Merge branch 'release/21.2.2'

Author: cslzchen

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 We follow the CalVer (https://calver.org/) versioning scheme: YY.MINOR.MICRO.
 
+21.2.2 (04-29-2021)
+===================
+
+Fix OAuth callback authorize redirect URL and consent approval callback URL
+
 21.2.1 (04-28-2021)
 ===================
 

src/main/java/org/apereo/cas/support/oauth/web/endpoints/OAuth20CallbackAuthorizeEndpointController.java

@@ -26,6 +26,9 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import java.net.URI;
+import java.net.URISyntaxException;
+
 /**
  * OAuth callback authorize controller based on the pac4j callback controller.
  *
@@ -58,16 +61,37 @@ public ModelAndView handleRequest(final HttpServletRequest request, final HttpSe
 
         val callback = new OAuth20CallbackLogic();
         val context = new JEEContext(request, response, getOAuthConfigurationContext().getSessionStore());
+        // Build the request URL with server prefix "https://accounts.osf.io" instead of calling `context.getFullRequestURL()` which
+        // somehow uses "https://127.0.0.1". This is a work-around for a weird tomcat relative redirect issue on staging 1 and prod.
+        val serverPrefix = getOAuthConfigurationContext().getCasProperties().getServer().getPrefix();
+        val fullRequestUrl = serverPrefix + request.getRequestURI() + '?' + request.getQueryString();
+        LOGGER.debug("[OAuth callbackAuthorize] full request URL in context [{}]", context.getFullRequestURL());
+        LOGGER.debug("[OAuth callbackAuthorize] full request URL customized [{}]", fullRequestUrl);
         callback.perform(
                 context,
                 getOAuthConfigurationContext().getOauthConfig(), (object, ctx) -> Boolean.FALSE,
-                context.getFullRequestURL(),
+                fullRequestUrl,
                 Boolean.TRUE,
                 Boolean.FALSE,
                 Boolean.FALSE,
                 Authenticators.CAS_OAUTH_CLIENT
         );
         var url = callback.getRedirectUrl();
+        if (!url.startsWith(serverPrefix)) {
+            LOGGER.warn("[OAuth callbackAuthorize] redirect URL [{}] doesn't have the correct server prefix [{}]", url, serverPrefix);
+            try {
+                URI uri = new URI(url);
+                url = serverPrefix + uri.getPath() + '?' + uri.getRawQuery();
+                LOGGER.warn("[OAuth callbackAuthorize] use server prefix for redirect URL [{}]", url);
+            } catch (URISyntaxException e) {
+                modelContext.setErrorCode(OsfCasOAuth20Constants.INTERNAL_SERVER_ERROR);
+                modelContext.setErrorMsg(e.getMessage());
+                modelContext.setOsfUrl(getOsfUrl());
+                return OsfCasOAuth20Utils.produceOAuth20ErrorView(modelContext);
+            }
+        } else {
+            LOGGER.info("[OAuth callbackAuthorize] redirect URL [{}] uses the correct server prefix: [{}}]", url, serverPrefix);
+        }
         if (StringUtils.isBlank(url)) {
             modelContext.setErrorCode(OsfCasOAuth20Constants.SESSION_STALE_MISMATCH);
             LOGGER.error(modelContext.getErrorMsg());
@@ -76,7 +100,7 @@ public ModelAndView handleRequest(final HttpServletRequest request, final HttpSe
             return OsfCasOAuth20Utils.produceOAuth20ErrorView(modelContext);
         }
         val manager = new ProfileManager<>(context, context.getSessionStore());
-        LOGGER.trace("OAuth callback URL is [{}]", url);
+        LOGGER.debug("OAuth callback URL is [{}]", url);
         return getOAuthConfigurationContext().getCallbackAuthorizeViewResolver().resolve(context, manager, url);
     }
 

src/main/java/org/apereo/cas/support/oauth/web/views/OAuth20ConsentApprovalViewResolver.java

@@ -20,6 +20,7 @@
 
 import org.springframework.web.servlet.ModelAndView;
 
+import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.HashSet;
 import java.util.Map;
@@ -139,14 +140,24 @@ protected ModelAndView redirectToApproveView(final JEEContext context, final Osf
      */
     protected String getCallbackUrl(final JEEContext context) throws URISyntaxException {
         val callbackUrl = context.getFullRequestURL();
+        val serverPrefix = casProperties.getServer().getPrefix();
+        if (!callbackUrl.startsWith(serverPrefix)) {
+            LOGGER.warn("[OAuth ConsentApproval] callback URL [{}] doesn't have the correct server prefix [{}]", callbackUrl, serverPrefix);
+        } else {
+            LOGGER.info("[OAuth ConsentApproval] callback URL [{}] uses the correct server prefix [{}]", callbackUrl, serverPrefix);
+        }
+        val serverPrefixUrl = new URI(serverPrefix);
         val url = new URIBuilder(callbackUrl);
+        url.setScheme(serverPrefixUrl.getScheme());
+        url.setHost(serverPrefixUrl.getHost());
+        url.setPort(-1);
         // APPROVAL_PROMPT can be set to any value. It does not have any effect since BYPASS_APPROVAL_PROMPT is present.
         // However, setting it to EMPTY is preferred so that it is different from its original values "auto" or "force".
         url.setParameter(OsfCasOAuth20Constants.APPROVAL_PROMPT, StringUtils.EMPTY);
         url.setParameter(OAuth20Constants.BYPASS_APPROVAL_PROMPT, Boolean.TRUE.toString());
-        LOGGER.debug("Callback URL for approval submit action: [{}]", callbackUrl);
-        return url.toString();
-
+        val approvalCallbackUrl = url.toString();
+        LOGGER.info("[OAuth ConsentApproval] modified approval callback URL [{}]", approvalCallbackUrl);
+        return approvalCallbackUrl;
     }
 
     /**