Surface Set-Cookie and remembered_device; mask secret headers

Support the Shibboleth plugin's API-client "remember this device" feature:

- PIResponse: add rememberedDevice (parsed from detail.remembered_device)
  and setCookieHeaders (the raw Set-Cookie response headers, which the JSON
  body does not carry).
- Endpoint/AsyncRequestCallable/PrivacyIDEA: capture the response Set-Cookie
  headers and thread them out via a new submitRequest() so validateCheck can
  attach them to the returned PIResponse.
- Endpoint: never log the X-API-Key or Cookie header values (masked like
  pass); the full API key was previously written to the header dump.
- PrivacyIDEA: log the "no service account configured" message at info
  level instead of error (it is a normal configuration).
- Bump version to 1.5.2.

Author: nilsbehlen

pom.xml

@@ -5,7 +5,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>org.privacyidea</groupId>
     <artifactId>privacyidea-java-client</artifactId>
-    <version>1.5.1</version>
+    <version>1.5.2</version>
     <packaging>jar</packaging>
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

src/main/java/org/privacyidea/AsyncRequestCallable.java

@@ -41,6 +41,10 @@ public class AsyncRequestCallable implements Callable<String>, Callback
     private final Endpoint endpoint;
     private final PrivacyIDEA privacyIDEA;
     final String[] callbackResult = {null};
+    // Body returned by call() (mirrors callbackResult[0], or null on timeout/failure) and the raw
+    // Set-Cookie response header(s). Populated on the request thread, read after the Future completes.
+    String body = null;
+    final java.util.List<String> setCookies = new java.util.ArrayList<>();
     private CountDownLatch latch;
 
     public AsyncRequestCallable(PrivacyIDEA privacyIDEA, Endpoint endpoint, String path, Map<String, String> params,
@@ -82,6 +86,7 @@ public void onResponse(@NotNull Call call, @NotNull Response response) throws IO
         // Using try-with-resources guarantees the body is properly closed after reading.
         try (ResponseBody responseBody = response.body())
         {
+            setCookies.addAll(response.headers("Set-Cookie"));
             if (responseBody != null)
             {
                 String s = responseBody.string();

src/main/java/org/privacyidea/Endpoint.java

@@ -31,12 +31,15 @@
 import javax.net.ssl.X509TrustManager;
 import okhttp3.Callback;
 import okhttp3.FormBody;
+import okhttp3.Headers;
 import okhttp3.HttpUrl;
 import okhttp3.OkHttpClient;
 import okhttp3.Request;
 
 import static org.privacyidea.PIConstants.GET;
+import static org.privacyidea.PIConstants.HEADER_COOKIE;
 import static org.privacyidea.PIConstants.HEADER_USER_AGENT;
+import static org.privacyidea.PIConstants.HEADER_X_API_KEY;
 import static org.privacyidea.PIConstants.POST;
 import static org.privacyidea.PIConstants.WEBAUTHN_PARAMETERS;
 
@@ -193,7 +196,20 @@ void sendRequestAsync(String endpoint, Map<String, String> params, Map<String, S
         }
 
         Request request = requestBuilder.build();
-        privacyIDEA.log("Header: " + request.headers().toString().replace("\n", " | "));
+        // Log headers, but never the secret values (API key, session cookie).
+        Headers reqHeaders = request.headers();
+        StringBuilder headerLog = new StringBuilder("Header: ");
+        for (int i = 0; i < reqHeaders.size(); i++)
+        {
+            String name = reqHeaders.name(i);
+            String value = reqHeaders.value(i);
+            if (HEADER_X_API_KEY.equalsIgnoreCase(name) || HEADER_COOKIE.equalsIgnoreCase(name))
+            {
+                value = "<hidden>";
+            }
+            headerLog.append(name).append(": ").append(value).append(" | ");
+        }
+        privacyIDEA.log(headerLog.toString());
         client.newCall(request).enqueue(callback);
     }
 }

src/main/java/org/privacyidea/JSONParser.java

@@ -244,6 +244,7 @@ else if ("interactive".equals(modeFromResponse))
             response.otpLength = getInt(detail, OTPLEN);
             response.isEnrollViaMultichallenge = getBoolean(detail, "enroll_via_multichallenge");
             response.isEnrollViaMultichallengeOptional = getBoolean(detail, "enroll_via_multichallenge_optional");
+            response.rememberedDevice = getBoolean(detail, "remembered_device");
             // The enrollment link can be in the detail or in one of the
             JsonObject passkeyChallenge = detail.getAsJsonObject(PASSKEY);
             if (passkeyChallenge != null && !passkeyChallenge.isJsonNull())

src/main/java/org/privacyidea/PIConstants.java

@@ -36,6 +36,9 @@ public class PIConstants
     public static final String HEADER_ORIGIN = "Origin";
     public static final String HEADER_AUTHORIZATION = "Authorization";
     public static final String HEADER_USER_AGENT = "User-Agent";
+    // Secret headers whose values must never be written to the log.
+    public static final String HEADER_X_API_KEY = "X-API-Key";
+    public static final String HEADER_COOKIE = "Cookie";
 
     // TOKEN TYPES / CONTAINER
     public static final String TOKEN_TYPE_PUSH = "push";

src/main/java/org/privacyidea/PIResponse.java

@@ -70,6 +70,13 @@ public class PIResponse
     public String webAuthnSignRequest = "";
     public String webAuthnTransactionId = "";
 
+    // Remember-this-device: detail.remembered_device reports whether a presented persistent-session
+    // cookie was recognised. setCookieHeaders carries the raw Set-Cookie response header(s) (e.g. the
+    // rotated pi_remember_device cookie) which the JSON body does not contain; it is populated by
+    // PrivacyIDEA#validateCheck after parsing, not by fromJSON.
+    public boolean rememberedDevice = false;
+    public transient List<String> setCookieHeaders = new ArrayList<>();
+
     public boolean authenticationSuccessful()
     {
         if (authentication == AuthenticationStatus.ACCEPT && (multiChallenge == null || multiChallenge.isEmpty()))

src/main/java/org/privacyidea/PrivacyIDEA.java

@@ -26,7 +26,6 @@
 import java.util.Objects;
 import java.util.concurrent.ArrayBlockingQueue;
 import java.util.concurrent.BlockingQueue;
-import java.util.concurrent.Callable;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.ExecutionException;
 import java.util.concurrent.Executors;
@@ -95,7 +94,7 @@ private PrivacyIDEA(PIConfig configuration, IPILogger logger, IPISimpleLogger si
         }
         else
         {
-            error("No service account configured. No JWT will be retrieved.");
+            log("No service account configured. No JWT will be retrieved.");
         }
     }
 
@@ -209,8 +208,14 @@ private PIResponse getPIResponse(String type, String input, String pass, Map<Str
         {
             params.put(TRANSACTION_ID, transactionID);
         }
-        String response = runRequestAsync(ENDPOINT_VALIDATE_CHECK, params, headers, false, POST);
-        return this.parser.parsePIResponse(response);
+        AsyncRequestCallable callable = submitRequest(ENDPOINT_VALIDATE_CHECK, params, headers, false, POST);
+        PIResponse piResponse = this.parser.parsePIResponse(callable.body);
+        if (piResponse != null)
+        {
+            // The rotated pi_remember_device cookie lives in the Set-Cookie response header, not the body.
+            piResponse.setCookieHeaders = callable.setCookies;
+        }
+        return piResponse;
     }
 
     /**
@@ -588,24 +593,33 @@ public boolean serviceAccountAvailable()
      */
     private String runRequestAsync(String path, Map<String, String> params, Map<String, String> headers, boolean authorizationRequired,
                                    String method)
+    {
+        return submitRequest(path, params, headers, authorizationRequired, method).body;
+    }
+
+    /**
+     * Like {@link #runRequestAsync} but returns the completed callable so callers can also read
+     * response metadata (e.g. Set-Cookie headers) that the plain body string does not carry.
+     */
+    private AsyncRequestCallable submitRequest(String path, Map<String, String> params, Map<String, String> headers,
+                                               boolean authorizationRequired, String method)
     {
         if (authorizationRequired)
         {
             // Wait for the JWT to be retrieved and add it to the header
             headers.put(PIConstants.HEADER_AUTHORIZATION, getJWT());
         }
-        Callable<String> callable = new AsyncRequestCallable(this, this.endpoint, path, params, headers, method);
+        AsyncRequestCallable callable = new AsyncRequestCallable(this, this.endpoint, path, params, headers, method);
         Future<String> future = this.threadPool.submit(callable);
-        String response = null;
         try
         {
-            response = future.get();
+            callable.body = future.get();
         }
         catch (InterruptedException | ExecutionException e)
         {
             log("runRequestAsync: " + e.getLocalizedMessage());
         }
-        return response;
+        return callable;
     }
 
     /**