Replace OpenID 2.0 with OAuth 2.0/OIDC login

.dockerignore

@@ -0,0 +1,21 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  The ASF licenses this file to You
+# under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.  For additional information regarding
+# copyright in this work, please see the NOTICE file in the top level
+# directory of this distribution.
+
+.git
+docker/postgresql-data
+docker/postgresql-16-data
+docker/roller-data
+it-selenium

Dockerfile

@@ -23,17 +23,9 @@
 
 FROM maven:3-eclipse-temurin-17 AS builder
 
-COPY ./docker /project/docker
-
-# Build Apache Roller
-
-WORKDIR /tmp
-RUN apt-get update && apt-get install -y git
-RUN git clone https://github.com/apache/roller.git
-WORKDIR /tmp/roller
-# change to branch/tag you prefer
-RUN git checkout tags/roller-6.1.0; \
-mvn -Duser.home=/builder/home -DskipTests=true -B clean install
+COPY . /project
+WORKDIR /project
+RUN mvn -Duser.home=/builder/home -DskipTests=true -B clean install
 
 
 # STAGE 2 - PACKAGE ------------------------------------------------
@@ -63,7 +55,7 @@ ENV DATABASE_HOST ${DATABASE_HOST}
 # install Roller WAR as ROOT.war, create data dirs
 
 WORKDIR /usr/local/roller
-COPY --from=builder /tmp/roller/app/target/roller.war /usr/local/tomcat/webapps/ROOT.war
+COPY --from=builder /project/app/target/roller.war /usr/local/tomcat/webapps/ROOT.war
 RUN mkdir -p data/mediafiles data/searchindex
 
 # download PostgreSQL and MySQL drivers plus Mail and Activation JARs
@@ -78,8 +70,8 @@ RUN wget https://repo1.maven.org/maven2/org/eclipse/angus/angus-activation/2.0.3
 
 # Add Roller entry-point and go!
 
-COPY --from=builder /project/docker/entry-point.sh /usr/local/tomcat/bin
-COPY --from=builder /project/docker/wait-for-it.sh /usr/local/tomcat/bin
+COPY docker/entry-point.sh /usr/local/tomcat/bin
+COPY docker/wait-for-it.sh /usr/local/tomcat/bin
 RUN chgrp -R 0 /usr/local/tomcat
 RUN chmod -R g+rw /usr/local/tomcat
 

app/pom.xml

@@ -493,6 +493,24 @@ limitations under the License.
             </exclusions>
         </dependency>
 
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-oauth2-client</artifactId>
+            <version>${spring.security.version}</version>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-oauth2-jose</artifactId>
+            <version>${spring.security.version}</version>
+        </dependency>
+
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-databind</artifactId>
+            <version>2.22.3</version>
+        </dependency>
+
         <!-- Other deps include Guice and ROME -->
 
         <dependency>

app/src/main/java/org/apache/roller/weblogger/config/AuthMethod.java

@@ -17,11 +17,14 @@
  */
 package org.apache.roller.weblogger.config;
 
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
 public enum AuthMethod {
     ROLLERDB("db"),
     LDAP("ldap"),
-    OPENID("openid"),
-    DB_OPENID("db-openid"),
+    OIDC("oidc"),
+    DB_OIDC("db-oidc"),
     CMA("cma");
 
     private final String propertyName;
@@ -34,7 +37,22 @@ public String getPropertyName() {
         return propertyName;
     }
 
+    private static final Log log = LogFactory.getLog(AuthMethod.class);
+    private static boolean warnedAboutOpenId;
+
     public static AuthMethod getAuthMethod(String propertyName) {
+        // OpenID 2.0 was replaced by OIDC; accept the old property values so
+        // an upgraded install boots instead of failing on every request
+        if ("openid".equals(propertyName) || "db-openid".equals(propertyName)) {
+            AuthMethod replacement = "openid".equals(propertyName) ? OIDC : DB_OIDC;
+            if (!warnedAboutOpenId) {
+                warnedAboutOpenId = true;
+                log.warn("authentication.method=" + propertyName + " is no longer supported and is "
+                        + "treated as " + replacement.getPropertyName() + "; update the property and "
+                        + "configure an oidc.{id}.* provider registration");
+            }
+            return replacement;
+        }
         for (AuthMethod test : AuthMethod.values()) {
             if (test.getPropertyName().equals(propertyName)) {
                 return test;

app/src/main/java/org/apache/roller/weblogger/ui/core/RollerContext.java

@@ -46,6 +46,7 @@
 import org.apache.roller.weblogger.ui.core.plugins.UIPluginManagerImpl;
 import org.apache.roller.weblogger.ui.core.security.AutoProvision;
 import org.apache.roller.weblogger.ui.core.security.BootstrapSecurity;
+import org.apache.roller.weblogger.ui.core.security.RollerClientRegistrationRepository;
 import org.apache.roller.weblogger.util.Reflection;
 import org.apache.roller.weblogger.util.cache.CacheManager;
 import org.apache.velocity.runtime.RuntimeSingleton;
@@ -317,7 +318,10 @@ private DelegatingPasswordEncoder createPasswordEncoder() {
 
         // supported encoders
         encoders.put("bcrypt", new BCryptPasswordEncoder());
-        encoders.put("pbkdf2", Pbkdf2PasswordEncoder.defaultsForSpringSecurity_v5_8());
+        // pbkdf2 stores only salt+hash, so its parameters must stay as they were
+        // when existing passwords were encoded or those passwords stop verifying.
+        // scrypt and argon2 encode their parameters, so they can take v5_8.
+        encoders.put("pbkdf2", Pbkdf2PasswordEncoder.defaultsForSpringSecurity_v5_5());
         // provided by bouncy castle dependency
         encoders.put("scrypt", SCryptPasswordEncoder.defaultsForSpringSecurity_v5_8());
         encoders.put("argon2", Argon2PasswordEncoder.defaultsForSpringSecurity_v5_8());
@@ -348,6 +352,21 @@ private DelegatingPasswordEncoder createPasswordEncoder() {
     }
 
 
+    /**
+     * The OIDC client registrations declared in security.xml, or null when
+     * OIDC is not configured.
+     */
+    public static RollerClientRegistrationRepository getClientRegistrationRepository() {
+        ApplicationContext ctx =
+                WebApplicationContextUtils.getRequiredWebApplicationContext(servletContext);
+        try {
+            return ctx.getBean("clientRegistrationRepository", RollerClientRegistrationRepository.class);
+        } catch (NoSuchBeanDefinitionException exc) {
+            log.debug("No clientRegistrationRepository bean in context", exc);
+            return null;
+        }
+    }
+
     /**
      * Flush user from any caches maintained by security system.
      */

app/src/main/java/org/apache/roller/weblogger/ui/core/RollerSession.java

@@ -34,6 +34,9 @@
 import org.apache.roller.weblogger.business.UserManager;
 import org.apache.roller.weblogger.pojos.User;
 import org.apache.roller.weblogger.ui.core.security.AutoProvision;
+import org.apache.roller.weblogger.ui.core.security.RollerOidcUserService;
+import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
+import org.springframework.security.oauth2.core.oidc.user.OidcUser;
 
 
 /**
@@ -90,6 +93,15 @@ public static RollerSession getRollerSession(HttpServletRequest request) {
                     UserManager umgr = WebloggerFactory.getWeblogger().getUserManager();
                     User user = umgr.getUserByUserName(principal.getName());
 
+                    // For OIDC-authenticated users, look up by OIDC subject
+                    if (user == null && principal instanceof OAuth2AuthenticationToken oauthToken) {
+                        Object oauthPrincipal = oauthToken.getPrincipal();
+                        if (oauthPrincipal instanceof OidcUser oidcUser) {
+                            String oidcSubject = RollerOidcUserService.toOidcSubject(oidcUser);
+                            user = umgr.getUserByOpenIdUrl(oidcSubject);
+                        }
+                    }
+
                     // try one time to auto-provision, only happens if user==null
                     // which means installation has LDAP enabled in security.xml
                     if (user == null && WebloggerConfig.getBooleanProperty("users.ldap.autoProvision.enabled")) {

app/src/main/java/org/apache/roller/weblogger/ui/core/filters/BootstrapSecurityFilter.java

@@ -35,7 +35,10 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
         boolean installer = uri != null && (tokenPage || uri.contains("/roller-ui/install/")
                 || uri.endsWith("/roller-ui/register.rol")
                 || uri.endsWith("/roller-ui/register!save.rol")
-                || uri.endsWith("/roller-ui/setup.rol"));
+                || uri.endsWith("/roller-ui/setup.rol")
+                // OIDC sign-in can provision the first account
+                || uri.contains("/oauth2/authorization/")
+                || uri.contains("/login/oauth2/code/"));
         if (installer && !BootstrapSecurity.isCompleted()) {
             if (tokenPage) { chain.doFilter(req, res); return; }
             if (!BootstrapSecurity.isValid(r)) { p.sendRedirect(r.getContextPath() + "/roller-ui/bootstrap-token.rol"); return; }

app/src/main/java/org/apache/roller/weblogger/ui/core/security/LogoutRedirect.java

@@ -0,0 +1,84 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ *  contributor license agreements.  The ASF licenses this file to You
+ * under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.  For additional information regarding
+ * copyright in this work, please see the NOTICE file in the top level
+ * directory of this distribution.
+ */
+
+package org.apache.roller.weblogger.ui.core.security;
+
+import java.io.IOException;
+
+import jakarta.servlet.ServletContext;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+import org.springframework.security.core.Authentication;
+import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
+import org.springframework.security.oauth2.client.oidc.web.logout.OidcClientInitiatedLogoutSuccessHandler;
+import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
+import org.springframework.security.oauth2.core.oidc.user.OidcUser;
+import org.springframework.web.context.support.WebApplicationContextUtils;
+
+/**
+ * Sends the browser on after Roller has ended its own session.
+ *
+ * <p>A user who signed in through an OIDC provider is sent to the provider's
+ * {@code end_session_endpoint}, so the provider session ends too and the next
+ * "Sign in with ..." asks for credentials again. The provider then returns the
+ * browser to {@code postLogoutRedirectUri}. Everyone else, and OIDC users whose
+ * provider does not advertise an end-session endpoint, go to the front page as
+ * before.
+ */
+public class LogoutRedirect {
+
+    private final ClientRegistrationRepository clientRegistrationRepository;
+
+    public LogoutRedirect(ClientRegistrationRepository clientRegistrationRepository) {
+        this.clientRegistrationRepository = clientRegistrationRepository;
+    }
+
+    /** Uses the client registrations configured in {@code security.xml}. */
+    public static LogoutRedirect forServletContext(ServletContext servletContext) {
+        return new LogoutRedirect(WebApplicationContextUtils
+                .getRequiredWebApplicationContext(servletContext)
+                .getBean(ClientRegistrationRepository.class));
+    }
+
+    /**
+     * @param authentication the authentication of the session being ended,
+     *        captured before the session was invalidated; may be null
+     * @param postLogoutRedirectUri absolute URL the provider returns to, or
+     *        null to let Spring derive it from the request
+     */
+    public void sendRedirect(HttpServletRequest request, HttpServletResponse response,
+            Authentication authentication, String postLogoutRedirectUri)
+            throws IOException, ServletException {
+
+        if (clientRegistrationRepository != null
+                && authentication instanceof OAuth2AuthenticationToken
+                && authentication.getPrincipal() instanceof OidcUser) {
+            OidcClientInitiatedLogoutSuccessHandler handler =
+                    new OidcClientInitiatedLogoutSuccessHandler(clientRegistrationRepository);
+            handler.setPostLogoutRedirectUri(postLogoutRedirectUri != null
+                    ? postLogoutRedirectUri : "{baseUrl}/");
+            // falls back to the context root when the provider has no end-session endpoint
+            handler.onLogoutSuccess(request, response, authentication);
+            return;
+        }
+
+        response.sendRedirect(request.getContextPath() + "/");
+    }
+}