oidc: handle session invalidation errors (#1239)

Improve the handling of session invalidation errors. Useful for multi-server
setups in situations when the session cookie is being loaded on a different
server than created it.

Author: ibodrov

server/plugins/oidc/src/main/java/com/walmartlabs/concord/server/plugins/oidc/OidcCallbackFilter.java

@@ -30,6 +30,7 @@
 import javax.servlet.ServletResponse;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
 import java.io.IOException;
 
 public class OidcCallbackFilter implements Filter {
@@ -87,7 +88,7 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
 
         if (code == null || state == null || !state.equals(expectedState)) {
             log.warn("Invalid callback parameters: code={}, state={}, expectedState={}", code != null, state, expectedState);
-            session.invalidate();
+            invalidateOrWarn(session);
             resp.sendRedirect(resp.encodeRedirectURL(OidcAuthFilter.URL + "?from=" + postLoginUrl));
             return;
         }
@@ -103,9 +104,17 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
             resp.sendRedirect(resp.encodeRedirectURL(postLoginUrl));
 
         } catch (Exception e) {
-            log.warn("OIDC callback error: {}", e.getMessage());
-            session.invalidate();
+            log.warn("OIDC callback error", e);
+            invalidateOrWarn(session);
             resp.sendRedirect(resp.encodeRedirectURL(OidcAuthFilter.URL + "?from=" + postLoginUrl));
         }
     }
+
+    private static void invalidateOrWarn(HttpSession session) {
+        try {
+            session.invalidate();
+        } catch (Exception e) {
+            log.warn("Unable to invalidate the session", e);
+        }
+    }
 }