Enable DAO for non-interactive action and send error context to flow

Author: cslzchen

src/main/java/io/cos/cas/osf/web/config/OsfCasSupportActionsConfiguration.java

@@ -100,6 +100,7 @@ public Action osfNonInteractiveAuthenticationCheckAction() {
                 serviceTicketRequestWebflowEventResolver.getObject(),
                 adaptiveAuthenticationPolicy.getObject(),
                 centralAuthenticationService.getObject(),
+                jpaOsfDao.getObject(),
                 casProperties.getAuthn().getOsfUrl(),
                 casProperties.getAuthn().getOsfApi(),
                 authnDelegationClients

src/main/java/io/cos/cas/osf/web/flow/login/OsfPrincipalFromNonInteractiveCredentialsAction.java

@@ -15,8 +15,10 @@
 import io.cos.cas.osf.authentication.exception.InstitutionSsoOsfApiFailedException;
 import io.cos.cas.osf.authentication.support.DelegationProtocol;
 import io.cos.cas.osf.authentication.support.OsfApiPermissionDenied;
+import io.cos.cas.osf.authentication.support.OsfInstitutionUtils;
 import io.cos.cas.osf.configuration.model.OsfApiProperties;
 import io.cos.cas.osf.configuration.model.OsfUrlProperties;
+import io.cos.cas.osf.dao.JpaOsfDao;
 import io.cos.cas.osf.web.support.OsfApiInstitutionAuthenticationResult;
 import io.cos.cas.osf.web.support.OsfCasSsoErrorContext;
 
@@ -142,7 +144,7 @@
 @Getter
 public class OsfPrincipalFromNonInteractiveCredentialsAction extends AbstractNonInteractiveCredentialsAction {
 
-    private static final String PARAMETER_SSO_ERROR_CONTEXT = "osfSsoErrorContext";
+    private static final String PARAMETER_SSO_ERROR_CONTEXT = "osfCasSsoErrorContext";
 
     private static final String USERNAME_PARAMETER_NAME = "username";
 
@@ -182,6 +184,9 @@ public class OsfPrincipalFromNonInteractiveCredentialsAction extends AbstractNon
     @NotNull
     private CentralAuthenticationService centralAuthenticationService;
 
+    @NotNull
+    private final JpaOsfDao jpaOsfDao;
+
     @NotNull
     private OsfUrlProperties osfUrlProperties;
 
@@ -198,6 +203,7 @@ public OsfPrincipalFromNonInteractiveCredentialsAction(
             final CasWebflowEventResolver serviceTicketRequestWebflowEventResolver,
             final AdaptiveAuthenticationPolicy adaptiveAuthenticationPolicy,
             final CentralAuthenticationService centralAuthenticationService,
+            final JpaOsfDao jpaOsfDao,
             final OsfUrlProperties osfUrlProperties,
             final OsfApiProperties osfApiProperties,
             final Map<String, List<String>> authnDelegationClients
@@ -208,6 +214,7 @@ public OsfPrincipalFromNonInteractiveCredentialsAction(
                 adaptiveAuthenticationPolicy
         );
         this.centralAuthenticationService = centralAuthenticationService;
+        this.jpaOsfDao = jpaOsfDao;
         this.osfUrlProperties = osfUrlProperties;
         this.osfApiProperties = osfApiProperties;
         this.authnDelegationClients = authnDelegationClients;
@@ -243,7 +250,8 @@ protected Credential constructCredentialsFromRequest(final RequestContext contex
                     );
                     final OsfPostgresCredential osfPostgresCredential = constructCredentialsFromPac4jAuthentication(context, clientName);
                     if (osfPostgresCredential != null) {
-                        final OsfApiInstitutionAuthenticationResult remoteUserInfo = notifyOsfApiOfInstnAuthnSuccess(osfPostgresCredential);
+                        final OsfApiInstitutionAuthenticationResult remoteUserInfo
+                                = notifyOsfApiOfInstnAuthnSuccess(context, osfPostgresCredential);
                         osfPostgresCredential.setUsername(remoteUserInfo.getSsoEmail());
                         osfPostgresCredential.setInstitutionId(remoteUserInfo.getInstitutionId());
                         WebUtils.removeCredential(context);
@@ -266,7 +274,8 @@ protected Credential constructCredentialsFromRequest(final RequestContext contex
             // Type 3: institution sso via Shibboleth authentication using the SAML protocol
             LOGGER.debug("Shibboleth session / header found in request context.");
             final OsfPostgresCredential osfPostgresCredential = constructCredentialsFromShibbolethAuthentication(context, request);
-            final OsfApiInstitutionAuthenticationResult remoteUserInfo = notifyOsfApiOfInstnAuthnSuccess(osfPostgresCredential);
+            final OsfApiInstitutionAuthenticationResult remoteUserInfo
+                    = notifyOsfApiOfInstnAuthnSuccess(context, osfPostgresCredential);
             final String ssoIdentity = osfPostgresCredential.getSsoIdentity();
             final String eppn = osfPostgresCredential.getDelegationAttributes().get("eppn");
             final String mail = osfPostgresCredential.getDelegationAttributes().get("mail");
@@ -571,6 +580,7 @@ private JSONObject extractInstnAuthnDataFromCredential(final OsfPostgresCredenti
      * @throws AccountException if there is an issue with authentication data or if the OSF API request has failed
      */
     private OsfApiInstitutionAuthenticationResult notifyOsfApiOfInstnAuthnSuccess(
+            final RequestContext context,
             final OsfPostgresCredential credential
     ) throws AccountException {
 
@@ -761,6 +771,15 @@ private OsfApiInstitutionAuthenticationResult notifyOsfApiOfInstnAuthnSuccess(
                 final String errorDetail = ((JsonObject) error).get("detail").getAsString();
                 if (OsfApiPermissionDenied.INSTITUTION_SSO_SELECTIVE_LOGIN_DENIED.getId().equals(errorDetail)) {
                     LOGGER.error("[OSF API] Failure - Institution Selective SSO Not Allowed: {}, filter={}", ssoUser, selectiveSsoFilter);
+                    setSsoErrorContext(
+                            context,
+                            InstitutionSsoSelectiveLoginDeniedException.class.getSimpleName(),
+                            String.format("Institution Selective SSO Not Allowed: %s", ssoUser),
+                            ssoEmail,
+                            ssoIdentity,
+                            institutionId,
+                            OsfInstitutionUtils.getInstitutionSupportEmail(this.jpaOsfDao, institutionId)
+                    );
                     throw new InstitutionSsoSelectiveLoginDeniedException("OSF API denies selective SSO login");
                 }
                 if (OsfApiPermissionDenied.INSTITUTION_SSO_DUPLICATE_IDENTITY.getId().equals(errorDetail)) {