From 02ce694a353c8e4487024b1eea2afd5d5464966b Mon Sep 17 00:00:00 2001
From: Pierre-Olivier Mercier <nemunaire@nemunai.re>
Date: Sun, 15 May 2022 12:34:19 +0200
Subject: [PATCH 1/4] ui: Include next parameters in OIDC

---
 ui/src/components/AuthButton.svelte | 19 +++++++++++++++++++
 ui/src/routes/__layout.svelte       |  7 ++++---
 ui/src/routes/auth.svelte           |  6 ++++--
 3 files changed, 27 insertions(+), 5 deletions(-)
 create mode 100644 ui/src/components/AuthButton.svelte

diff --git a/ui/src/components/AuthButton.svelte b/ui/src/components/AuthButton.svelte
new file mode 100644
index 0000000..fc148fe
--- /dev/null
+++ b/ui/src/components/AuthButton.svelte
@@ -0,0 +1,19 @@
+<script>
+ import { page } from '$app/stores';
+
+ let className = '';
+ export { className as class };
+
+ let auth_route = 'auth/CRI'
+ $: {
+     if ($page.url.searchParams.get('next')) {
+         auth_route = 'auth/CRI?next=' + encodeURIComponent($page.url.searchParams.get('next'));
+     } else {
+         auth_route = 'auth/CRI?';
+     }
+ }
+</script>
+
+<a href={auth_route} target="_self" class="{className}">
+    <slot></slot>
+</a>
diff --git a/ui/src/routes/__layout.svelte b/ui/src/routes/__layout.svelte
index 10145b6..a99d9f2 100644
--- a/ui/src/routes/__layout.svelte
+++ b/ui/src/routes/__layout.svelte
@@ -42,6 +42,7 @@
 </script>
 
 <script>
+ import AuthButton from '../components/AuthButton.svelte';
  import Toaster from '../components/Toaster.svelte';
 
  export let rroute = '';
@@ -129,9 +130,9 @@
                     </li>
                 {:else}
                     <li class="nav-item">
-                        <a href="auth/CRI" target="_self" class="btn btn-dark">
-	                    Se connecter
-	                </a>
+                        <AuthButton class="btn btn-dark">
+                            Se connecter
+                        </AuthButton>
                     </li>
                 {/if}
 	    </ul>
diff --git a/ui/src/routes/auth.svelte b/ui/src/routes/auth.svelte
index feb3840..df42cfb 100644
--- a/ui/src/routes/auth.svelte
+++ b/ui/src/routes/auth.svelte
@@ -14,6 +14,8 @@
  import { goto } from '$app/navigation';
  import { page } from '$app/stores'
 
+ import AuthButton from '../components/AuthButton.svelte';
+
  let auth = { username: "", password: "" };
  let pleaseWait = false;
 
@@ -70,9 +72,9 @@
     <div class="col">
         <h2>OpenId Connect</h2>
         <div class="text-center">
-            <a href="auth/CRI" class="btn btn-primary" target="_self">
+            <AuthButton class="btn btn-primary">
 	        Me connecter avec mon compte CRI
-            </a>
+            </AuthButton>
         </div>
     </div>
 </div>

From 6c89d3e9be2ca47b78f0d7aeec7c8e0da847839e Mon Sep 17 00:00:00 2001
From: Pierre-Olivier Mercier <nemunaire@nemunai.re>
Date: Sun, 15 May 2022 12:34:38 +0200
Subject: [PATCH 2/4] Allow login through Kerberos if the user already exists
 in DB

---
 auth_krb5.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/auth_krb5.go b/auth_krb5.go
index 012f09b..ff6d1ed 100644
--- a/auth_krb5.go
+++ b/auth_krb5.go
@@ -51,7 +51,7 @@ func checkAuthKrb5(w http.ResponseWriter, _ httprouter.Params, body []byte) (int
 		}
 	}
 
-	if !found {
+	if !userExists(lf.Login) && !found {
 		return nil, fmt.Errorf("You are not allowed to log you in this way. Please use OpenID Connect.")
 	}
 

From a3e1797240041a0fb638597d356ed550f7f72407 Mon Sep 17 00:00:00 2001
From: Pierre-Olivier Mercier <nemunaire@nemunai.re>
Date: Sun, 15 May 2022 12:35:03 +0200
Subject: [PATCH 3/4] Reenable Secure cookies

---
 auth.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/auth.go b/auth.go
index ddd0f4d..03345c3 100644
--- a/auth.go
+++ b/auth.go
@@ -82,7 +82,7 @@ func completeAuth(w http.ResponseWriter, username string, email string, firstnam
 		Expires:  time.Now().Add(30 * 24 * time.Hour),
 		HttpOnly: true,
 		SameSite: http.SameSiteStrictMode,
-		//Secure: true,
+		Secure:   true,
 	})
 
 	return

From 5e20cec59d702c3809c7b8fcd99e719db451d39c Mon Sep 17 00:00:00 2001
From: Pierre-Olivier Mercier <nemunaire@nemunai.re>
Date: Sun, 15 May 2022 12:36:17 +0200
Subject: [PATCH 4/4] Handle next parameters even through OIDC

---
 auth_oidc.go | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/auth_oidc.go b/auth_oidc.go
index 828153b..e5ca93b 100644
--- a/auth_oidc.go
+++ b/auth_oidc.go
@@ -20,6 +20,7 @@ var (
 	oidcRedirectURL = "https://srs.nemunai.re"
 	oauth2Config    oauth2.Config
 	oidcVerifier    *oidc.IDTokenVerifier
+	nextSessionMap  = map[string]string{}
 )
 
 func init() {
@@ -60,6 +61,12 @@ func initializeOIDC() {
 
 func redirectOIDC_CRI(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
 	session, err := NewSession()
+
+	// Save next parameter
+	if len(r.URL.Query().Get("next")) > 0 {
+		nextSessionMap[fmt.Sprintf("%x", session.Id)] = r.URL.Query().Get("next")
+	}
+
 	if err != nil {
 		http.Error(w, fmt.Sprintf("{'errmsg':%q}", err.Error()), http.StatusInternalServerError)
 	} else {
@@ -121,5 +128,12 @@ func OIDC_CRI_complete(w http.ResponseWriter, r *http.Request, ps httprouter.Par
 		return
 	}
 
-	http.Redirect(w, r, "/", http.StatusFound)
+	// Retrieve next URL associated with session
+	if next, ok := nextSessionMap[fmt.Sprintf("%x", session.Id)]; ok {
+		http.Redirect(w, r, next, http.StatusFound)
+		delete(nextSessionMap, fmt.Sprintf("%x", session.Id))
+	} else {
+		http.Redirect(w, r, "/", http.StatusFound)
+	}
+
 }