-
Type:
Bug
-
Status: Resolved
-
Priority:
Major
-
Resolution: Fixed
-
Affects Version/s: 13.5.0, 14.0.0
-
Component/s: XUI
OpenAM needs to be able to redirect an unauthenticated user to a specific URL after they authenticate. This URL may contain multiple query string parameters, such as "http://www.google.com/?foo=bar&hello=world". This URL it is expected to be encoded and passed into the XUI as a URL like so:
/openam/XUI/#login/&goto=http%3A%2F%2Fwww.google.com%2F%3Ffoo%3Dbar%26hello%3Dworld
The REST endpoint "/openam/json/authenticate" also expects to receive this URL as an encoded parameter. This is used to start the authentication process, and the goto URL provided to the authentication process will be retained throughout the lifetime of the session that will be created.
The problem is that the encoded value passed into XUI is being decoded before it is passed to the authenticate endpoint. This is especially problematic when URLs contain multiple parameters, as it causes the URL-splitting logic to incorrectly parse the subsequent parameters of the goto URL as being additional parameters to the authenticate endpoint (unrelated to the goto URL). For example, the above would be passed in like so:
/openam/json/authenticate?goto=http://www.google.com/?foo=bar&hello=world
Thus, the value for the "goto" parameter would only be "http://www.google.com/?foo=bar", and there would be another (likely ignored) parameter "hello=world" treated separately.
The expected behavior is for the XUI to submit this goto URL encoded, like so:
/openam/json/authenticate?goto=http%3A%2F%2Fwww.google.com%2F%3Ffoo%3Dbar%26hello%3Dworld
This is especially troublesome for the OAuth flow. In that case, the "authorize" endpoint redirects unauthenticated users to the XUI login page, with a URL like so:
/openam/XUI/#login/&realm=%2F&goto=http%3A%2F%2Frich.example.com%3A8080%2Fopenam%2Foauth2%2Fauthorize%3Fresponse_type%3Dcode%26scope%3Dopenid%2520profile%2520email%26redirect_uri%3Dhttps%253A%252F%252Flocalhost%253A8443%252FoauthReturn.html%26state%3Dlogin%2526provider%253Dopenam%2526redirect_uri%253Dhttps%253A%252F%252Flocalhost%253A8443%252FoauthReturn.html%26client_id%3Dopenidm
However when the XUI loads, it submits the goto URL it was provided to the "authenticate" endpoint without retaining the encoding, so that the authenticate endpoint only sees a goto URL with a value like so:
http://rich.example.com:8080/openam/oauth2/authorize?response_type=code
The remaining, critically-important OAuth parameters are missing from the URL, so that when the authentication process completes the authorization endpoint is unable to process the request and the user can't return to their requested application (the RP) with the authorization code.
- caused
-
OPENAM-10752 Social Authentication in a subrealm without parameters causes loop in 13.5.1-SNAPSHOT
-
- Closed
-
- depends on
-
OPENAM-9619 URL Parameters are ignored during login
-
- Resolved
-
- is duplicated by
-
OPENAM-9630 Oauth2 authorise endpoint not encoding goto url causing query params to be lost
-
- Resolved
-
-
OPENAM-9662 XUI does not correctly set link to return to login page in CDSSO deployments
-
- Resolved
-
-
OPENAM-9664 "Return to Login Page" link after logout does not encode the goto URL
-
- Closed
-
- is related to
-
OPENAM-5547 Agent behaviour when appending goto= to LoginURLs is not compatible with XUI login URL
-
- Closed
-
-
OPENAM-9664 "Return to Login Page" link after logout does not encode the goto URL
-
- Closed
-
- is required by
-
OPENAM-9626 Broken FacebookSocialAuthenticationService with DuplicateRequestParameterValidator
-
- Resolved
-
-
OPENAM-9719 session upgrade fails in combination with SAML-based SSO
-
- Resolved
-
- relates to
-
OPENAM-9664 "Return to Login Page" link after logout does not encode the goto URL
-
- Closed
-