[GitHub] [guacamole-client] necouchman commented on a change in pull request #563: GUACAMOLE-793: validateTicket() returns the CASAuthenticatedUser instance

[GitBox <gi...@apache.org>]

necouchman commented on a change in pull request #563:
URL: https://github.com/apache/guacamole-client/pull/563#discussion_r516794487



##########
File path: extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/ticket/TicketValidationService.java
##########
@@ -122,16 +134,44 @@
             }
             
             // Convert remaining attributes that have values to Strings
+            String groupAttribute = confService.getGroupAttribute();
+            // Use cas-member-attribute to retrieve and set group memberships
+            String groupDnFormat = confService.getGroupDnFormat();
+            String groupTemplate = "";
+            if (groupDnFormat != null) {
+                // if CAS is backended to LDAP, groups come in as RFC4514 DN
+                // syntax.  If cas-group-dn-format is set, this strips
+                // an entry such as "CN=Foo,OU=Bar,DC=example,DC=com" to
+                // "Foo"
+                groupTemplate = groupDnFormat.replace("%s","([A-Za-z0-9_\\(\\)\\-\\.\\s+]+)");
+                // the underlying parser aggregates all instances of the same
+                // attribute, so we need to be able to parse them out
+                groupTemplate=groupTemplate+",*\\s*";
+            } else {
+               groupTemplate = "([A-Za-z0-9_\\(\\)\\-\\.\\s+]+,*\\s*)";
+            }

Review comment:
       * Please don't cuddle the `if/else` tags.
   * `groupTemplate` line has a 3 space indent.

##########
File path: extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/AuthenticationProviderService.java
##########
@@ -82,13 +83,9 @@ public CASAuthenticatedUser authenticateUser(Credentials credentials)
         if (request != null) {
             String ticket = request.getParameter(CASTicketField.PARAMETER_NAME);
             if (ticket != null) {
-                Map<String, String> tokens = ticketService.validateTicket(ticket, credentials);
-                String username = credentials.getUsername();
-                if (username != null) {
-                    CASAuthenticatedUser authenticatedUser = authenticatedUserProvider.get();
-                    authenticatedUser.init(username, credentials, tokens);
-                    return authenticatedUser;
-                }
+                CASAuthenticatedUser authenticatedUser =
+                    ticketService.validateTicket(ticket, credentials);
+                return authenticatedUser;

Review comment:
       Maybe just `return ticketService.validateTicket(ticket, credentials);` here?

##########
File path: extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/ticket/TicketValidationService.java
##########
@@ -122,16 +134,42 @@
             }
             
             // Convert remaining attributes that have values to Strings
+            String groupAttribute = confService.getGroupAttribute();
+            // Use cas-member-attribute to retrieve and set group memberships
+            String groupDnFormat = confService.getGroupDnFormat();
+            String groupTemplate = "";
+            if (groupDnFormat != null) {
+                // if CAS is backended to LDAP, groups come in as RFC4514 DN
+                // syntax.  If cas-group-dn-format is set, this strips
+                // an entry such as "CN=Foo,OU=Bar,DC=example,DC=com" to
+                // "Foo"
+                groupTemplate = groupDnFormat.replace("%s","([A-Za-z0-9_\\(\\)\\-\\.\\s+]+)");
+                // the underlying parser aggregates all instances of the same
+                // attribute, so we need to be able to parse them out
+                groupTemplate=groupTemplate+",*\\s*";
+            } else {
+               groupTemplate = "([A-Za-z0-9_\\(\\)\\-\\.\\s+]+,*\\s*)";
+            }
+            Pattern pattern = Pattern.compile(groupTemplate);

Review comment:
       I'm not 100% certain if this will work, but, based on this page:
   
   https://www.baeldung.com/java-regexp-escape-char
   
   It looks like the `\Q` and `\E` special characters can be used to escape anything between them. So it might be possible to use those around the value of the `groupDnFormat` String to automatically escape anything within that ??

##########
File path: extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/ticket/TicketValidationService.java
##########
@@ -81,14 +93,13 @@
      *     password values in.
      *
      * @return
-     *     A Map all of tokens for the user parsed from attributes returned
-     *     by the CAS server.
+     *     The CASAuthenticatedUser instance returned by the CAS server.

Review comment:
       I'm not sure this actually addresses Mike's comment, here.  Mike is pointing out that it is inaccurate to say that the "CASAuthenticatedUser instance returned by the CAS server", because the CAS server is not returning a `CASAuthenticatedUser` instance - in fact, the CAS server does not know anything about the `CASAuthenticatedUser` class.  So, a more accurate comment would be:
   
   > A CASAuthenticatedUser instance containing the ticket data returned by the CAS server.
   
   Since the ticket _is_ what the CAS server returns.




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org