[SYNCOPE-2007] Adding configurable JCacheSessionStore for OIDCC4UI

Author: ilgrosso

client/idm/console/src/main/java/org/apache/syncope/client/console/topology/Topology.java

@@ -73,6 +73,10 @@ public class Topology extends BasePage {
 
     public static final String CONNECTOR_SERVER_LOCATION_PREFIX = "connid://";
 
+    public static String sanitizeMarkupId(final String input) {
+        return input.replaceAll("[^a-zA-Z0-9._-]", "_");
+    }
+
     @SpringBean
     protected ServiceOps serviceOps;
 
@@ -224,7 +228,7 @@ public void onClick(final AjaxRequestTarget target, final Serializable ignore) {
         // Add Syncope (root topologynode)
         // -----------------------------------------
         String rootName = StringUtils.capitalize(Constants.SYNCOPE);
-        final TopologyNode syncopeTopologyNode = new TopologyNode(rootName, rootName, TopologyNode.Kind.SYNCOPE);
+        TopologyNode syncopeTopologyNode = new TopologyNode(rootName, rootName, TopologyNode.Kind.SYNCOPE);
         syncopeTopologyNode.setX(origX);
         syncopeTopologyNode.setY(origY);
 
@@ -234,9 +238,9 @@ public void onClick(final AjaxRequestTarget target, final Serializable ignore) {
 
         body.add(topologyNodePanel(Constants.SYNCOPE, syncopeTopologyNode, false));
 
-        Map<Serializable, Map<Serializable, TopologyNode>> connections = new HashMap<>();
-        Map<Serializable, TopologyNode> syncopeConnections = new HashMap<>();
-        connections.put(syncopeTopologyNode.getKey(), syncopeConnections);
+        Map<String, Map<String, TopologyNode>> connections = new HashMap<>();
+        Map<String, TopologyNode> syncopeConnections = new HashMap<>();
+        connections.put(sanitizeMarkupId(syncopeTopologyNode.getKey()), syncopeConnections);
 
         // required to retrieve parent positions
         Map<String, TopologyNode> servers = new HashMap<>();
@@ -273,8 +277,8 @@ protected void populateItem(final ListItem<URI> item) {
 
                 item.add(topologyNodePanel("cs", topologynode, false));
 
-                syncopeConnections.put(url, topologynode);
-                connections.put(url, new HashMap<>());
+                syncopeConnections.put(sanitizeMarkupId(url), topologynode);
+                connections.put(sanitizeMarkupId(url), new HashMap<>());
             }
         };
 
@@ -312,8 +316,8 @@ protected void populateItem(final ListItem<URI> item) {
 
                 item.add(topologyNodePanel("fp", topologynode, false));
 
-                syncopeConnections.put(url, topologynode);
-                connections.put(url, new HashMap<>());
+                syncopeConnections.put(sanitizeMarkupId(url), topologynode);
+                connections.put(sanitizeMarkupId(url), new HashMap<>());
             }
         };
 
@@ -369,7 +373,7 @@ protected void populateItem(final ListItem<ConnInstanceTO> item) {
                         item.add(topologyNodePanel("conn", topologynode, conn.isErrored()));
 
                         // Update connections
-                        Map<Serializable, TopologyNode> remoteConnections;
+                        Map<String, TopologyNode> remoteConnections;
                         if (connections.containsKey(conn.getLocation())) {
                             remoteConnections = connections.get(conn.getLocation());
                         } else {
@@ -404,7 +408,7 @@ protected void populateItem(final ListItem<ConnInstanceTO> item) {
                     TopologyNode topologynode = new TopologyNode(
                             resourceTO.getKey(), resourceTO.getKey(), TopologyNode.Kind.RESOURCE);
 
-                    Map<Serializable, TopologyNode> remoteConnections;
+                    Map<String, TopologyNode> remoteConnections;
                     if (connections.containsKey(resourceTO.getConnector())) {
                         remoteConnections = connections.get(resourceTO.getConnector());
                     } else {
@@ -480,10 +484,11 @@ protected void populateItem(final ListItem<TopologyNode> item) {
 
             @Override
             public void renderHead(final Component component, final IHeaderResponse response) {
-                final StringBuilder jsPlumbConf = new StringBuilder();
-                jsPlumbConf.append(String.format(Locale.US, "activate(%.2f);", 0.68f));
+                StringBuilder jsPlumbConf = new StringBuilder(String.format(Locale.US, "activate(%.2f);", 0.68f));
+
+                connections.forEach((key, value) -> value.forEach((label, node) -> jsPlumbConf.append(
+                        "connect('%s','%s','%s');".formatted(sanitizeMarkupId(key), label, node.getKind()))));
 
-                createConnections(connections).forEach(jsPlumbConf::append);
                 jsPlumbConf.append("restoreTopologyLayout();");
 
                 response.render(OnDomReadyHeaderItem.forScript(jsPlumbConf.toString()));
@@ -538,18 +543,9 @@ protected void populateItem(final ListItem<TopologyNode> item) {
         newlyCreatedContainer.add(newlyCreated);
     }
 
-    private static List<String> createConnections(final Map<Serializable, Map<Serializable, TopologyNode>> targets) {
-        List<String> list = new ArrayList<>();
-
-        targets.forEach((key, value) -> value.forEach((label, node) -> list.add(
-                "connect('%s','%s','%s');".formatted(key, label, node.getKind()))));
-
-        return list;
-    }
-
     private TopologyNodePanel topologyNodePanel(final String id, final TopologyNode node, final boolean errored) {
         TopologyNodePanel panel = new TopologyNodePanel(id, node, errored);
-        panel.setMarkupId(String.valueOf(node.getKey()));
+        panel.setMarkupId(sanitizeMarkupId(node.getKey()));
         panel.setOutputMarkupId(true);
 
         List<Behavior> behaviors = new ArrayList<>();
@@ -561,7 +557,7 @@ private TopologyNodePanel topologyNodePanel(final String id, final TopologyNode
             @Override
             public void renderHead(final Component component, final IHeaderResponse response) {
                 response.render(OnDomReadyHeaderItem.forScript("setPosition('%s', %d, %d)".
-                        formatted(node.getKey(), node.getX(), node.getY())));
+                        formatted(sanitizeMarkupId(node.getKey()), node.getX(), node.getY())));
             }
         });
 

client/idm/console/src/main/java/org/apache/syncope/client/console/topology/TopologyNodePanel.java

@@ -94,7 +94,7 @@ public TopologyNodePanel(final String id, final TopologyNode node, final boolean
             add(AttributeModifier.append("data-original-title", title));
         }
 
-        this.setMarkupId(node.getDisplayName());
+        setMarkupId(Topology.sanitizeMarkupId(node.getDisplayName()));
     }
 
     @Override

docker/core/src/main/resources/core-oidc.properties

@@ -0,0 +1,20 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# with Core replication, enabling the session store requires to setup a JCache distributed provider
+oidc.c4ui.session-store-enabled=false
+oidc.c4ui.session-store-expiration-minutes=10

ext/oidcc4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/resources/oidcc4ui/BeforeLogoutResource.java

@@ -50,7 +50,7 @@ protected ResourceResponse newResourceResponse(final Attributes attributes) {
         response.setStatusCode(Response.Status.FOUND.getStatusCode());
         response.getHeaders().addHeader(HttpHeaders.CACHE_CONTROL, "no-cache, no-store");
         response.getHeaders().addHeader("Pragma", "no-cache");
-        response.getHeaders().addHeader(HttpHeaders.LOCATION, logoutRequest.getLocation());
+        response.getHeaders().addHeader(HttpHeaders.LOCATION, logoutRequest.location());
 
         Session.get().invalidate();
 

ext/oidcc4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/resources/oidcc4ui/CodeConsumerResource.java

@@ -61,6 +61,7 @@ protected ResourceResponse newResourceResponse(final Attributes attributes) {
 
         OIDCC4UIService service = BaseSession.class.cast(Session.get()).getAnonymousService(OIDCC4UIService.class);
         OIDCLoginResponse response = service.login(
+                Session.get().getAttribute(OIDCConstants.REQUEST_ID).toString(),
                 request.getRequestURL().toString(),
                 authorizationCode,
                 Session.get().getAttribute(OIDCConstants.OP).toString());

ext/oidcc4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/resources/oidcc4ui/LoginResource.java

@@ -54,12 +54,13 @@ protected ResourceResponse newResourceResponse(final Attributes attributes) {
         OIDCRequest loginRequest = service.createLoginRequest(redirectURI, op, reauth);
 
         Session.get().setAttribute(OIDCConstants.OP, op);
+        Session.get().setAttribute(OIDCConstants.REQUEST_ID, loginRequest.id());
 
         ResourceResponse response = new ResourceResponse();
         response.setStatusCode(Response.Status.FOUND.getStatusCode());
         response.getHeaders().addHeader(HttpHeaders.CACHE_CONTROL, "no-cache, no-store");
         response.getHeaders().addHeader("Pragma", "no-cache");
-        response.getHeaders().addHeader(HttpHeaders.LOCATION, loginRequest.getLocation());
+        response.getHeaders().addHeader(HttpHeaders.LOCATION, loginRequest.location());
 
         return response;
     }

ext/oidcc4ui/common-lib/src/main/java/org/apache/syncope/common/lib/oidc/OIDCConstants.java

@@ -26,6 +26,8 @@ public final class OIDCConstants {
 
     public static final String OP = "op";
 
+    public static final String REQUEST_ID = "requestId";
+
     public static final String LOGOUT_TOKEN = "logout_token";
 
     private OIDCConstants() {

ext/oidcc4ui/common-lib/src/main/java/org/apache/syncope/common/lib/oidc/OIDCRequest.java

@@ -20,17 +20,6 @@
 
 import java.io.Serializable;
 
-public class OIDCRequest implements Serializable {
+public record OIDCRequest(String id, String location) implements Serializable {
 
-    private static final long serialVersionUID = -3509031322459942441L;
-
-    private String location;
-
-    public String getLocation() {
-        return location;
-    }
-
-    public void setLocation(final String location) {
-        this.location = location;
-    }
 }

ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/OIDCC4UILogic.java

@@ -41,7 +41,6 @@
 import org.apache.syncope.common.lib.types.CipherAlgorithm;
 import org.apache.syncope.common.lib.types.ClientExceptionType;
 import org.apache.syncope.common.lib.types.IdRepoEntitlement;
-import org.apache.syncope.core.logic.oidc.NoOpSessionStore;
 import org.apache.syncope.core.logic.oidc.OIDCC4UIContext;
 import org.apache.syncope.core.logic.oidc.OIDCClientCache;
 import org.apache.syncope.core.logic.oidc.OIDCUserManager;
@@ -56,6 +55,7 @@
 import org.apache.syncope.core.spring.security.AuthDataAccessor;
 import org.pac4j.core.context.CallContext;
 import org.pac4j.core.context.WebContext;
+import org.pac4j.core.context.session.SessionStore;
 import org.pac4j.core.credentials.Credentials;
 import org.pac4j.core.credentials.SessionKeyCredentials;
 import org.pac4j.core.exception.http.WithLocationAction;
@@ -73,6 +73,8 @@ public class OIDCC4UILogic extends AbstractTransactionalLogic<EntityTO> {
 
     protected static final String JWT_CLAIM_ID_TOKEN = "ID_TOKEN";
 
+    protected static final String NO_OP_REQUEST_ID = "noop";
+
     protected final OIDCClientCache oidcClientCacheLogin;
 
     protected final OIDCClientCache oidcClientCacheLogout;
@@ -89,6 +91,8 @@ public class OIDCC4UILogic extends AbstractTransactionalLogic<EntityTO> {
 
     protected final EncryptorManager encryptorManager;
 
+    protected final SessionStore sessionStore;
+
     public OIDCC4UILogic(
             final OIDCClientCache oidcClientCacheLogin,
             final OIDCClientCache oidcClientCacheLogout,
@@ -97,7 +101,8 @@ public OIDCC4UILogic(
             final OIDCC4UIProviderDAO opDAO,
             final AccessTokenDAO accessTokenDAO,
             final OIDCUserManager userManager,
-            final EncryptorManager encryptorManager) {
+            final EncryptorManager encryptorManager,
+            final SessionStore sessionStore) {
 
         this.oidcClientCacheLogin = oidcClientCacheLogin;
         this.oidcClientCacheLogout = oidcClientCacheLogout;
@@ -107,6 +112,7 @@ public OIDCC4UILogic(
         this.accessTokenDAO = accessTokenDAO;
         this.userManager = userManager;
         this.encryptorManager = encryptorManager;
+        this.sessionStore = sessionStore;
     }
 
     protected OidcClient getOidcClient(
@@ -147,22 +153,25 @@ protected Map<String, String> buildParams(final WebContext webContext) {
         });
 
         // 2. create OIDCRequest
-        WithLocationAction action = oidcClient.getRedirectionAction(
-                new CallContext(new OIDCC4UIContext(), NoOpSessionStore.INSTANCE)).
+        OIDCC4UIContext ctx = new OIDCC4UIContext();
+        WithLocationAction action = oidcClient.getRedirectionAction(new CallContext(ctx, sessionStore)).
                 map(WithLocationAction.class::cast).
                 orElseThrow(() -> {
                     SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.Unknown);
                     sce.getElements().add("No RedirectionAction generated for LoginRequest");
                     return sce;
                 });
 
-        OIDCRequest loginRequest = new OIDCRequest();
-        loginRequest.setLocation(action.getLocation());
-        return loginRequest;
+        return new OIDCRequest(Optional.ofNullable(ctx.getId()).orElse(NO_OP_REQUEST_ID), action.getLocation());
     }
 
     @PreAuthorize("hasRole('" + IdRepoEntitlement.ANONYMOUS + "')")
-    public OIDCLoginResponse login(final String redirectURI, final String authorizationCode, final String opName) {
+    public OIDCLoginResponse login(
+            final String requestId,
+            final String redirectURI,
+            final String authorizationCode,
+            final String opName) {
+
         // 0. look for OP
         OIDCC4UIProvider op = opDAO.findByName(opName).
                 orElseThrow(() -> new NotFoundException("OIDC Provider '" + opName + '\''));
@@ -171,14 +180,16 @@ public OIDCLoginResponse login(final String redirectURI, final String authorizat
         OidcClient oidcClient = getOidcClient(oidcClientCacheLogin, op, redirectURI);
 
         // 2. get OpenID Connect tokens
+        OIDCC4UIContext ctx = new OIDCC4UIContext();
+        ctx.setId(requestId);
+
         String idTokenHint = null;
         JWTClaimsSet claimsSet = null;
         try {
             OidcCredentials credentials = new OidcCredentials();
             credentials.setCode(authorizationCode);
 
-            oidcClient.getAuthenticator().validate(
-                    new CallContext(new OIDCC4UIContext(), NoOpSessionStore.INSTANCE), credentials);
+            oidcClient.getAuthenticator().validate(new CallContext(ctx, sessionStore), credentials);
 
             JWT idToken = credentials.toIdToken();
             if (idToken == null) {
@@ -324,8 +335,9 @@ public OIDCRequest createLogoutRequest(final String accessToken, final String re
         OidcProfile profile = new OidcProfile();
         profile.setIdTokenString((String) claimsSet.getClaim(JWT_CLAIM_ID_TOKEN));
 
+        OIDCC4UIContext ctx = new OIDCC4UIContext();
         WithLocationAction action = oidcClient.getLogoutAction(
-                new CallContext(new OIDCC4UIContext(), NoOpSessionStore.INSTANCE),
+                new CallContext(ctx, sessionStore),
                 profile,
                 redirectURI).
                 map(WithLocationAction.class::cast).
@@ -335,9 +347,7 @@ public OIDCRequest createLogoutRequest(final String accessToken, final String re
                     return sce;
                 });
 
-        OIDCRequest logoutRequest = new OIDCRequest();
-        logoutRequest.setLocation(action.getLocation());
-        return logoutRequest;
+        return new OIDCRequest(Optional.ofNullable(ctx.getId()).orElse(NO_OP_REQUEST_ID), action.getLocation());
     }
 
     @PreAuthorize("hasRole('" + IdRepoEntitlement.ANONYMOUS + "')")
@@ -371,7 +381,7 @@ public Optional<String> getRequestParameter(final String name) {
                 }
                 return Optional.empty();
             }
-        }, NoOpSessionStore.INSTANCE)).orElseThrow(() -> {
+        }, sessionStore)).orElseThrow(() -> {
             SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.Unknown);
             sce.getElements().add("Could not validate the logout token");
             return sce;