Update login web flow to handle param "errorSouce"

Author: cslzchen

etc/cas/config/cas.properties

@@ -71,6 +71,7 @@ cas.logout.remove-descendant-tickets=false
 #
 cas.authn.osf-url.home=https://{{ .Values.osfDomain }}/
 cas.authn.osf-url.dashboard=https://{{ .Values.osfDomain }}/dashboard/
+cas.authn.osf-url.login-with-next=https://{{ .Values.osfDomain }}/login?next=
 cas.authn.osf-url.logout=https://{{ .Values.osfDomain }}/logout/
 cas.authn.osf-url.resend-confirmation=https://{{ .Values.osfDomain }}/resend/
 cas.authn.osf-url.forgot-password=https://{{ .Values.osfDomain }}/forgotpassword/

etc/cas/config/local/cas-local.properties

@@ -72,6 +72,7 @@ cas.logout.remove-descendant-tickets=false
 #
 cas.authn.osf-url.home=http://localhost:5000/
 cas.authn.osf-url.dashboard=http://localhost:5000/dashboard/
+cas.authn.osf-url.login-with-next=http://localhost:5000/login?next=
 cas.authn.osf-url.logout=http://localhost:5000/logout/
 cas.authn.osf-url.resend-confirmation=http://localhost:5000/resend/
 cas.authn.osf-url.forgot-password=http://localhost:5000/forgotpassword/

src/main/java/io/cos/cas/osf/configuration/model/OsfUrlProperties.java

@@ -5,6 +5,8 @@
 import lombok.experimental.Accessors;
 
 import java.io.Serializable;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
 
 /**
  * This is {@link OsfUrlProperties}.
@@ -39,6 +41,11 @@ public class OsfUrlProperties implements Serializable {
      */
     private String register;
 
+    /**
+     * OSF login endpoint with "?next=".
+     */
+    private String loginWithNext;
+
     /**
      * OSF logout endpoint URL.
      */
@@ -88,4 +95,11 @@ public class OsfUrlProperties implements Serializable {
      * OSF / COS donation page URL.
      */
     private String donate;
+
+    /**
+     * Build the default service URL using OSF login endpoint with OSF home page as destination.
+     */
+    public String constructDefaultServiceUrl() {
+        return loginWithNext + URLEncoder.encode(home, StandardCharsets.UTF_8);
+    }
 }

src/main/java/io/cos/cas/osf/web/flow/configurer/OsfCasLoginWebflowConfigurer.java

@@ -81,6 +81,7 @@ protected void createDefaultViewStates(final Flow flow) {
         createTwoFactorLoginFormView(flow);
         createInstitutionLoginView(flow);
         createOrcidLoginAutoRedirectView(flow);
+        createDefaultServiceLoginAutoRedirectView(flow);
         createOsfCasAuthenticationExceptionViewStates(flow);
     }
 
@@ -324,6 +325,11 @@ private void createOsfDefaultLoginCheckAction(final Flow flow) {
                 OsfCasWebflowConstants.TRANSITION_ID_ORCID_LOGIN_AUTO_REDIRECT,
                 OsfCasWebflowConstants.VIEW_ID_ORCID_LOGIN_AUTO_REDIRECT
         );
+        createTransitionForState(
+                action,
+                OsfCasWebflowConstants.TRANSITION_ID_DEFAULT_SERVICE_LOGIN_AUTO_REDIRECT,
+                OsfCasWebflowConstants.VIEW_ID_DEFAULT_SERVICE_LOGIN_AUTO_REDIRECT
+        );
         createTransitionForState(
                 action,
                 CasWebflowConstants.TRANSITION_ID_ERROR,
@@ -434,6 +440,19 @@ protected void createOrcidLoginAutoRedirectView(final Flow flow) {
         );
     }
 
+    /**
+     * Create the ORCiD login auto-redirect view to support the OSF feature "sign-up via ORCiD".
+     *
+     * @param flow the flow
+     */
+    protected void createDefaultServiceLoginAutoRedirectView(final Flow flow) {
+        createViewState(
+                flow,
+                OsfCasWebflowConstants.VIEW_ID_DEFAULT_SERVICE_LOGIN_AUTO_REDIRECT,
+                OsfCasWebflowConstants.VIEW_ID_DEFAULT_SERVICE_LOGIN_AUTO_REDIRECT
+        );
+    }
+
     /**
      * Create the institution SSO init view state to support the OSF feature "sign-in via institutions".
      *

src/main/java/io/cos/cas/osf/web/flow/login/OsfAbstractLoginPreparationAction.java

@@ -8,6 +8,10 @@
 import org.springframework.webflow.execution.Event;
 import org.springframework.webflow.execution.RequestContext;
 
+import java.util.Arrays;
+import java.util.LinkedList;
+import java.util.List;
+
 /**
  * This is {@link OsfAbstractLoginPreparationAction}.
  *
@@ -39,6 +43,10 @@ public abstract class OsfAbstractLoginPreparationAction extends AbstractAuthenti
 
     protected static final String PARAMETER_ORCID_REDIRECT_VALUE = "true";
 
+    protected static final String PARAMETER_ERROR_SOURCE = "errorSource";
+
+    protected static final List<String> EXPECTED_ERROR_CODES = new LinkedList<>(Arrays.asList("401", "403", "404", "405", "423"));
+
     public OsfAbstractLoginPreparationAction(
             final CasDelegatingWebflowEventResolver initialAuthenticationAttemptWebflowEventResolver,
             final CasWebflowEventResolver serviceTicketRequestWebflowEventResolver,

src/main/java/io/cos/cas/osf/web/flow/login/OsfCasPreInitialFlowSetupAction.java

@@ -2,6 +2,7 @@
 
 import io.cos.cas.osf.configuration.model.OsfUrlProperties;
 
+import io.cos.cas.osf.web.flow.support.OsfCasWebflowConstants;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
@@ -22,17 +23,16 @@
 @Slf4j
 public class OsfCasPreInitialFlowSetupAction extends AbstractAction {
 
-    private static final String OSF_URL_FLOW_PARAMETER = "osfUrl";
-
     @NotNull
     private final OsfUrlProperties osfUrlProperties;
 
     @Override
     protected Event doExecute(final RequestContext context) {
-        OsfUrlProperties osfUrl = Optional.of(context).map(requestContext
-                -> (OsfUrlProperties) requestContext.getFlowScope().get(OSF_URL_FLOW_PARAMETER)).orElse(null);
+        final OsfUrlProperties osfUrl = Optional.of(context).map(
+                requestContext -> (OsfUrlProperties) requestContext.getFlowScope().get(OsfCasWebflowConstants.FLOW_PARAMETER_OSF_URL)
+        ).orElse(null);
         if (osfUrl == null) {
-            context.getFlowScope().put(OSF_URL_FLOW_PARAMETER, osfUrlProperties);
+            context.getFlowScope().put(OsfCasWebflowConstants.FLOW_PARAMETER_OSF_URL, osfUrlProperties);
         }
         return success();
     }

src/main/java/io/cos/cas/osf/web/flow/support/OsfCasWebflowConstants.java

@@ -2,35 +2,45 @@
 
 /**
  * This is {@link OsfCasWebflowConstants}, which expands the default {@link org.apereo.cas.web.flow.CasWebflowConstants}
- * interface by adding OSF CAS customized action, state and view IDs.
+ * interface by adding OSF CAS customized action, state, transition and view IDs as well as names web flow parameters.
  *
  * @author Longze Chen
  * @since 20.0.0
  */
 
 public interface OsfCasWebflowConstants {
 
-    String ACTION_ID_OSF_PRE_INITIAL_FLOW_SETUP = "osfCasPreInitialFlowSetupAction";
+    String FLOW_PARAMETER_OSF_URL = "osfUrl";
 
-    String ACTION_ID_OSF_DEFAULT_LOGIN_CHECK = "osfDefaultLoginCheckAction";
+    String ACTION_ID_OSF_PRE_INITIAL_FLOW_SETUP = "osfCasPreInitialFlowSetupAction";
 
-    String STATE_ID_OSF_DEFAULT_LOGIN_CHECK = "osfDefaultLoginCheck";
+    String ACTION_ID_OSF_NON_INTERACTIVE_AUTHENTICATION_CHECK = "osfNonInteractiveAuthenticationCheckAction";
 
-    String TRANSITION_ID_USERNAME_PASSWORD_LOGIN = "continueToUsernamePasswordLogin";
+    String ACTION_ID_OSF_DEFAULT_LOGIN_CHECK = "osfDefaultLoginCheckAction";
 
     String ACTION_ID_OSF_INSTITUTION_LOGIN_CHECK = "osfInstitutionLoginCheckAction";
 
-    String STATE_ID_OSF_INSTITUTION_LOGIN_CHECK = "osfInstitutionLoginCheck";
+    String TRANSITION_ID_USERNAME_PASSWORD_LOGIN = "continueToUsernamePasswordLogin";
 
     String TRANSITION_ID_INSTITUTION_LOGIN = "switchToInstitutionLogin";
 
     String TRANSITION_ID_ORCID_LOGIN_AUTO_REDIRECT = "autoRedirectToOrcidLogin";
 
+    String TRANSITION_ID_DEFAULT_SERVICE_LOGIN_AUTO_REDIRECT = "autoRedirectToDefaultServiceLogin";
+
+    String STATE_ID_OSF_NON_INTERACTIVE_AUTHENTICATION_CHECK = "osfNonInteractiveAuthenticationCheck";
+
+    String STATE_ID_OSF_DEFAULT_LOGIN_CHECK = "osfDefaultLoginCheck";
+
+    String STATE_ID_OSF_INSTITUTION_LOGIN_CHECK = "osfInstitutionLoginCheck";
+
+    String VIEW_ID_INSTITUTION_SSO_INIT = "casInstitutionLoginView";
+
     String VIEW_ID_ORCID_LOGIN_AUTO_REDIRECT = "casAutoRedirectToOrcidLoginView";
 
-    String ACTION_ID_OSF_NON_INTERACTIVE_AUTHENTICATION_CHECK = "osfNonInteractiveAuthenticationCheckAction";
+    String VIEW_ID_DEFAULT_SERVICE_LOGIN_AUTO_REDIRECT = "casAutoRedirectToDefaultServiceLoginView";
 
-    String STATE_ID_OSF_NON_INTERACTIVE_AUTHENTICATION_CHECK = "osfNonInteractiveAuthenticationCheck";
+    String VIEW_ID_ONE_TIME_PASSWORD_REQUIRED = "casTwoFactorLoginView";
 
     String VIEW_ID_ACCOUNT_NOT_CONFIRMED_OSF = "casAccountNotConfirmedOsfView";
 
@@ -40,9 +50,5 @@ public interface OsfCasWebflowConstants {
 
     String VIEW_ID_INVALID_VERIFICATION_KEY = "casInvalidVerificationKeyView";
 
-    String VIEW_ID_ONE_TIME_PASSWORD_REQUIRED = "casTwoFactorLoginView";
-
-    String VIEW_ID_INSTITUTION_SSO_INIT = "casInstitutionLoginView";
-
     String VIEW_ID_INSTITUTION_SSO_FAILED = "casInstitutionSsoFailedView";
 }

src/main/java/io/cos/cas/osf/web/support/OsfCasLoginContext.java

@@ -26,7 +26,13 @@ public class OsfCasLoginContext implements Serializable  {
 
     private static final long serialVersionUID = 7523144720609509742L;
 
-    private String serviceUrl;
+    /**
+     * The encoded service URL provided by the "service=" query param in the request URL.
+     *
+     * This attribute is deprecated and should be removed since 1) ThymeLeaf handles URL building elegantly in the template and 2) both of
+     * the flow parameters "service.originalUrl" and "originalUrl" stores the current service information.
+     */
+    private String encodedServiceUrl;
 
     private String handleErrorName;
 
@@ -38,18 +44,31 @@ public class OsfCasLoginContext implements Serializable  {
 
     private String orcidLoginUrl;
 
+    private boolean defaultService;
+
+    /**
+     * The default service URL that uses OSF login endpoint with OSF home as destination.
+     *
+     * e.g. http(s)://[OSF Domain]/login?next=[encoded version of http(s)://[OSF Domain]/]
+     */
+    private String defaultServiceUrl;
+
     public OsfCasLoginContext (
-            final String serviceUrl,
+            final String encodedServiceUrl,
             final boolean institutionLogin,
             final String institutionId,
             final boolean orcidRedirect,
-            final String orcidLoginUrl
+            final String orcidLoginUrl,
+            final boolean defaultService,
+            final String defaultServiceUrl
     ) {
-        this.serviceUrl = serviceUrl;
+        this.encodedServiceUrl = encodedServiceUrl;
         this.handleErrorName = null;
         this.institutionLogin = institutionLogin;
         this.institutionId = institutionId;
         this.orcidRedirect = orcidRedirect;
         this.orcidLoginUrl = orcidLoginUrl;
+        this.defaultService = defaultService;
+        this.defaultServiceUrl = defaultServiceUrl;
     }
 }

src/main/resources/messages.properties

@@ -545,6 +545,7 @@ screen.pm.button.backtoosf=Back to OSF
 screen.delegation.button.orcid=Sign in with ORCiD
 screen.delegation.button.institution=Sign in through institution
 screen.delegation.heading.orcidredirect=Redirecting to ORCiD
+screen.flowless.heading.defaultserviceredirect=Redirecting to OSF login
 #
 # Two factor and login form submission
 #

src/main/resources/templates/casAutoRedirectToDefaultServiceLoginView.html

@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+    <head th:with="defaultServiceLoginUrl=@{/login(service=${osfCasLoginContext.defaultServiceUrl})}">
+        <!-- When this template is rendered, both ${osfCasLoginContext.defaultSerivceUrl}
+             and #{screen.flowless.heading.defaultserviceredirect} are guranteed to exist. -->
+        <meta http-equiv="refresh" th:content="${'0; url=' + defaultServiceLoginUrl}" />
+        <title th:text="#{screen.flowless.heading.defaultserviceredirect}"></title>
+    </head>
+</html>