fix for MID-4099 session timeout, ajax unresponsiveness and wrong aja…

…x response to login page redirect fix

(cherry picked from commit b620bde)

gui/admin-gui/src/main/java/com/evolveum/midpoint/web/security/WicketLoginUrlAuthenticationEntryPoint.java

@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2010-2017 Evolveum
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.evolveum.midpoint.web.security;
+
+import org.apache.wicket.request.http.WebRequest;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+/**
+ * Created by Viliam Repan (lazyman).
+ */
+public class WicketLoginUrlAuthenticationEntryPoint extends LoginUrlAuthenticationEntryPoint {
+
+    public WicketLoginUrlAuthenticationEntryPoint(String loginFormUrl) {
+        super(loginFormUrl);
+    }
+
+    @Override
+    public void commence(HttpServletRequest request, HttpServletResponse response,
+                         AuthenticationException authException) throws IOException, ServletException {
+
+        if (!isWicketAjaxRequest(request)) {
+            super.commence(request, response, authException);
+
+            return;
+        }
+
+        String url = buildRedirectUrlToLoginPage(request, response, authException);
+
+        WicketRedirectStrategy strategy = new WicketRedirectStrategy();
+        strategy.sendRedirect(request, response, url);
+    }
+
+    private boolean isWicketAjaxRequest(HttpServletRequest request) {
+        String value = request.getParameter(WebRequest.PARAM_AJAX);
+        if (value != null && "true".equals(value)) {
+            return true;
+        }
+
+        value = request.getHeader(WebRequest.HEADER_AJAX);
+        if (value != null && "true".equals(value)) {
+            return true;
+        }
+
+        return false;
+    }
+}

gui/admin-gui/src/main/java/com/evolveum/midpoint/web/security/WicketRedirectStrategy.java

@@ -0,0 +1,48 @@
+/*
+ * Copyright (c) 2010-2017 Evolveum
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.evolveum.midpoint.web.security;
+
+import org.apache.wicket.util.time.Time;
+import org.springframework.security.web.DefaultRedirectStrategy;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.io.Writer;
+
+/**
+ * Created by Viliam Repan (lazyman).
+ */
+public class WicketRedirectStrategy extends DefaultRedirectStrategy {
+
+    @Override
+    public void sendRedirect(HttpServletRequest request, HttpServletResponse response, String url) throws IOException {
+        response.setStatus(HttpServletResponse.SC_OK);
+
+        response.setContentType("text/xml");
+
+        response.setHeader("Ajax-Location", url);
+        // disabled caching
+        response.setHeader("Date", Long.toString(Time.now().getMilliseconds()));
+        response.setHeader("Expires", Long.toString(Time.START_OF_UNIX_TIME.getMilliseconds()));
+        response.setHeader("Pragma", "no-cache");
+        response.setHeader("Cache-Control", "no-cache, no-store");
+
+        Writer writer = response.getWriter();
+        writer.write("<ajax-response><redirect><![CDATA[" + url + "]]></redirect></ajax-response>");
+    }
+}

gui/admin-gui/src/main/webapp/WEB-INF/ctx-web-security.xml

@@ -41,10 +41,15 @@ http://www.springframework.org/schema/context
     <http pattern="/wro/**" security="none"/>
     <!-- todo fix later with some mounting-->
     <http pattern="/wicket/resource/**" security="none"/>
-
+
+    <beans:bean id="wicketAuthenticationEntryPoint"
+          class="com.evolveum.midpoint.web.security.WicketLoginUrlAuthenticationEntryPoint">
+        <beans:constructor-arg value="/login"/>
+    </beans:bean>
 
 	<!-- add following: entry-point-ref="casEntryPoint"  to the http element before create-session attribute -->
-    <http create-session="never" auto-config="true" use-expressions="false" access-decision-manager-ref="accessDecisionManager">
+    <http create-session="never" auto-config="true" use-expressions="false"
+          access-decision-manager-ref="accessDecisionManager" entry-point-ref="wicketAuthenticationEntryPoint">
 <!--         <intercept-url pattern="/registration" /> -->
         <intercept-url pattern="/j_spring_security_check" />
         <intercept-url pattern="/spring_security_login" />