diff --git a/server/src/main/java/password/pwm/config/DomainConfig.java b/server/src/main/java/password/pwm/config/DomainConfig.java index f4a0d71008..bc16195d76 100644 --- a/server/src/main/java/password/pwm/config/DomainConfig.java +++ b/server/src/main/java/password/pwm/config/DomainConfig.java @@ -57,6 +57,7 @@ import password.pwm.util.secure.PwmHashAlgorithm; import password.pwm.util.secure.PwmSecurityKey; import password.pwm.util.secure.SecureEngine; +import password.pwm.http.HttpMethod; import java.io.StringWriter; import java.security.cert.X509Certificate; @@ -233,6 +234,14 @@ public PrivateKeyCertificate readSettingAsPrivateKey( final PwmSetting setting ) return settingReader.readSettingAsPrivateKey( setting ); } + public HttpMethod readSettingAsHttpMethod( final PwmSetting setting ) + { + return settingReader.readSettingAsEnum( setting, + password.pwm.config.option.HttpMethod.class ) == password.pwm.config.option.HttpMethod.POST + ? HttpMethod.POST + : HttpMethod.GET; + } + public PwmSecurityKey getSecurityKey( ) throws PwmUnrecoverableException { //return configurationSuppliers.pwmSecurityKey.call(); diff --git a/server/src/main/java/password/pwm/config/PwmSetting.java b/server/src/main/java/password/pwm/config/PwmSetting.java index 128ad8a35d..e69ead1f61 100644 --- a/server/src/main/java/password/pwm/config/PwmSetting.java +++ b/server/src/main/java/password/pwm/config/PwmSetting.java @@ -822,6 +822,8 @@ public enum PwmSetting "recovery.oauth.idserver.codeResolveUrl", PwmSettingSyntax.STRING, PwmSettingCategory.RECOVERY_OAUTH ), RECOVERY_OAUTH_ID_ATTRIBUTES_URL( "recovery.oauth.idserver.attributesUrl", PwmSettingSyntax.STRING, PwmSettingCategory.RECOVERY_OAUTH ), + RECOVERY_OAUTH_ID_ATTRIBUTES_METHOD( + "recovery.oauth.idserver.attributesMethod", PwmSettingSyntax.SELECT, PwmSettingCategory.RECOVERY_OAUTH ), RECOVERY_OAUTH_ID_CERTIFICATE( "recovery.oauth.idserver.serverCerts", PwmSettingSyntax.X509CERT, PwmSettingCategory.RECOVERY_OAUTH ), RECOVERY_OAUTH_ID_CLIENTNAME( @@ -1190,6 +1192,8 @@ public enum PwmSetting "oauth.idserver.codeResolveUrl", PwmSettingSyntax.STRING, PwmSettingCategory.OAUTH ), OAUTH_ID_ATTRIBUTES_URL( "oauth.idserver.attributesUrl", PwmSettingSyntax.STRING, PwmSettingCategory.OAUTH ), + OAUTH_ID_ATTRIBUTES_METHOD( + "oauth.idserver.attributesMethod", PwmSettingSyntax.SELECT, PwmSettingCategory.OAUTH ), OAUTH_ID_CERTIFICATE( "oauth.idserver.serverCerts", PwmSettingSyntax.X509CERT, PwmSettingCategory.OAUTH ), OAUTH_ID_CLIENTNAME( diff --git a/server/src/main/java/password/pwm/config/option/HttpMethod.java b/server/src/main/java/password/pwm/config/option/HttpMethod.java new file mode 100644 index 0000000000..080a06f1da --- /dev/null +++ b/server/src/main/java/password/pwm/config/option/HttpMethod.java @@ -0,0 +1,27 @@ +/* + * Password Management Servlets (PWM) + * http://www.pwm-project.org + * + * Copyright (c) 2006-2009 Novell, Inc. + * Copyright (c) 2009-2021 The PWM Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package password.pwm.config.option; + +public enum HttpMethod implements ConfigurationOption +{ + POST, + GET, +} diff --git a/server/src/main/java/password/pwm/http/PwmResponse.java b/server/src/main/java/password/pwm/http/PwmResponse.java index a81f36cf49..f1d12fc1ab 100644 --- a/server/src/main/java/password/pwm/http/PwmResponse.java +++ b/server/src/main/java/password/pwm/http/PwmResponse.java @@ -289,9 +289,19 @@ public void sendRedirect( final String url, final RedirectType redirectType ) preCommitActions(); final String basePath = pwmRequest.getBasePath(); - final String effectiveUrl = url.startsWith( basePath ) - ? url - : basePath + url; + final String effectiveUrl; + + // a redirect can either be internal and already include the basePath, + // or internal without basePath, in this case we add the basePath + // or external with preceding protocol, in this case we use the url as is + if ( url.startsWith( basePath ) || url.matches( "^https?://.*" ) ) + { + effectiveUrl = url; + } + else + { + effectiveUrl = basePath + url; + } // http "other" redirect final HttpServletResponse resp = pwmRequest.getPwmResponse().getHttpServletResponse(); diff --git a/server/src/main/java/password/pwm/http/servlet/oauth/OAuthMachine.java b/server/src/main/java/password/pwm/http/servlet/oauth/OAuthMachine.java index 813ae9c967..ed741f646d 100644 --- a/server/src/main/java/password/pwm/http/servlet/oauth/OAuthMachine.java +++ b/server/src/main/java/password/pwm/http/servlet/oauth/OAuthMachine.java @@ -160,7 +160,7 @@ OAuthResolveResults makeOAuthResolveRequest( requestParams.put( config.readAppProperty( AppProperty.HTTP_PARAM_OAUTH_CLIENT_ID ), clientID ); requestParams.put( config.readAppProperty( AppProperty.HTTP_PARAM_OAUTH_CLIENT_SECRET ), settings.getSecret().getStringValue() ); - final PwmHttpClientResponse restResults = makeHttpRequest( pwmRequest, "oauth code resolver", settings, requestUrl, requestParams, null ); + final PwmHttpClientResponse restResults = makeHttpRequest( pwmRequest, "oauth code resolver", settings, requestUrl, requestParams, null, HttpMethod.POST ); final OAuthResolveResults results = resolveResultsFromResponseBody( pwmRequest, restResults.getBody() ); @@ -204,7 +204,7 @@ private OAuthResolveResults makeOAuthRefreshRequest( requestParams.put( config.readAppProperty( AppProperty.HTTP_PARAM_OAUTH_REFRESH_TOKEN ), refreshCode ); requestParams.put( config.readAppProperty( AppProperty.HTTP_PARAM_OAUTH_GRANT_TYPE ), grantType ); - final PwmHttpClientResponse restResults = makeHttpRequest( pwmRequest, "OAuth refresh resolver", settings, requestUrl, requestParams, null ); + final PwmHttpClientResponse restResults = makeHttpRequest( pwmRequest, "OAuth refresh resolver", settings, requestUrl, requestParams, null, HttpMethod.POST ); return resolveResultsFromResponseBody( pwmRequest, restResults.getBody() ); } @@ -219,10 +219,11 @@ String makeOAuthGetUserInfoRequest( { final DomainConfig config = pwmRequest.getDomainConfig(); final String requestUrl = settings.getAttributesUrl(); + final HttpMethod requestMethod = settings.getAttributesMethod(); final Map requestParams = new HashMap<>(); requestParams.put( config.readAppProperty( AppProperty.HTTP_PARAM_OAUTH_ACCESS_TOKEN ), accessToken ); requestParams.put( config.readAppProperty( AppProperty.HTTP_PARAM_OAUTH_ATTRIBUTES ), settings.getDnAttributeName() ); - restResults = makeHttpRequest( pwmRequest, "OAuth userinfo", settings, requestUrl, requestParams, accessToken ); + restResults = makeHttpRequest( pwmRequest, "OAuth userinfo", settings, requestUrl, requestParams, accessToken, requestMethod ); } final String resultBody = restResults.getBody(); @@ -250,7 +251,8 @@ private static PwmHttpClientResponse makeHttpRequest( final OAuthSettings settings, final String requestUrl, final Map requestParams, - final String accessToken + final String accessToken, + final HttpMethod method ) throws PwmUnrecoverableException { @@ -273,7 +275,7 @@ private static PwmHttpClientResponse makeHttpRequest( headers.put( HttpHeader.ContentType.getHttpName(), HttpContentType.form.getHeaderValueWithEncoding() ); pwmHttpClientRequest = PwmHttpClientRequest.builder() - .method( HttpMethod.POST ) + .method( method ) .url( requestUrl ) .body( requestBody ) .headers( headers ) @@ -316,7 +318,7 @@ private static String figureOauthSelfEndPointUrl( final PwmRequest pwmRequest ) { final String returnUrlOverride = pwmRequest.getDomainConfig().readAppProperty( AppProperty.OAUTH_RETURN_URL_OVERRIDE ); - final String siteURL = pwmRequest.getDomainConfig().readSettingAsString( PwmSetting.PWM_SITE_URL ); + final String siteURL = pwmRequest.getAppConfig().readSettingAsString( PwmSetting.PWM_SITE_URL ); if ( returnUrlOverride != null && !returnUrlOverride.trim().isEmpty() ) { debugSource = "AppProperty(\"" + AppProperty.OAUTH_RETURN_URL_OVERRIDE.getKey() + "\")"; @@ -470,7 +472,8 @@ private Optional figureUsernameGrantParam( } LOGGER.debug( sessionLabel, () -> "preparing to send username to OAuth /sign endpoint for future injection to /grant redirect" ); - final PwmHttpClientResponse restResults = makeHttpRequest( pwmRequest, "OAuth pre-inject username signing service", settings, signUrl, requestPayload, null ); + final PwmHttpClientResponse restResults = makeHttpRequest( pwmRequest, "OAuth pre-inject username signing service", settings, + signUrl, requestPayload, null, HttpMethod.POST ); final String resultBody = restResults.getBody(); final Map resultBodyMap = JsonUtil.deserializeStringMap( resultBody ); diff --git a/server/src/main/java/password/pwm/http/servlet/oauth/OAuthSettings.java b/server/src/main/java/password/pwm/http/servlet/oauth/OAuthSettings.java index b511c2a555..4b3c79aa44 100644 --- a/server/src/main/java/password/pwm/http/servlet/oauth/OAuthSettings.java +++ b/server/src/main/java/password/pwm/http/servlet/oauth/OAuthSettings.java @@ -26,6 +26,7 @@ import password.pwm.config.PwmSetting; import password.pwm.config.profile.ForgottenPasswordProfile; import password.pwm.util.PasswordData; +import password.pwm.http.HttpMethod; import java.io.Serializable; import java.security.cert.X509Certificate; @@ -38,6 +39,7 @@ public class OAuthSettings implements Serializable private String loginURL; private String codeResolveUrl; private String attributesUrl; + private HttpMethod attributesMethod; private String scope; private String clientID; private PasswordData secret; @@ -62,6 +64,7 @@ public static OAuthSettings forSSOAuthentication( final DomainConfig config ) .loginURL( config.readSettingAsString( PwmSetting.OAUTH_ID_LOGIN_URL ) ) .codeResolveUrl( config.readSettingAsString( PwmSetting.OAUTH_ID_CODERESOLVE_URL ) ) .attributesUrl( config.readSettingAsString( PwmSetting.OAUTH_ID_ATTRIBUTES_URL ) ) + .attributesMethod( config.readSettingAsHttpMethod( PwmSetting.OAUTH_ID_ATTRIBUTES_METHOD ) ) .clientID( config.readSettingAsString( PwmSetting.OAUTH_ID_CLIENTNAME ) ) .secret( config.readSettingAsPassword( PwmSetting.OAUTH_ID_SECRET ) ) .dnAttributeName( config.readSettingAsString( PwmSetting.OAUTH_ID_DN_ATTRIBUTE_NAME ) ) diff --git a/server/src/main/java/password/pwm/ws/server/rest/RestSetPasswordServer.java b/server/src/main/java/password/pwm/ws/server/rest/RestSetPasswordServer.java index be072a1bb4..58410eaea6 100644 --- a/server/src/main/java/password/pwm/ws/server/rest/RestSetPasswordServer.java +++ b/server/src/main/java/password/pwm/ws/server/rest/RestSetPasswordServer.java @@ -211,7 +211,8 @@ private static RestResultBean doSetPassword( ); StatisticsClient.incrementStat( restRequest.getDomain(), Statistic.REST_SETPASSWORD ); - final JsonInputData jsonResultData = new JsonInputData( targetUserIdentity.getUserIdentity().toDelimitedKey(), null, random ); + final JsonInputData jsonResultData = new JsonInputData( targetUserIdentity.getUserIdentity().toDelimitedKey(), + newPassword.getStringValue(), random ); return RestResultBean.forSuccessMessage( jsonResultData, restRequest, Message.Success_PasswordChange ); } catch ( final PwmException e ) diff --git a/server/src/main/resources/password/pwm/config/PwmSetting.xml b/server/src/main/resources/password/pwm/config/PwmSetting.xml index a58f2a26ff..8e2896bc03 100644 --- a/server/src/main/resources/password/pwm/config/PwmSetting.xml +++ b/server/src/main/resources/password/pwm/config/PwmSetting.xml @@ -2509,6 +2509,15 @@ https://oauthserver.example.com/osp/a/idm/auth/oauth2/getattributes + +