/src/main/java/org/keycloak/adapters/saml/elytron/KeycloakConfigurationServletListener.java index 5ece449657b..f89cfcd2ebf 100644 --- a/adapters/saml/wildfly-elytron/src/main/java/org/keycloak/adapters/saml/elytron/KeycloakConfigurationServletListener.java +++ b/adapters/saml/wildfly-elytron/src/main/java/org/keycloak/adapters/saml/elytron/KeycloakConfigurationServletListener.java @@ -156,14 +156,14 @@ public class KeycloakConfigurationServletListener implements ServletContextListe public void addTokenStoreUpdaters(ServletContext servletContext) { SessionIdMapperUpdater updater = this.idMapperUpdater; + servletContext.addListener(new IdMapperUpdaterSessionListener(idMapper)); // This takes care of HTTP sessions manipulated locally + try { String idMapperSessionUpdaterClasses = servletContext.getInitParameter("keycloak.sessionIdMapperUpdater.classes"); if (idMapperSessionUpdaterClasses == null) { return; } - servletContext.addListener(new IdMapperUpdaterSessionListener(idMapper)); // This takes care of HTTP sessions manipulated locally - updater = SessionIdMapperUpdater.DIRECT; for (String clazz : idMapperSessionUpdaterClasses.split("\\s*,\\s*")) { diff --git a/pom.xml b/pom.xml index 07f0421edad..195928aad3b 100644 --- a/pom.xml +++ b/pom.xml @@ -106,6 +106,7 @@ 3.0.0 1.0.2.Final + 1.0.2.Final 2.0.2.Final 2.0.0.Final 2.0.1.Final @@ -152,7 +153,6 @@ 6.0.0 5.0.0 7.4.6 - 1.0.2.Final 2.0.0.Final 4.1.2 @@ -1645,6 +1645,11 @@ jboss-servlet-api_3.0_spec ${servlet.api.30.version} + + org.jboss.spec.javax.servlet + jboss-servlet-api_3.1_spec + ${servlet.api.31.version} + org.jboss.spec.javax.ws.rs jboss-jaxrs-api_2.1_spec diff --git a/testsuite/integration-arquillian/test-apps/servlets/pom.xml b/testsuite/integration-arquillian/test-apps/servlets/pom.xml index 88e482771d6..2dfff1fcad4 100644 --- a/testsuite/integration-arquillian/test-apps/servlets/pom.xml +++ b/testsuite/integration-arquillian/test-apps/servlets/pom.xml @@ -15,7 +15,7 @@ org.jboss.spec.javax.servlet - jboss-servlet-api_3.0_spec + jboss-servlet-api_3.1_spec provided diff --git a/testsuite/integration-arquillian/test-apps/servlets/src/main/java/org/keycloak/testsuite/adapter/servlet/SendUsernameServlet.java b/testsuite/integration-arquillian/test-apps/servlets/src/main/java/org/keycloak/testsuite/adapter/servlet/SendUsernameServlet.java index c3f2f3b715c..a8dda54d0f6 100755 --- a/testsuite/integration-arquillian/test-apps/servlets/src/main/java/org/keycloak/testsuite/adapter/servlet/SendUsernameServlet.java +++ b/testsuite/integration-arquillian/test-apps/servlets/src/main/java/org/keycloak/testsuite/adapter/servlet/SendUsernameServlet.java @@ -23,7 +23,6 @@ import org.keycloak.adapters.saml.SamlAuthenticationError; import org.keycloak.adapters.saml.SamlPrincipal; import org.keycloak.adapters.saml.SamlSession; import org.keycloak.adapters.spi.AuthenticationError; -import org.keycloak.saml.processing.core.saml.v2.constants.X500SAMLProfileConstants; import javax.servlet.RequestDispatcher; import javax.servlet.http.HttpServletRequest; @@ -45,8 +44,6 @@ import java.util.Arrays; import java.util.Collections; import java.util.List; import java.util.Map.Entry; -import javax.xml.parsers.DocumentBuilderFactory; -import javax.xml.transform.OutputKeys; import javax.xml.transform.Transformer; import javax.xml.transform.TransformerException; import javax.xml.transform.TransformerFactory; @@ -104,11 +101,19 @@ public class SendUsernameServlet { } + @GET + @Path("change-session-id") + public Response changeSessionId() throws IOException { + System.out.println("In SendUsername Servlet changeSessionId()"); + final String sessionId = httpServletRequest.changeSessionId(); + + return Response.ok(sessionId).header(HttpHeaders.CONTENT_TYPE, MediaType.TEXT_PLAIN_TYPE + ";charset=UTF-8").build(); + } + @GET @Path("getAssertionFromDocument") public Response getAssertionFromDocument() throws IOException, TransformerException { sentPrincipal = httpServletRequest.getUserPrincipal(); - DocumentBuilderFactory domFact = DocumentBuilderFactory.newInstance(); Document doc = ((SamlPrincipal) sentPrincipal).getAssertionDocument(); String xml = ""; if (doc != null) { diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/adapter/servlet/SAMLFilterServletAdapterTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/adapter/servlet/SAMLFilterServletAdapterTest.java index b354073f9b3..4606a3c5590 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/adapter/servlet/SAMLFilterServletAdapterTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/adapter/servlet/SAMLFilterServletAdapterTest.java @@ -110,6 +110,12 @@ public class SAMLFilterServletAdapterTest extends SAMLServletAdapterTest { } + @Test + @Override + @Ignore + public void testChangeSessionID() throws Exception { + } + /** * Tests that the adapter is using the configured role mappings provider to map the roles extracted from the assertion * into roles that exist in the application domain. For this test a {@link org.keycloak.adapters.saml.PropertiesBasedRoleMapper} diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/adapter/servlet/SAMLServletAdapterTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/adapter/servlet/SAMLServletAdapterTest.java index 827a929e8ed..68d1429d338 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/adapter/servlet/SAMLServletAdapterTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/adapter/servlet/SAMLServletAdapterTest.java @@ -1894,6 +1894,34 @@ public class SAMLServletAdapterTest extends AbstractSAMLServletAdapterTest { checkLoggedOut(salesPostSigEmailServletPage, testRealmSAMLPostLoginPage); } + @Test + public void testChangeSessionID() throws Exception { + // login in the employeeDom application + assertSuccessfulLogin(employeeDomServletPage, bburkeUser, testRealmSAMLPostLoginPage, "principal=bburke"); + assertSuccessfullyLoggedIn(employeeDomServletPage, "principal=bburke"); + String sessionId = driver.manage().getCookieNamed("JSESSIONID").getValue(); + + // retrieve the saml document + driver.navigate().to(employeeDomServletPage.getUriBuilder().clone().path("getAssertionFromDocument").build().toURL()); + waitForPageToLoad(); + String xml = getRawPageSource(); + Assert.assertNotEquals("", xml); + + // change the session id + driver.navigate().to(employeeDomServletPage.getUriBuilder().clone().path("change-session-id").build().toURL()); + waitForPageToLoad(); + Assert.assertNotEquals("SessionID has not been changed at login", sessionId, driver.manage().getCookieNamed("JSESSIONID").getValue()); + + // retrieve again the saml document and should be the same as login should be maintained + driver.navigate().to(employeeDomServletPage.getUriBuilder().clone().path("getAssertionFromDocument").build().toURL()); + waitForPageToLoad(); + Assert.assertEquals(xml, getRawPageSource()); + + // logout + employeeDomServletPage.logout(); + checkLoggedOut(employeeDomServletPage, testRealmSAMLPostLoginPage); + } + public static void printDocument(Source doc, OutputStream out) throws IOException, TransformerException { TransformerFactory tf = TransformerFactory.newInstance(); Transformer transformer = tf.newTransformer();