GUACAMOLE-1364: Allow both traditional username/password and SSO.

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/.ratignore

@@ -0,0 +1 @@
+src/main/resources/html/*.html

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/AuthenticationProviderService.java

@@ -21,18 +21,21 @@ package org.apache.guacamole.auth.openid;
 
 import com.google.inject.Inject;
 import com.google.inject.Provider;
+import com.google.inject.Singleton;
+import java.net.URI;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.Set;
 import javax.servlet.http.HttpServletRequest;
+import javax.ws.rs.core.UriBuilder;
 import org.apache.guacamole.auth.openid.conf.ConfigurationService;
-import org.apache.guacamole.auth.openid.form.TokenField;
 import org.apache.guacamole.auth.openid.token.NonceService;
 import org.apache.guacamole.auth.openid.token.TokenValidationService;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.auth.sso.SSOAuthenticationProviderService;
 import org.apache.guacamole.auth.sso.user.SSOAuthenticatedUser;
 import org.apache.guacamole.form.Field;
+import org.apache.guacamole.form.RedirectField;
 import org.apache.guacamole.language.TranslatableMessage;
 import org.apache.guacamole.net.auth.Credentials;
 import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
@@ -42,8 +45,15 @@ import org.jose4j.jwt.JwtClaims;
 /**
  * Service that authenticates Guacamole users by processing OpenID tokens.
  */
+@Singleton
 public class AuthenticationProviderService implements SSOAuthenticationProviderService {
 
+    /**
+     * The standard HTTP parameter which will be included within the URL by all
+     * OpenID services upon successful authentication and redirect.
+     */
+    public static final String TOKEN_PARAMETER_NAME = "id_token";
+
     /**
      * Service for retrieving OpenID configuration information.
      */
@@ -78,7 +88,7 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
         // Validate OpenID token in request, if present, and derive username
         HttpServletRequest request = credentials.getRequest();
         if (request != null) {
-            String token = request.getParameter(TokenField.PARAMETER_NAME);
+            String token = request.getParameter(TOKEN_PARAMETER_NAME);
             if (token != null) {
                 JwtClaims claims = tokenService.validateToken(token);
                 if (claims != null) {
@@ -99,26 +109,38 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
 
         }
 
-        // Request OpenID token
+        // Request OpenID token (will automatically redirect the user to the
+        // OpenID authorization page via JavaScript)
         throw new GuacamoleInvalidCredentialsException("Invalid login.",
             new CredentialsInfo(Arrays.asList(new Field[] {
-
-                // OpenID-specific token (will automatically redirect the user
-                // to the authorization page via JavaScript)
-                new TokenField(
-                    confService.getAuthorizationEndpoint(),
-                    confService.getScope(),
-                    confService.getClientID(),
-                    confService.getRedirectURI(),
-                    nonceService.generate(confService.getMaxNonceValidity() * 60000L),
-                    new TranslatableMessage("LOGIN.INFO_IDP_REDIRECT_PENDING")
-                )
-
+                new RedirectField(TOKEN_PARAMETER_NAME, getLoginURI(),
+                        new TranslatableMessage("LOGIN.INFO_IDP_REDIRECT_PENDING"))
             }))
         );
 
     }
 
+    /**
+     * Returns the full URI of the OpenID login endpoint to which a user must
+     * be redirected in order to authenticate and receive an OpenID token.
+     *
+     * @return 
+     *     The full URI of the OpenID login endpoint, including unique nonce.
+     *
+     * @throws GuacamoleException
+     *     If configuration information required for generating the login URI
+     *     cannot be read.
+     */
+    public URI getLoginURI() throws GuacamoleException {
+        return UriBuilder.fromUri(confService.getAuthorizationEndpoint())
+                .queryParam("scope", confService.getScope())
+                .queryParam("response_type", "id_token")
+                .queryParam("client_id", confService.getClientID())
+                .queryParam("redirect_uri", confService.getRedirectURI())
+                .queryParam("nonce", nonceService.generate(confService.getMaxNonceValidity() * 60000L))
+                .build();
+    }
+
     @Override
     public void shutdown() {
         // Nothing to clean up

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/OpenIDAuthenticationProvider.java

@@ -34,7 +34,8 @@ public class OpenIDAuthenticationProvider extends SSOAuthenticationProvider {
      * against an OpenID service.
      */
     public OpenIDAuthenticationProvider() {
-        super(AuthenticationProviderService.class, new OpenIDAuthenticationProviderModule());
+        super(AuthenticationProviderService.class, OpenIDResource.class,
+                new OpenIDAuthenticationProviderModule());
     }
 
     @Override

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/OpenIDResource.java

@@ -0,0 +1,43 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.guacamole.auth.openid;
+
+import com.google.inject.Inject;
+import javax.ws.rs.core.Response;
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.auth.sso.SSOResource;
+
+/**
+ * REST API resource that automatically redirects users to the OpenID identity
+ * provider.
+ */
+public class OpenIDResource implements SSOResource {
+
+    /**
+     * Service for authenticating users using OpenID.
+     */
+    @Inject
+    private AuthenticationProviderService authService;
+
+    @Override
+    public Response redirectToIdentityProvider() throws GuacamoleException {
+        return Response.seeOther(authService.getLoginURI()).build();
+    }
+
+}

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/form/TokenField.java

@@ -1,87 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.guacamole.auth.openid.form;
-
-import java.net.URI;
-import javax.ws.rs.core.UriBuilder;
-import org.apache.guacamole.form.RedirectField;
-import org.apache.guacamole.language.TranslatableMessage;
-
-/**
- * Field definition which represents the token returned by an OpenID Connect
- * service.
- */
-public class TokenField extends RedirectField {
-
-    /**
-     * The standard HTTP parameter which will be included within the URL by all
-     * OpenID services upon successful authentication and redirect.
-     */
-    public static final String PARAMETER_NAME = "id_token";
-
-    /**
-     * Creates a new field which requests authentication via OpenID connect.
-     * Successful authentication at the OpenID Connect service will result in
-     * the client being redirected to the specified redirect URI. The OpenID
-     * token will be embedded in the fragment (the part following the hash
-     * symbol) of that URI, which the JavaScript side of this extension will
-     * move to the query parameters.
-     *
-     * @param authorizationEndpoint
-     *     The full URL of the endpoint accepting OpenID authentication
-     *     requests.
-     *
-     * @param scope
-     *     The space-delimited list of OpenID scopes to request from the
-     *     identity provider, such as "openid" or "openid email profile".
-     *
-     * @param clientID
-     *     The ID of the OpenID client. This is normally determined ahead of
-     *     time by the OpenID service through some manual credential request
-     *     procedure.
-     *
-     * @param redirectURI
-     *     The URI that the OpenID service should redirect to upon successful
-     *     authentication.
-     *
-     * @param nonce
-     *     A random string unique to this request. To defend against replay
-     *     attacks, this value must cease being valid after its first use.
-     * 
-     * @param redirectMessage
-     *     The message that will be displayed to the user during redirect.  This
-     *     will be processed through Guacamole's translation system.
-     */
-    public TokenField(URI authorizationEndpoint, String scope,
-            String clientID, URI redirectURI, String nonce,
-            TranslatableMessage redirectMessage) {
-
-        super(PARAMETER_NAME, UriBuilder.fromUri(authorizationEndpoint)
-                .queryParam("scope", scope)
-                .queryParam("response_type", "id_token")
-                .queryParam("client_id", clientID)
-                .queryParam("redirect_uri", redirectURI)
-                .queryParam("nonce", nonce)
-                .build(),
-                redirectMessage);
-
-    }
-
-}

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/resources/guac-manifest.json

@@ -9,6 +9,15 @@
         "org.apache.guacamole.auth.openid.OpenIDAuthenticationProvider"
     ],
 
+    "css" : [
+        "styles/sso-providers.css"
+    ],
+
+    "html" : [
+        "html/sso-providers.html",
+        "html/sso-provider-openid.html"
+    ],
+
     "translations" : [
         "translations/ca.json",
         "translations/de.json",

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/resources/html/sso-provider-openid.html

@@ -0,0 +1,4 @@
+<meta name="after-children" content=".login-ui .sso-provider-list:last-child">
+<li class="sso-provider sso-provider-openid"><a href="api/ext/openid/login">{{
+    'LOGIN.NAME_IDP_OPENID' | translate
+}}</a></li>