import org.jasig.cas.services.UnauthorizedServiceException; //导入依赖的package包/类
/**
 * Gets registered service jwt secret.
 *
 * @param service  the service
 * @param propName the prop name
 * @return the registered service jwt secret
 */
protected String getRegisteredServiceJwtSecret(final RegisteredService service, final String propName) {
    if (service == null || !service.getAccessStrategy().isServiceAccessAllowed()) {
        logger.debug("Service is not defined/found or its access is disabled in the registry");
        throw new UnauthorizedServiceException(UnauthorizedServiceException.CODE_UNAUTHZ_SERVICE);
    }
    if (service.getProperties().containsKey(propName)) {
        final RegisteredServiceProperty propSigning = service.getProperties().get(propName);
        final String tokenSigningSecret = propSigning.getValue();
        if (StringUtils.isNotBlank(tokenSigningSecret)) {
            logger.debug("Found the secret value {} for service [{}]", propName, service.getServiceId());
            return tokenSigningSecret;
        }
    }
    logger.warn("Service [{}] does not define a property [{}] in the registry",
            service.getServiceId(), propName);
    return null;
}
 

import org.jasig.cas.services.UnauthorizedServiceException; //导入依赖的package包/类
@Test(expected = UnauthorizedServiceException.class)
public void verifyValidateServiceTicketWithInvalidService() throws Exception {
    final AuthenticationContext ctx = TestUtils.getAuthenticationContext(getAuthenticationSystemSupport(), getService("test2"));

    final TicketGrantingTicket ticketGrantingTicket = getCentralAuthenticationService()
        .createTicketGrantingTicket(ctx);
    final ServiceTicket serviceTicket = getCentralAuthenticationService()
        .grantServiceTicket(ticketGrantingTicket.getId(), getService(), ctx);

    getCentralAuthenticationService().validateServiceTicket(
        serviceTicket.getId(), getService("test2"));
}
 

import org.jasig.cas.services.UnauthorizedServiceException; //导入依赖的package包/类
@Test(expected=UnauthorizedServiceException.class)
public void unauthorizedServiceProvided() throws Exception {
    final MockRequestContext mockRequestContext = new MockRequestContext();
    mockRequestContext.getFlowScope().put("service", this.unauthorizedService);

    this.serviceAuthorizationCheck.doExecute(mockRequestContext);
    fail("Should have thrown UnauthorizedServiceException");
}
 

import org.jasig.cas.services.UnauthorizedServiceException; //导入依赖的package包/类
@Test(expected=UnauthorizedServiceException.class)
public void serviceThatIsNotRegisteredProvided() throws Exception {
    final MockRequestContext mockRequestContext = new MockRequestContext();
    mockRequestContext.getFlowScope().put("service", this.undefinedService);
    this.serviceAuthorizationCheck.doExecute(mockRequestContext);
    fail("Should have thrown UnauthorizedServiceException");
}
 

import org.jasig.cas.services.UnauthorizedServiceException; //导入依赖的package包/类
@Test(expected=UnauthorizedServiceException.class)
public void verifyValidateServiceTicketWithInvalidService() throws Exception {
    final TicketGrantingTicket ticketGrantingTicket = getCentralAuthenticationService()
        .createTicketGrantingTicket(
            TestUtils.getCredentialsWithSameUsernameAndPassword());
    final ServiceTicket serviceTicket = getCentralAuthenticationService()
        .grantServiceTicket(ticketGrantingTicket.getId(), TestUtils.getService());

    getCentralAuthenticationService().validateServiceTicket(
        serviceTicket.getId(), TestUtils.getService("test2"));
}
 

import org.jasig.cas.services.UnauthorizedServiceException; //导入依赖的package包/类
@Override
protected Event doExecute(final RequestContext context) throws Exception {
    final Service service = WebUtils.getService(context);

    final boolean match = this.servicesManager.matchesExistingService(service);

    if (match) {
        return success();
    }

    final String msg = String.format("ServiceManagement: Unauthorized Service Access. "
            + "Service [%s] does not match entries in service registry.", service.getId());
    logger.warn(msg);
    throw new UnauthorizedServiceException(UnauthorizedServiceException.CODE_UNAUTHZ_SERVICE, msg);
}
 

import org.jasig.cas.services.UnauthorizedServiceException; //导入依赖的package包/类
@Override
protected Event doExecute(final RequestContext context) throws Exception {
    final HttpServletRequest request = WebUtils.getHttpServletRequest(context);
    if (!this.pathPopulated) {
        final String contextPath = context.getExternalContext().getContextPath();
        final String cookiePath = StringUtils.hasText(contextPath) ? contextPath + '/' : "/";
        logger.info("Setting path for cookies to: {} ", cookiePath);
        this.warnCookieGenerator.setCookiePath(cookiePath);
        this.ticketGrantingTicketCookieGenerator.setCookiePath(cookiePath);
        this.pathPopulated = true;
    }

    WebUtils.putTicketGrantingTicketInScopes(context,
            this.ticketGrantingTicketCookieGenerator.retrieveCookieValue(request));

    WebUtils.putWarningCookie(context,
            Boolean.valueOf(this.warnCookieGenerator.retrieveCookieValue(request)));

    final Service service = WebUtils.getService(this.argumentExtractors, context);


    if (service != null) {
        logger.debug("Placing service in context scope: [{}]", service.getId());

        final RegisteredService registeredService = this.servicesManager.findServiceBy(service);
        if (registeredService != null && registeredService.getAccessStrategy().isServiceAccessAllowed()) {
            logger.debug("Placing registered service [{}] with id [{}] in context scope",
                    registeredService.getServiceId(),
                    registeredService.getId());
            WebUtils.putRegisteredService(context, registeredService);
        }
    } else if (!this.enableFlowOnAbsentServiceRequest) {
        logger.warn("No service authentication request is available at [{}]. CAS is configured to disable the flow.",
                WebUtils.getHttpServletRequest(context).getRequestURL());
        throw new NoSuchFlowExecutionException(context.getFlowExecutionContext().getKey(),
                new UnauthorizedServiceException("screen.service.required.message", "Service is required"));
    }
    WebUtils.putService(context, service);
    return result("success");
}
 

import org.jasig.cas.services.UnauthorizedServiceException; //导入依赖的package包/类
@Test(expected=UnauthorizedServiceException.class)
public void testValidateServiceTicketWithInvalidService() throws Exception {
    final String ticketGrantingTicket = getCentralAuthenticationService()
        .createTicketGrantingTicket(
            TestUtils.getCredentialsWithSameUsernameAndPassword());
    final String serviceTicket = getCentralAuthenticationService()
        .grantServiceTicket(ticketGrantingTicket, TestUtils.getService());

    getCentralAuthenticationService().validateServiceTicket(
        serviceTicket, TestUtils.getService("test2"));
}
 

import org.jasig.cas.services.UnauthorizedServiceException; //导入依赖的package包/类
@Test(expected=UnauthorizedServiceException.class)
public void unauthorizedServiceProvided() throws Exception {
    MockRequestContext mockRequestContext = new MockRequestContext();
    mockRequestContext.getFlowScope().put("service", this.unauthorizedService);

    this.serviceAuthorizationCheck.doExecute(mockRequestContext);
    fail("Should have thrown UnauthorizedServiceException");
}
 

import org.jasig.cas.services.UnauthorizedServiceException; //导入依赖的package包/类
@Test(expected=UnauthorizedServiceException.class)
public void serviceThatIsNotRegisteredProvided() throws Exception {
    MockRequestContext mockRequestContext = new MockRequestContext();
    mockRequestContext.getFlowScope().put("service", this.undefinedService);
    this.serviceAuthorizationCheck.doExecute(mockRequestContext);
    fail("Should have thrown UnauthorizedServiceException");
}
 

import org.jasig.cas.services.UnauthorizedServiceException; //导入依赖的package包/类
protected LocalCookieGenerator newCookieGeneratorInstance(
    final HttpServletRequest request) {
    String appName = CasShibUtil.getAppNameFromRequestURI(request,
        shibServiceRegistrar);
    if (appName == null) {
        throw new UnauthorizedServiceException(
            "Can't issue cookies because application name could not be determined.");
    }

    LocalCookieGenerator cookieGenerator = new LocalCookieGenerator();
    if (cookieSecure != null)
        cookieGenerator.setCookieSecure(cookieSecure.booleanValue());
    if (cookieMaxAge != null)
        cookieGenerator.setCookieMaxAge(cookieMaxAge.intValue());

    // cookie name is cookieNamePrefix + "-" + escaped(appName)
    cookieGenerator.setCookieName(getFullCookieName(appName));

    // determine the cookie path based on the requestURI
    String cookiePath = (request.getContextPath() != null ? request
        .getContextPath() : "")
        + "/shib/" + appName;

    cookieGenerator.setCookiePath(cookiePath);

    return (cookieGenerator);
}
 

import org.jasig.cas.services.UnauthorizedServiceException; //导入依赖的package包/类
@Override
public WebApplicationService extractServiceInternal(
    final HttpServletRequest request) {
    CasShibWebApplicationServiceImpl service = (CasShibWebApplicationServiceImpl) super
        .extractServiceInternal(request);

    boolean authorizedService = isAuthorized(service, false);
    if (!authorizedService) {
        // fortunately this is a RuntimeException
        throw new UnauthorizedServiceException(
            "The passcode provided is invalid.");
    }

    return (service);
}
 

import org.jasig.cas.services.UnauthorizedServiceException; //导入依赖的package包/类
@Override
public WebApplicationService extractServiceInternal(
    final HttpServletRequest request) {
    CasShibWebApplicationServiceImpl service = (CasShibWebApplicationServiceImpl) super
        .extractServiceInternal(request);

    boolean authorizedService = isAuthorized(service, true);
    if (!authorizedService) {
        // fortunately this is a RuntimeException
        throw new UnauthorizedServiceException(
            "The passcode provided is invalid.");
    }

    return (service);
}
 

import org.jasig.cas.services.UnauthorizedServiceException; //导入依赖的package包/类
@Override
public WebApplicationService extractServiceInternal(
    final HttpServletRequest request) {
    CasShibSamlService service = (CasShibSamlService) super
        .extractServiceInternal(request);

    boolean authorizedService = isAuthorized(service, false);
    if (!authorizedService) {
        // fortunately this is a RuntimeException
        throw new UnauthorizedServiceException(
            "The passcode provided is invalid.");
    }

    return (service);
}
 

import org.jasig.cas.services.UnauthorizedServiceException; //导入依赖的package包/类
@Override
public WebApplicationService extractServiceInternal(
    final HttpServletRequest request) {
    CasShibSamlService service = (CasShibSamlService) super
        .extractServiceInternal(request);

    boolean authorizedService = isAuthorized(service, true);
    if (!authorizedService) {
        // fortunately this is a RuntimeException
        throw new UnauthorizedServiceException(
            "The passcode provided is invalid.");
    }

    return (service);
}
 

import org.jasig.cas.services.UnauthorizedServiceException; //导入依赖的package包/类
@Override
protected Event doExecute(final RequestContext requestContext) throws Exception {
    final HttpServletRequest request = WebUtils.getHttpServletRequest(requestContext);
    final String entityId = request.getParameter(this.entityIdParameterName);
    if (StringUtils.isBlank(entityId)) {
        logger.debug("No entity id found for parameter [{}]", this.entityIdParameterName);
        return success();
    }

    final WebApplicationService service = serviceFactory.createService(entityId);
    final RegisteredService registeredService = this.servicesManager.findServiceBy(service);
    if (registeredService == null || !registeredService.getAccessStrategy().isServiceAccessAllowed()) {
        logger.debug("Entity id [{}] is not recognized/allowed by the CAS service registry", entityId);

        if (registeredService != null) {
            WebUtils.putUnauthorizedRedirectUrlIntoFlowScope(requestContext,
                    registeredService.getAccessStrategy().getUnauthorizedRedirectUrl());
        }

        throw new UnauthorizedServiceException(UnauthorizedServiceException.CODE_UNAUTHZ_SERVICE,
                "Entity " + entityId + " not recognized");
    }

    final EntityDescriptor entityDescriptor = this.metadataAdapter.getEntityDescriptorForEntityId(entityId);
    if (entityDescriptor == null) {
        logger.debug("Entity descriptor not found for [{}]", entityId);
        return success();
    }

    final SPSSODescriptor spssoDescriptor = getSPSsoDescriptor(entityDescriptor);
    if (spssoDescriptor == null) {
        logger.debug("SP SSO descriptor not found for [{}]", entityId);
        return success();
    }

    final Extensions extensions = spssoDescriptor.getExtensions();
    if (extensions == null) {
        logger.debug("No extensions are found for [{}]", UIInfo.DEFAULT_ELEMENT_NAME.getNamespaceURI());
        return success();
    }

    final List<XMLObject> spExtensions = extensions.getUnknownXMLObjects(UIInfo.DEFAULT_ELEMENT_NAME);
    if (spExtensions.isEmpty()) {
        logger.debug("No extensions are found for [{}]", UIInfo.DEFAULT_ELEMENT_NAME.getNamespaceURI());
        return success();
    }

    final SimpleMetadataUIInfo mdui = new SimpleMetadataUIInfo(registeredService);

    for (final XMLObject obj : spExtensions) {
        if (obj instanceof UIInfo) {
            final UIInfo uiInfo = (UIInfo) obj;
            logger.debug("Found UI info for [{}] and added to flow context", entityId);
            mdui.setUIInfo(uiInfo);
        }
    }

    requestContext.getFlowScope().put(MDUI_FLOW_PARAMETER_NAME, mdui);
    return success();
}
 

import org.jasig.cas.services.UnauthorizedServiceException; //导入依赖的package包/类
/**
 * Construct SAML response.
 * <a href="http://bit.ly/1uI8Ggu">See this reference for more info.</a>
 * @param service the service
 * @return the SAML response
 */
protected String constructSamlResponse(final GoogleAccountsService service) {
    final DateTime currentDateTime = new DateTime();
    final DateTime notBeforeIssueInstant = DateTime.parse("2003-04-17T00:46:02Z");

    /*
     * Must be looked up directly from the context
     * because the services manager is not serializable
     * and cannot be class field.
     */
    final ApplicationContext context = ApplicationContextProvider.getApplicationContext();
    final ServicesManager servicesManager = context.getBean("servicesManager", ServicesManager.class);
    final RegisteredService registeredService = servicesManager.findServiceBy(service);
    if (registeredService == null || !registeredService.getAccessStrategy().isServiceAccessAllowed()) {
        throw new UnauthorizedServiceException(UnauthorizedServiceException.CODE_UNAUTHZ_SERVICE);
    }
    final String userId = registeredService.getUsernameAttributeProvider()
                .resolveUsername(service.getPrincipal(), service);

    final org.opensaml.saml.saml2.core.Response response = samlObjectBuilder.newResponse(
        samlObjectBuilder.generateSecureRandomId(), currentDateTime, service.getId(), service);
    response.setStatus(samlObjectBuilder.newStatus(StatusCode.SUCCESS, null));

    final AuthnStatement authnStatement = samlObjectBuilder.newAuthnStatement(
        AuthnContext.PASSWORD_AUTHN_CTX, currentDateTime);
    final Assertion assertion = samlObjectBuilder.newAssertion(authnStatement,
        "https://www.opensaml.org/IDP",
        notBeforeIssueInstant, samlObjectBuilder.generateSecureRandomId());

    final Conditions conditions = samlObjectBuilder.newConditions(notBeforeIssueInstant,
            currentDateTime.plusSeconds(this.skewAllowance), service.getId());
    assertion.setConditions(conditions);

    final Subject subject = samlObjectBuilder.newSubject(NameID.EMAIL, userId,
        service.getId(), currentDateTime.plusSeconds(this.skewAllowance), service.getRequestId());
    assertion.setSubject(subject);

    response.getAssertions().add(assertion);

    final StringWriter writer = new StringWriter();
    samlObjectBuilder.marshalSamlXmlObject(response, writer);

    final String result = writer.toString();
    LOGGER.debug("Generated Google SAML response: {}", result);
    return result;
}
 

import org.jasig.cas.services.UnauthorizedServiceException; //导入依赖的package包/类
@Test(expected=UnauthorizedServiceException.class)
public void verifyInvalidServiceWhenDelegatingTicketGrantingTicket() throws Exception {
    this.cas.createProxyGrantingTicket(ST_ID, getAuthenticationContext());
}