[
https://issues.apache.org/jira/browse/GUACAMOLE-808?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18090944#comment-18090944
]
David Bateman commented on GUACAMOLE-808:
-----------------------------------------
Using a dynamic redirect_uri is in fact against the OIDC security
recommandations (see [RC6819 Oath 2.0 Threat
Model|[https://datatracker.ietf.org/doc/html/rfc6819#section-5.2.3.5]).] So a
state variable should be used as suggested above, that asks Guacamole to
redirect to another page.. One problem with this is that the state query
parameter will also need to hide other things such as the PKCE verifier, So the
best thing to do here would be to have a SessionManager instance in the openid
extension that stores the redirect URI the user wanted and pass only the key of
the SessionManager in the state query parameter.
I have PR open against OpenID at the moment, and it already includes a
SessionManager to handle the PKCE verifier. I'll take a look at adding the
redirect as part of the session and always sending the user back to the
requested page, and part of this PR
> Support redirecting to originally requested URL after successful SSO login
> --------------------------------------------------------------------------
>
> Key: GUACAMOLE-808
> URL: https://issues.apache.org/jira/browse/GUACAMOLE-808
> Project: Guacamole
> Issue Type: Improvement
> Components: guacamole, guacamole-auth-sso-cas,
> guacamole-auth-sso-openid, guacamole-auth-sso-saml
> Reporter: Parth Mishra
> Priority: Minor
>
> Upon successful authentication via OIDC, the user is returned to the redirect
> URI (e.g. {{https://myserver.com/guacamole/}}) even if they were requesting
> another Guacamole resource such as a Connection link. It would be nice if the
> user could be routed to the requested resource after successful
> authentication.
> This way, if they were to click a direct link to a guacamole Connection they
> have access too, the successful authentication via the IDP can reroute them
> directly to the requested connection URL rather than the guacamole UI.
> Typically this is done with encoding the request URL with the "state"
> parameter of OIDC and verifying with the nonce.
> This feature could be really useful for relying on custom frontends without
> having to modify or reimplement the web app.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
