Merge branch 'cslzchen/fix-flow-init-and-400s' into feature/institution-sso

Author: cslzchen

etc/cas/config/cas.properties

@@ -71,6 +71,7 @@ cas.logout.remove-descendant-tickets=false
 #
 cas.authn.osf-url.home=https://{{ .Values.osfDomain }}/
 cas.authn.osf-url.dashboard=https://{{ .Values.osfDomain }}/dashboard/
+cas.authn.osf-url.login-with-next=https://{{ .Values.osfDomain }}/login?next=
 cas.authn.osf-url.logout=https://{{ .Values.osfDomain }}/logout/
 cas.authn.osf-url.resend-confirmation=https://{{ .Values.osfDomain }}/resend/
 cas.authn.osf-url.forgot-password=https://{{ .Values.osfDomain }}/forgotpassword/

etc/cas/config/local/cas-local.properties

@@ -72,6 +72,7 @@ cas.logout.remove-descendant-tickets=false
 #
 cas.authn.osf-url.home=http://localhost:5000/
 cas.authn.osf-url.dashboard=http://localhost:5000/dashboard/
+cas.authn.osf-url.login-with-next=http://localhost:5000/login?next=
 cas.authn.osf-url.logout=http://localhost:5000/logout/
 cas.authn.osf-url.resend-confirmation=http://localhost:5000/resend/
 cas.authn.osf-url.forgot-password=http://localhost:5000/forgotpassword/

src/main/java/io/cos/cas/osf/configuration/model/OsfUrlProperties.java

@@ -5,6 +5,8 @@
 import lombok.experimental.Accessors;
 
 import java.io.Serializable;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
 
 /**
  * This is {@link OsfUrlProperties}.
@@ -39,6 +41,11 @@ public class OsfUrlProperties implements Serializable {
      */
     private String register;
 
+    /**
+     * OSF login endpoint with "?next=".
+     */
+    private String loginWithNext;
+
     /**
      * OSF logout endpoint URL.
      */
@@ -88,4 +95,11 @@ public class OsfUrlProperties implements Serializable {
      * OSF / COS donation page URL.
      */
     private String donate;
+
+    /**
+     * Build the default service URL using OSF login endpoint with OSF home page as destination.
+     */
+    public String constructDefaultServiceUrl() {
+        return loginWithNext + URLEncoder.encode(home, StandardCharsets.UTF_8);
+    }
 }

src/main/java/io/cos/cas/osf/web/config/OsfCasSupportActionsConfiguration.java

@@ -3,6 +3,7 @@
 import io.cos.cas.osf.dao.JpaOsfDao;
 import io.cos.cas.osf.web.flow.login.OsfDefaultLoginPreparationAction;
 import io.cos.cas.osf.web.flow.login.OsfInstitutionLoginPreparationAction;
+import io.cos.cas.osf.web.flow.login.OsfCasPreInitialFlowSetupAction;
 import io.cos.cas.osf.web.flow.login.OsfPrincipalFromNonInteractiveCredentialsAction;
 
 import org.apereo.cas.CentralAuthenticationService;
@@ -22,7 +23,6 @@
 import org.springframework.webflow.execution.Action;
 
 import java.util.LinkedHashMap;
-import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
 
@@ -48,7 +48,6 @@ public class OsfCasSupportActionsConfiguration extends CasSupportActionsConfigur
     @Qualifier("initialAuthenticationAttemptWebflowEventResolver")
     private ObjectProvider<CasDelegatingWebflowEventResolver> initialAuthenticationAttemptWebflowEventResolver;
 
-
     @Autowired
     @Qualifier("adaptiveAuthenticationPolicy")
     private ObjectProvider<AdaptiveAuthenticationPolicy> adaptiveAuthenticationPolicy;
@@ -60,6 +59,16 @@ public class OsfCasSupportActionsConfiguration extends CasSupportActionsConfigur
     @Autowired
     private ObjectProvider<JpaOsfDao> jpaOsfDao;
 
+    /**
+     * Bean configuration for {@link OsfCasPreInitialFlowSetupAction}.
+     *
+     * @return the initialized action
+     */
+    @Bean
+    public Action osfCasPreInitialFlowSetupAction() {
+        return new OsfCasPreInitialFlowSetupAction(casProperties.getAuthn().getOsfUrl());
+    }
+
     /**
      * Bean configuration for {@link OsfPrincipalFromNonInteractiveCredentialsAction}.
      *

src/main/java/io/cos/cas/osf/web/flow/config/OsfCasWebflowContextConfiguration.java

@@ -1,6 +1,7 @@
 package io.cos.cas.osf.web.flow.config;
 
 import io.cos.cas.osf.web.flow.configurer.OsfCasLoginWebflowConfigurer;
+import io.cos.cas.osf.web.flow.configurer.OsfCasLogoutWebFlowConfigurer;
 
 import org.apereo.cas.configuration.CasConfigurationProperties;
 import org.apereo.cas.web.flow.CasWebflowConfigurer;
@@ -46,4 +47,16 @@ public CasWebflowConfigurer defaultWebflowConfigurer() {
         osfCasLoginWebflowConfigurer.setOrder(Ordered.HIGHEST_PRECEDENCE);
         return osfCasLoginWebflowConfigurer;
     }
+
+    @Override
+    @Bean
+    @Order(DEFAULT_WEB_FLOW_CONFIGURER_ORDER)
+    @Lazy(false)
+    public CasWebflowConfigurer defaultLogoutWebflowConfigurer() {
+        OsfCasLogoutWebFlowConfigurer osfCasLogoutWebFlowConfigurer
+                = new OsfCasLogoutWebFlowConfigurer(builder(), loginFlowRegistry(), applicationContext, casProperties);
+        osfCasLogoutWebFlowConfigurer.setLogoutFlowDefinitionRegistry(logoutFlowRegistry());
+        osfCasLogoutWebFlowConfigurer.setOrder(Ordered.HIGHEST_PRECEDENCE);
+        return osfCasLogoutWebFlowConfigurer;
+    }
 }

src/main/java/io/cos/cas/osf/web/flow/configurer/OsfCasLoginWebflowConfigurer.java

@@ -26,6 +26,7 @@
 import org.springframework.context.ConfigurableApplicationContext;
 import org.springframework.webflow.core.collection.MutableAttributeMap;
 import org.springframework.webflow.definition.registry.FlowDefinitionRegistry;
+import org.springframework.webflow.engine.ActionList;
 import org.springframework.webflow.engine.ActionState;
 import org.springframework.webflow.engine.Flow;
 import org.springframework.webflow.engine.History;
@@ -66,13 +67,21 @@ public OsfCasLoginWebflowConfigurer(
         super(flowBuilderServices, flowDefinitionRegistry, applicationContext, casProperties);
     }
 
+    @Override
+    protected void createInitialFlowActions(final Flow flow) {
+        final ActionList startActionList = flow.getStartActionList();
+        startActionList.add(createEvaluateAction(OsfCasWebflowConstants.ACTION_ID_OSF_PRE_INITIAL_FLOW_SETUP));
+        super.createInitialFlowActions(flow);
+    }
+
     @Override
     protected void createDefaultViewStates(final Flow flow) {
         super.createDefaultViewStates(flow);
         // Create OSF customized view states
         createTwoFactorLoginFormView(flow);
         createInstitutionLoginView(flow);
         createOrcidLoginAutoRedirectView(flow);
+        createDefaultServiceLoginAutoRedirectView(flow);
         createOsfCasAuthenticationExceptionViewStates(flow);
     }
 
@@ -316,6 +325,11 @@ private void createOsfDefaultLoginCheckAction(final Flow flow) {
                 OsfCasWebflowConstants.TRANSITION_ID_ORCID_LOGIN_AUTO_REDIRECT,
                 OsfCasWebflowConstants.VIEW_ID_ORCID_LOGIN_AUTO_REDIRECT
         );
+        createTransitionForState(
+                action,
+                OsfCasWebflowConstants.TRANSITION_ID_DEFAULT_SERVICE_LOGIN_AUTO_REDIRECT,
+                OsfCasWebflowConstants.VIEW_ID_DEFAULT_SERVICE_LOGIN_AUTO_REDIRECT
+        );
         createTransitionForState(
                 action,
                 CasWebflowConstants.TRANSITION_ID_ERROR,
@@ -426,6 +440,19 @@ protected void createOrcidLoginAutoRedirectView(final Flow flow) {
         );
     }
 
+    /**
+     * Create the ORCiD login auto-redirect view to support the OSF feature "sign-up via ORCiD".
+     *
+     * @param flow the flow
+     */
+    protected void createDefaultServiceLoginAutoRedirectView(final Flow flow) {
+        createViewState(
+                flow,
+                OsfCasWebflowConstants.VIEW_ID_DEFAULT_SERVICE_LOGIN_AUTO_REDIRECT,
+                OsfCasWebflowConstants.VIEW_ID_DEFAULT_SERVICE_LOGIN_AUTO_REDIRECT
+        );
+    }
+
     /**
      * Create the institution SSO init view state to support the OSF feature "sign-in via institutions".
      *
@@ -438,5 +465,4 @@ protected void createInstitutionLoginView(final Flow flow) {
                 OsfCasWebflowConstants.VIEW_ID_INSTITUTION_SSO_INIT
         );
     }
-
 }

src/main/java/io/cos/cas/osf/web/flow/configurer/OsfCasLogoutWebFlowConfigurer.java

@@ -0,0 +1,49 @@
+package io.cos.cas.osf.web.flow.configurer;
+
+import io.cos.cas.osf.web.flow.support.OsfCasWebflowConstants;
+
+import org.apereo.cas.configuration.CasConfigurationProperties;
+import org.apereo.cas.web.flow.configurer.DefaultLogoutWebflowConfigurer;
+
+import org.springframework.context.ConfigurableApplicationContext;
+import org.springframework.webflow.definition.registry.FlowDefinitionRegistry;
+import org.springframework.webflow.engine.ActionList;
+import org.springframework.webflow.engine.Flow;
+import org.springframework.webflow.engine.builder.support.FlowBuilderServices;
+
+/**
+ * This is {@link OsfCasLogoutWebFlowConfigurer}.
+ *
+ * @author Longze Chen
+ * @since 20.2.0
+ */
+public class OsfCasLogoutWebFlowConfigurer extends DefaultLogoutWebflowConfigurer {
+
+    public OsfCasLogoutWebFlowConfigurer(
+            final FlowBuilderServices flowBuilderServices,
+            final FlowDefinitionRegistry flowDefinitionRegistry,
+            final ConfigurableApplicationContext applicationContext,
+            final CasConfigurationProperties casProperties
+    ) {
+        super(flowBuilderServices, flowDefinitionRegistry, applicationContext, casProperties);
+    }
+
+    @Override
+    protected void doInitialize() {
+        final Flow flow = getLogoutFlow();
+        if (flow != null) {
+            createInitialFlowActions(flow);
+        }
+        super.doInitialize();
+    }
+
+    /**
+     * Create initial flow actions similar to {@link OsfCasLoginWebflowConfigurer#createInitialFlowActions(Flow)}.
+     *
+     * @param flow the flow
+     */
+    protected void createInitialFlowActions(final Flow flow) {
+        final ActionList startActionList = flow.getStartActionList();
+        startActionList.add(createEvaluateAction(OsfCasWebflowConstants.ACTION_ID_OSF_PRE_INITIAL_FLOW_SETUP));
+    }
+}

src/main/java/io/cos/cas/osf/web/flow/login/OsfAbstractLoginPreparationAction.java

@@ -8,6 +8,10 @@
 import org.springframework.webflow.execution.Event;
 import org.springframework.webflow.execution.RequestContext;
 
+import java.util.Arrays;
+import java.util.LinkedList;
+import java.util.List;
+
 /**
  * This is {@link OsfAbstractLoginPreparationAction}.
  *
@@ -39,6 +43,10 @@ public abstract class OsfAbstractLoginPreparationAction extends AbstractAuthenti
 
     protected static final String PARAMETER_ORCID_REDIRECT_VALUE = "true";
 
+    protected static final String PARAMETER_ERROR_SOURCE = "errorSource";
+
+    protected static final List<String> EXPECTED_ERROR_CODES = new LinkedList<>(Arrays.asList("401", "403", "404", "405", "423"));
+
     public OsfAbstractLoginPreparationAction(
             final CasDelegatingWebflowEventResolver initialAuthenticationAttemptWebflowEventResolver,
             final CasWebflowEventResolver serviceTicketRequestWebflowEventResolver,

src/main/java/io/cos/cas/osf/web/flow/login/OsfCasPreInitialFlowSetupAction.java

@@ -0,0 +1,39 @@
+package io.cos.cas.osf.web.flow.login;
+
+import io.cos.cas.osf.configuration.model.OsfUrlProperties;
+
+import io.cos.cas.osf.web.flow.support.OsfCasWebflowConstants;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import org.springframework.webflow.action.AbstractAction;
+import org.springframework.webflow.execution.Event;
+import org.springframework.webflow.execution.RequestContext;
+
+import javax.validation.constraints.NotNull;
+import java.util.Optional;
+
+/**
+ * This is {@link OsfCasPreInitialFlowSetupAction}.
+ *
+ * @author Longze Chen
+ * @since 20.2.0
+ */
+@RequiredArgsConstructor
+@Slf4j
+public class OsfCasPreInitialFlowSetupAction extends AbstractAction {
+
+    @NotNull
+    private final OsfUrlProperties osfUrlProperties;
+
+    @Override
+    protected Event doExecute(final RequestContext context) {
+        final OsfUrlProperties osfUrl = Optional.of(context).map(
+                requestContext -> (OsfUrlProperties) requestContext.getFlowScope().get(OsfCasWebflowConstants.FLOW_PARAMETER_OSF_URL)
+        ).orElse(null);
+        if (osfUrl == null) {
+            context.getFlowScope().put(OsfCasWebflowConstants.FLOW_PARAMETER_OSF_URL, osfUrlProperties);
+        }
+        return success();
+    }
+}

src/main/java/io/cos/cas/osf/web/flow/login/OsfPrincipalFromNonInteractiveCredentialsAction.java

@@ -80,7 +80,6 @@
 import java.util.Date;
 import java.util.List;
 import java.util.Map;
-import java.util.Optional;
 
 /**
  * This is {@link OsfPrincipalFromNonInteractiveCredentialsAction}.
@@ -265,12 +264,6 @@ protected Credential constructCredentialsFromRequest(final RequestContext contex
 
     @Override
     protected Event doPreExecute(final RequestContext context) throws Exception {
-        // Put server-specific OSF URLs into the flow scope
-        OsfUrlProperties osfUrl = Optional.of(context).map(requestContext
-                -> (OsfUrlProperties) requestContext.getFlowScope().get(OSF_URL_FLOW_PARAMETER)).orElse(null);
-        if (osfUrl == null) {
-            context.getFlowScope().put(OSF_URL_FLOW_PARAMETER, osfUrlProperties);
-        }
         // super.doPreExecute() calls constructCredentialsFromRequest() whose exception must be caught and returned as a flow event
         try {
             return super.doPreExecute(context);