Skip to content

Fix/plugin rest pac4j jee session store #1167

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Sep 17, 2025
Merged

Fix/plugin rest pac4j jee session store #1167

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c749429
Fixed usage of client.getRedirectAction by adding CallContext
sbglasius Aug 14, 2025
93be60c
Merge pull request #1166 from apache/7.0.x
sbglasius Sep 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 14 additions & 8 deletions ...-rest/grails-app/controllers/grails/plugin/springsecurity/rest/RestOauthController.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,10 +32,12 @@ import org.apache.commons.codec.binary.Base64
import org.grails.plugins.codecs.URLCodec
import org.pac4j.core.client.IndirectClient
import org.pac4j.core.context.CallContext
import org.pac4j.core.context.WebContext
import org.pac4j.core.context.session.SessionStore
import org.pac4j.core.exception.http.FoundAction
import org.pac4j.core.exception.http.RedirectionAction
import org.pac4j.jee.context.JEEContext
import org.pac4j.jee.context.session.JEESessionStore
import org.pac4j.jee.context.session.JEESessionStoreFactory
import org.springframework.http.HttpStatus
import org.springframework.security.core.userdetails.User

Expand All @@ -46,7 +48,7 @@ import java.nio.charset.StandardCharsets
class RestOauthController {

static allowedMethods = [accessToken: 'POST']

private static final SessionStore SESSION_STORE = JEESessionStoreFactory.INSTANCE.newSessionStore(null)
final String CALLBACK_ATTR = "spring-security-rest-callback"

CallbackErrorHandler callbackErrorHandler
Expand All @@ -64,8 +66,7 @@ class RestOauthController {
*/
def authenticate(String provider, String callback) {
IndirectClient client = restOauthService.getClient(provider)
WebContext context = new JEEContext(request, response)


if (callback) {
try {
if (Base64.isBase64(callback.getBytes())){
Expand All @@ -78,9 +79,14 @@ class RestOauthController {
}
}

RedirectionAction redirectAction = client.getRedirectionAction(context, JEESessionStore.INSTANCE).get()
log.debug "Redirecting to ${redirectAction.location}"
redirect url: redirectAction.location
CallContext callContext = new CallContext(new JEEContext(request, response), SESSION_STORE)
RedirectionAction redirectAction = client.getRedirectionAction(callContext).get()
if(redirectAction instanceof FoundAction) {
log.debug "Redirecting to ${redirectAction.location}"
redirect url: redirectAction.location
} else {
response.status = redirectAction.code
}
}

/**
Expand All @@ -89,7 +95,7 @@ class RestOauthController {
* frontend application can store the REST API token locally for subsequent API calls.
*/
def callback(String provider) {
CallContext context = new CallContext(new JEEContext(request, response), null)
CallContext context = new CallContext(new JEEContext(request, response), SESSION_STORE)
def frontendCallbackUrl
if (session[CALLBACK_ATTR]) {
log.debug "Found callback URL in the HTTP session"
Expand Down
Loading