GUACAMOLE-1780: Allow SAML, SSL sessions to be resumed after another auth provider vetoes the auth attempt.

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationEventListener.java

@@ -0,0 +1,74 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.ssl;
+
+import com.google.inject.Inject;
+import com.google.inject.Singleton;
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.auth.ssl.SSLAuthenticationSessionManager;
+import org.apache.guacamole.net.event.AuthenticationFailureEvent;
+import org.apache.guacamole.net.event.AuthenticationSuccessEvent;
+import org.apache.guacamole.net.event.listener.Listener;
+
+/**
+ * A Listener that will reactivate or invalidate SSL auth sessions depending on
+ * overall auth success or failure.
+ */
+@Singleton
+public class AuthenticationEventListener implements Listener {
+
+    /**
+     * Session manager for generating and maintaining unique tokens to
+     * represent the authentication flow of a user who has only partially
+     * authenticated.
+     *
+     * Requires static injection due to the fact that the webapp just calls the
+     * constructor directly when creating new Listeners. The instances will not
+     * be constructed by guice.
+     */
+    @Inject
+    private static SSLAuthenticationSessionManager sessionManager;
+
+    @Override
+    public void handleEvent(Object event) throws GuacamoleException {
+
+        if (event instanceof AuthenticationSuccessEvent)
+
+            // After an auth attempt has fully succeeded, invalidate the session
+            // associated with the successful login event so it can't be reused
+            sessionManager.invalidateSession(
+                AuthenticationProviderService.getSessionIdentifier(
+                    ((AuthenticationSuccessEvent) event).getCredentials()));
+
+        else if (event instanceof AuthenticationFailureEvent)
+
+            // If the SSL auth succeeded, but other auth providers failed to
+            // authenticate the user associated with the credentials in this
+            // failure event, they may wish to make another login attempt. To
+            // avoid an infinite login attempt loop, re-enable the session
+            // associated with these credentials, allowing the auth attempt to be 
+            // resumed without requiring another round trip to the SSL service.
+            sessionManager.reactivateSession(
+                AuthenticationProviderService.getSessionIdentifier(
+                    ((AuthenticationFailureEvent) event).getCredentials()));
+
+    }
+
+}

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationProviderService.java

@@ -75,22 +75,42 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
     private static final String AUTH_SESSION_PARAMETER_NAME = "state";
 
     /**
-     * Processes the given HTTP request, returning the identity represented by
-     * the auth session token present in that request. If no such token is
-     * present, or the token does not represent a valid identity, null is
-     * returned.
+     * Return the value of the session identifier associated with the given
+     * credentials, or null if no session identifier is found in the credentials.
      *
-     * @param request
-     *     The HTTP request to process.
+     * @param credentials
+     *      The credentials from which to extract the session identifier.
+     *
+     * @return
+     *      The session identifier associated with the given credentials, or
+     *      null if no identifier is found.
+     */
+    public static String getSessionIdentifier(Credentials credentials) {
+
+        // Return the session identifier from the request params, if set, or
+        // null otherwise
+        return credentials != null && credentials.getRequest() != null
+                ? credentials.getRequest().getParameter(AUTH_SESSION_PARAMETER_NAME)
+                : null;
+    }
+
+    /**
+     * Processes the given credentials, returning the identity represented by
+     * the auth session token present in that request associated with the 
+     * credentials. If no such token is present, or the token does not represent
+     * a valid identity, null is returned.
+     *
+     * @param credentials
+     *     The credentials to extract the auth session token from.
      *
      * @return
      *     The identity represented by the auth session token in the request,
      *     or null if there is no such token or the token does not represent a
      *     valid identity.
      */
-    private SSOAuthenticatedUser processIdentity(Credentials credentials, HttpServletRequest request) {
+    private SSOAuthenticatedUser processIdentity(Credentials credentials) {
 
-        String state = request.getParameter(AUTH_SESSION_PARAMETER_NAME);
+        String state = getSessionIdentifier(credentials);
         String username = sessionManager.getIdentity(state);
         if (username == null)
             return null;
@@ -153,7 +173,7 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
         //
 
         if (confService.isPrimaryHostname(host))
-            return processIdentity(credentials, request);
+            return processIdentity(credentials);
 
         // All other requests are not allowed - redirect to proper hostname
         throw new GuacamoleInvalidCredentialsException("Authentication is "

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProviderModule.java

@@ -35,6 +35,8 @@ public class SSLAuthenticationProviderModule extends AbstractModule {
         bind(ConfigurationService.class);
         bind(NonceService.class).in(Scopes.SINGLETON);
         bind(SSLAuthenticationSessionManager.class);
+
+        requestStaticInjection(AuthenticationEventListener.class);
     }
 
 }

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json

@@ -9,6 +9,10 @@
         "org.apache.guacamole.auth.ssl.SSLAuthenticationProvider"
     ],
 
+    "listeners" : [
+        "org.apache.guacamole.auth.ssl.AuthenticationEventListener"
+    ],
+
     "css" : [
         "styles/sso-providers.css"
     ],