GUACAMOLE-2258: Allow redirection to original page after login

  - Allow store the full URI in RequestDetails
  - Add methods to get/set originalURI in AuthenticatedUser and derived classes
  - Set the originalURI in JDBC base class
  - Promote session manager to base SSO class; Use it to store the originalURI in openid
  - Allow redirection to be stored in GuacamoleSession iff new login
  - Store the redirection in the GuacamoleSession the AuthenticationService
  - If redirection set in GuacamoleSession pass it back on the /api/tokens REST endpoint
  - In the javascript in the redirection is set on the /api/tokens endpoint, redirect after authentication

Author: David Bateman

extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderService.java

@@ -81,8 +81,10 @@ public AuthenticatedUser authenticateUser(AuthenticationProvider authenticationP
 
         // Authenticate user
         AuthenticatedUser user = userService.retrieveAuthenticatedUser(authenticationProvider, credentials);
-        if (user != null)
+        if (user != null) {
+            user.setOriginalUri(credentials.getRequestDetails().getRequestURI());
             return user;
+        }
 
         // Otherwise, unauthorized
         throw new GuacamoleInvalidCredentialsException("Invalid login", CredentialsInfo.USERNAME_PASSWORD);

extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/RemoteAuthenticatedUser.java

@@ -51,6 +51,12 @@ public abstract class RemoteAuthenticatedUser implements AuthenticatedUser {
      */
     private final Set<String> effectiveGroups;
 
+    /**
+     * The URI that was originally used to the first call to the authentication
+     * providers authenticateUser method.
+     */
+    private String originalUri;
+
     /**
      * Creates a new RemoteAuthenticatedUser, deriving the associated remote
      * host from the given credentials.
@@ -103,4 +109,14 @@ public void invalidate() {
         // Nothing to invalidate
     }
 
+    @Override
+    public void setOriginalUri(String originalUri) {
+        this.originalUri = originalUri;
+    }
+
+    @Override
+    public String getOriginalUri() {
+        return this.originalUri;
+    }
+
 }

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/session/SSOAuthenticationSession.java

@@ -0,0 +1,129 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.sso.session;
+
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.Map;
+import org.apache.guacamole.net.auth.AuthenticationSession;
+import org.apache.guacamole.net.auth.Credentials;
+
+/**
+ * Representation of an in-progress OpenID authentication attempt.
+ */
+public class SSOAuthenticationSession extends AuthenticationSession {
+    /**
+     * The key value used to store the redirection URI
+     */
+    private static String REDIRECTION = "redirection";
+
+    /**
+     * THe key value of the redirection URI in the credential parameers
+     */
+    private static String REQUEST_HREF = "href";
+
+    /**
+     * A Map of Arbitrary session data
+     */
+    private final Map<String, Object> session;
+
+    /**
+     * Creates a new AuthenticationSession representing an in-progress
+     * authentication attempt.
+     *
+     * @param session
+     *     A Map of the session data to be stored
+     * 
+     * @param expires
+     *     The number of milliseconds that may elapse before this session must
+     *     be considered invalid.
+     */
+    public SSOAuthenticationSession(Map<String,Object> session, long expires) {
+        super(expires);
+        this.session = session;
+    }
+
+    /**
+     * Creates a new AuthenticationSession representing an in-progress
+     * authentication attempt.
+     * 
+     * @param expires
+     *     The number of milliseconds that may elapse before this session must
+     *     be considered invalid.
+     */
+    public SSOAuthenticationSession(long expires) {
+        this(new ConcurrentHashMap<>(), expires);
+    }
+    
+    /**
+     * Returns the stored session data
+     *
+     * @return
+     *     The session data, can be null
+     */
+    public Map<String, Object> getSession() {
+        return session;
+    }
+
+    /**
+     * Returns an Object stored in the session data
+     *
+     * @return
+     *     The object in the session, can be null
+     */
+    public Object get(String key) {
+        return session.get(key);
+    }
+
+    /**
+     * Returns an Object stored in the session data
+     *
+     * @return
+     *     The object in the session, can be null
+     */
+    public void put(String key, Object value) {
+        session.put(key, value);
+    }
+
+    /**
+     * Special case for redirection from credentials to
+     * simplify he authentication providers
+     * 
+     * @return 
+     *      The redirection stored in teh session
+     */
+    public String getRedirection() {
+        Object obj = session.get(REDIRECTION);
+        return obj == null ? null : obj.toString();
+    }
+
+    /**
+     * Special case for redirection from credentials to
+     * simplify he authentication providers
+     * 
+     * @param credentials
+     *      The credentials from which to extract the redirection.
+     */
+    public void setRedirection(Credentials credentials) {
+        String redirection = credentials.getParameter(REQUEST_HREF);
+        put(REDIRECTION, redirection);
+    }
+}
+
+

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/session/SSOAuthenticationSessionManager.java

@@ -0,0 +1,48 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.sso.session;
+
+import java.util.Map;
+import com.google.inject.Singleton;
+import org.apache.guacamole.net.auth.AuthenticationSessionManager;
+
+/**
+ * Manager service that temporarily stores authentication attempts while
+ * the authentication flow is underway.
+ */
+@Singleton
+public class SSOAuthenticationSessionManager
+        extends AuthenticationSessionManager<SSOAuthenticationSession> {
+
+   /**
+     * Returns the stored session data used with the identity provider
+     *
+     * @param identifier
+     *     The unique string returned by the call to defer(). For convenience,
+     *     this value may safely be null.
+     *
+     * @return
+     *     The session data 
+     */
+    public SSOAuthenticationSession resume(String identifier) {
+        return super.resume(identifier);
+    }
+}
+

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/AuthenticationProviderService.java

@@ -24,31 +24,29 @@
 import com.google.inject.Singleton;
 import java.net.URI;
 import java.util.Arrays;
-import java.util.Collection;
 import java.util.Collections;
 import java.util.Map;
 import java.util.Set;
 import javax.ws.rs.core.UriBuilder;
 import org.apache.guacamole.auth.openid.conf.ConfigurationService;
-import org.apache.guacamole.auth.openid.OpenIDAuthenticationSessionManager;
 import org.apache.guacamole.auth.openid.token.TokenValidationService;
 import org.apache.guacamole.auth.openid.util.PKCEUtil;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.auth.sso.NonceService;
 import org.apache.guacamole.auth.sso.SSOAuthenticationProviderService;
+import org.apache.guacamole.auth.sso.session.SSOAuthenticationSession;
+import org.apache.guacamole.auth.sso.session.SSOAuthenticationSessionManager;
 import org.apache.guacamole.auth.sso.user.SSOAuthenticatedUser;
 import org.apache.guacamole.form.Field;
 import org.apache.guacamole.form.RedirectField;
 import org.apache.guacamole.language.TranslatableMessage;
 import org.apache.guacamole.net.auth.Credentials;
 import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
 import org.apache.guacamole.net.auth.credentials.GuacamoleInvalidCredentialsException;
-import org.apache.guacamole.net.auth.IdentifierGenerator;
 import org.jose4j.jwt.JwtClaims;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-
 /**
  * Service that authenticates Guacamole users by processing OpenID tokens.
  */
@@ -90,7 +88,7 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
      * Manager of active OpenID authentication attempts.
      */
     @Inject
-    private OpenIDAuthenticationSessionManager sessionManager;
+    private SSOAuthenticationSessionManager sessionManager;
 
     /**
      * Service for validating and generating unique nonce values.
@@ -137,11 +135,16 @@ public SSOAuthenticatedUser authenticateUser(Credentials credentials)
         Set<String> groups = null;
         Map<String,String> tokens = Collections.emptyMap();
 
-        logger.debug("OpenID authentication with '{}' reponse type (ID: {}, Secret: {}, PKCE: {})",
+        // Recover session
+        String identifier = getSessionIdentifier(credentials);
+        SSOAuthenticationSession session = sessionManager.resume(identifier);
+
+        logger.debug("OpenID authentication with '{}' reponse type (ID: {}, Secret: {}, PKCE: {}, Redirection: {})",
                   confService.getResponseType(),
                   confService.getClientID(),
                   confService.getClientSecret(),
-                  confService.isPKCERequired());
+                  confService.isPKCERequired(),
+                  credentials.getParameter("href"));
 
         if (confService.isImplicitFlow()) {
             String token = credentials.getParameter(IMPLICIT_TOKEN_PARAMETER_NAME);
@@ -157,10 +160,8 @@ public SSOAuthenticatedUser authenticateUser(Credentials credentials)
         else {
             String verifier = null;
             if (confService.isPKCERequired()) {
-                // Recover session
-                String identifier = getSessionIdentifier(credentials);
-                if (identifier != null) {
-                    verifier = sessionManager.getVerifier(identifier);
+                if (session != null) {
+                    verifier = session.get("verifier").toString();
                 }
             }
             String code = credentials.getParameter("code");
@@ -180,14 +181,17 @@ public SSOAuthenticatedUser authenticateUser(Credentials credentials)
             // Create corresponding authenticated user
             SSOAuthenticatedUser authenticatedUser = authenticatedUserProvider.get();
             authenticatedUser.init(username, credentials, groups, tokens);
+            if (session != null) {
+                authenticatedUser.setOriginalUri(session.getRedirection());
+            }
             return authenticatedUser;
         }
 
         // Request OpenID token (will automatically redirect the user to the
         // OpenID authorization page via JavaScript)
         throw new GuacamoleInvalidCredentialsException("Invalid login.",
             new CredentialsInfo(Arrays.asList(new Field[] {
-                new RedirectField(AUTH_SESSION_QUERY_PARAM, getLoginURI(),
+                new RedirectField(AUTH_SESSION_QUERY_PARAM, getLoginURI(credentials),
                         new TranslatableMessage("LOGIN.INFO_IDP_REDIRECT_PENDING"))
             }))
         );
@@ -196,6 +200,10 @@ public SSOAuthenticatedUser authenticateUser(Credentials credentials)
 
     @Override
     public URI getLoginURI() throws GuacamoleException {
+        return getLoginURI(null);
+    }
+
+    private URI getLoginURI(Credentials credentials) throws GuacamoleException {
         UriBuilder builder = UriBuilder.fromUri(confService.getAuthorizationEndpoint())
                 .queryParam("scope", confService.getScope())
                 .queryParam("response_type", confService.getResponseType().toString())
@@ -215,10 +223,14 @@ public URI getLoginURI() throws GuacamoleException {
             }
 
             // Store verifier for authenticateUser
-            OpenIDAuthenticationSession session = new OpenIDAuthenticationSession(codeVerifier,
+            SSOAuthenticationSession session = new SSOAuthenticationSession(
                         confService.getMaxPKCEVerifierValidity() * 60000L);
-            String identifier = IdentifierGenerator.generateIdentifier();
-            sessionManager.defer(session, identifier);
+            session.put("verifier", codeVerifier);
+            if (credentials != null) {
+                session.setRedirection(credentials);
+                logger.debug("Redirection set : {}", session.getRedirection());
+            }
+            String identifier = sessionManager.defer(session);
 
             builder.queryParam("code_challenge", codeChallenge)
                     .queryParam("code_challenge_method", "S256")

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/OpenIDAuthenticationProviderModule.java

@@ -25,7 +25,7 @@
 import org.apache.guacamole.auth.openid.conf.ConfigurationService;
 import org.apache.guacamole.auth.openid.conf.OpenIDEnvironment;
 import org.apache.guacamole.auth.openid.conf.OpenIDWellKnown;
-import org.apache.guacamole.auth.openid.OpenIDAuthenticationSessionManager;
+import org.apache.guacamole.auth.sso.session.SSOAuthenticationSessionManager;
 import org.apache.guacamole.auth.sso.NonceService;
 import org.apache.guacamole.auth.openid.token.TokenValidationService;
 import org.apache.guacamole.environment.Environment;
@@ -45,7 +45,7 @@ protected void configure() {
         bind(ConfigurationService.class);
         bind(NonceService.class).in(Scopes.SINGLETON);
         bind(TokenValidationService.class);
-        bind(OpenIDAuthenticationSessionManager.class);
+        bind(SSOAuthenticationSessionManager.class).in(Scopes.SINGLETON);
 
         bind(Environment.class).toInstance(environment);
     }