Improved support for OpenID connect and OAuth2

[1earch]

Improved support for OAuth2 and OIDC

I'm creating this issue to centralize some problems related to SSO (PR #430, resolving issue #354). However, before listing problems, I would like to thanks @saibot94 and @To-om for their work on this feature.

Request Type

Bugs and feature requests

Invalid URL

The first error you can encounter is the one quoted in #1010 by @ananth07reddy:

java.lang.IllegalArgumentException: Invalid URL

This error is caused because the config parameter auth.sso.groups.url is mandatory: the user's groups can't be retreived from the user info endpoint (auth.oauth2.userUrl).

Authentication failure (on front-end)

This error was noted by @softybear, in issue #946. Its problem is that the SSO backend code is never reached. Indeed, when signing in with SSO, we are redirected to https://my-hive-instance.com/index.html#/login?code=[received_code] but the front-end code managing SSO login is waiting a URL as https://my-hive-instance.com/index.html?code=[received_code]#/login

Authentication failure on disconnect

The front-end code tries to login us when we want to disconnect, because the code is still in the URL.

Steps to reproduces

1. SSO login
2. Be redirected to https://my-hive-instance.com/index.html?code=[received_code]#/login
3. Be authenticated then see cases
   https://my-hive-instance.com/index.html?code=[received_code]#/cases
4. Use the disconnect link in navbar and be redirected to https://my-hive-instance.com/index.html?code=[received_code]#/login

Thus, the backend will try to authenticate you with the code another time. This won't work and the frontend will show you a "Authentication failure" error.

SSO auto-login doesn't work

This feature (auth.sso.autologin) doesn't work. When activated, going to my TheHive instance homepage doesn't automagically redirect me to my federated identity provider.

SSO user profile update

The way SSO is actually implemented doesn't allow a user profile update. This should be possible in a case of a company, where employees' rights could be updated.

[To-om]

@1earch Thank you for your contribution.