CAS serviceValidate接口中service参数和ticket中的service一致验证

maxkey-persistence/src/main/java/org/dromara/maxkey/persistence/service/impl/GroupsServiceImpl.java

@@ -68,7 +68,6 @@ public class GroupsServiceImpl  extends JpaServiceImpl<GroupsMapper,Groups,Strin
             }
             groupMemberService.deleteDynamicMember(dynamicGroup);
             groupMemberService.addDynamicMember(dynamicGroup);
-            
         }
     }
     

maxkey-protocols/maxkey-protocol-cas/src/main/java/org/dromara/maxkey/authz/cas/endpoint/validate/Cas10AuthorizeEndpoint.java

@@ -21,11 +21,14 @@
 package org.dromara.maxkey.authz.cas.endpoint.validate;
 
 
+import org.apache.commons.lang3.Strings;
 import org.dromara.maxkey.authn.SignPrincipal;
 import org.dromara.maxkey.authz.cas.endpoint.CasBaseAuthorizeEndpoint;
 import org.dromara.maxkey.authz.cas.response.Service10ResponseBuilder;
 import org.dromara.maxkey.authz.cas.ticket.CasConstants;
 import org.dromara.maxkey.authz.cas.ticket.Ticket;
+import org.dromara.maxkey.entity.apps.AppsCasDetails;
+import org.dromara.maxkey.http.HttpUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -100,6 +103,13 @@ renew [OPTIONAL] - if this parameter is set, ticket validation will only succeed
         }
         
         if(storedTicket != null){
+        	AppsCasDetails  casDetail = storedTicket.getCasDetails();
+            //serviceValidate接口中service参数必须和ticket中的service一致
+        	String requestCasService  = HttpUtils.requestUrl(service);
+            if(!Strings.CS.equals(requestCasService, casDetail.getService())){
+            	_logger.debug("Ticket {} not valid for register‌ service {} , the request service {}",ticket,casDetail.getService(),requestCasService);
+            	return new Service10ResponseBuilder().failure().serviceResponseBuilder();
+            }
             String principal=((SignPrincipal)storedTicket.getAuthentication().getPrincipal()).getUsername();
             _logger.debug("principal {}",principal);
             return new Service10ResponseBuilder().success()
@@ -107,8 +117,7 @@ renew [OPTIONAL] - if this parameter is set, ticket validation will only succeed
                     .serviceResponseBuilder();
         }else{
             _logger.debug("Ticket not found .");
-            return new Service10ResponseBuilder().failure()
-                    .serviceResponseBuilder();
+            return new Service10ResponseBuilder().failure().serviceResponseBuilder();
         }
     }
 }

maxkey-protocols/maxkey-protocol-cas/src/main/java/org/dromara/maxkey/authz/cas/endpoint/validate/Cas20AuthorizeEndpoint.java

@@ -24,6 +24,7 @@ import java.lang.reflect.InvocationTargetException;
 
 import org.apache.commons.beanutils.BeanUtils;
 import org.apache.commons.lang3.StringUtils;
+import org.apache.commons.lang3.Strings;
 import org.dromara.maxkey.authn.SignPrincipal;
 import org.dromara.maxkey.authz.cas.endpoint.CasBaseAuthorizeEndpoint;
 import org.dromara.maxkey.authz.cas.response.ServiceResponseBuilder;
@@ -33,7 +34,9 @@ import org.dromara.maxkey.authz.cas.ticket.ProxyGrantingTicketImpl;
 import org.dromara.maxkey.authz.cas.ticket.Ticket;
 import org.dromara.maxkey.authz.endpoint.adapter.AbstractAuthorizeAdapter;
 import org.dromara.maxkey.constants.ConstsBoolean;
+import org.dromara.maxkey.entity.apps.AppsCasDetails;
 import org.dromara.maxkey.http.HttpResponseConstants;
+import org.dromara.maxkey.http.HttpUtils;
 import org.dromara.maxkey.util.Instance;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -195,6 +198,16 @@ public class Cas20AuthorizeEndpoint  extends CasBaseAuthorizeEndpoint{
         ServiceResponseBuilder serviceResponseBuilder=new ServiceResponseBuilder(format);
         
         if(storedTicket!=null){
+        	AppsCasDetails  casDetail = storedTicket.getCasDetails();
+            //serviceValidate接口中service参数必须和ticket中的service一致
+            String requestCasService  = HttpUtils.requestUrl(service);
+            if(!Strings.CS.equals(requestCasService, casDetail.getService())){
+            	_logger.debug("Ticket {} not valid for register‌ service {} , the request service {}",ticket,casDetail.getService(),requestCasService);
+            	serviceResponseBuilder.failure()
+                    .setCode(CasConstants.ERROR_CODE.INVALID_SERVICE)
+                    .setDescription("Ticket "+ticket+" not valid for this service "+requestCasService);
+                return serviceResponseBuilder.serviceResponseBuilder();
+            }
             SignPrincipal authentication = ((SignPrincipal)storedTicket.getAuthentication().getPrincipal());
             if(StringUtils.isNotBlank(pgtUrl)) {
                 ProxyGrantingTicketIOUImpl proxyGrantingTicketIOUImpl =new ProxyGrantingTicketIOUImpl();

maxkey-protocols/maxkey-protocol-cas/src/main/java/org/dromara/maxkey/authz/cas/endpoint/validate/Cas30AuthorizeEndpoint.java

@@ -24,6 +24,7 @@ import java.lang.reflect.InvocationTargetException;
 
 import org.apache.commons.beanutils.BeanUtils;
 import org.apache.commons.lang3.StringUtils;
+import org.apache.commons.lang3.Strings;
 import org.dromara.maxkey.authn.SignPrincipal;
 import org.dromara.maxkey.authz.cas.endpoint.CasBaseAuthorizeEndpoint;
 import org.dromara.maxkey.authz.cas.response.ServiceResponseBuilder;
@@ -33,7 +34,9 @@ import org.dromara.maxkey.authz.cas.ticket.ProxyGrantingTicketImpl;
 import org.dromara.maxkey.authz.cas.ticket.Ticket;
 import org.dromara.maxkey.authz.endpoint.adapter.AbstractAuthorizeAdapter;
 import org.dromara.maxkey.constants.ConstsBoolean;
+import org.dromara.maxkey.entity.apps.AppsCasDetails;
 import org.dromara.maxkey.http.HttpResponseConstants;
+import org.dromara.maxkey.http.HttpUtils;
 import org.dromara.maxkey.util.Instance;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -78,6 +81,17 @@ public class Cas30AuthorizeEndpoint  extends CasBaseAuthorizeEndpoint{
         ServiceResponseBuilder serviceResponseBuilder=new ServiceResponseBuilder(format);
         
         if(storedTicket!=null){
+        	AppsCasDetails  casDetail = storedTicket.getCasDetails();
+            //serviceValidate接口中service参数必须和ticket中的service一致
+            String requestCasService  = HttpUtils.requestUrl(service);
+            if(!Strings.CS.equals(requestCasService, casDetail.getService())){
+            	_logger.debug("Ticket {} not valid for register‌ service {} , the request service {}",ticket,casDetail.getService(),requestCasService);
+            	serviceResponseBuilder.failure()
+                    .setCode(CasConstants.ERROR_CODE.INVALID_SERVICE)
+                    .setDescription("Ticket "+ticket+" not valid for this service "+requestCasService);
+            	httpResponseAdapter.write(response,serviceResponseBuilder.serviceResponseBuilder(),format);
+            }
+            
             SignPrincipal authentication = ((SignPrincipal)storedTicket.getAuthentication().getPrincipal());
             if(StringUtils.isNotBlank(pgtUrl)) {
                 ProxyGrantingTicketIOUImpl proxyGrantingTicketIOUImpl =new ProxyGrantingTicketIOUImpl();