Correct typos and error in all comments of the PR

* issuer,
  * authorization_endpoint,
  * token_endpoint,
  * jwks_uri
- Replace openid-flow-type with openid-response-type
- Use an Enum for openid-response-type to limit to the values 'id_token',
  'token' or 'cod'
- Treat the response type as an implicit flow type allowing use of AWS
  Cognito

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/AuthenticationProviderService.java

@@ -63,6 +63,7 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
     /**
      * The standard HTTP parameter which will be included within the URL by all
      * OpenID services upon successful implicit flow authentication.
+     *
      */
     public static final String IMPLICIT_TOKEN_PARAMETER_NAME = "id_token";
 
@@ -136,23 +137,24 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
         Set<String> groups = null;
         Map<String,String> tokens = Collections.emptyMap();
 
-        logger.debug("OpenID authentication with {} flow (ID: {}, Secret: {}, PKCE: {})",
+        logger.debug("OpenID authentication with '{}' reponse type (ID: {}, Secret: {}, PKCE: {})",
-                  confService.getFlowType(),
+                  confService.getResponseType(),
                   confService.getClientID(),
                   confService.getClientSecret(),
                   confService.isPKCERequired());
 
-        if (confService.getFlowType().equals("implicit")) {
+        if (confService.isImplicitFlow()) {
             String token = credentials.getParameter(IMPLICIT_TOKEN_PARAMETER_NAME);
             if (token != null) {
-                JwtClaims claims = tokenService.validateToken(token);
+                JwtClaims claims = tokenService.validateTokenOrCode(token, "");
                 if (claims != null) {
                     username = tokenService.processUsername(claims);
                     groups = tokenService.processGroups(claims);
                     tokens = tokenService.processAttributes(claims);
                 }
             }
-        } else {
+        }
+        else {
             String verifier = null;
             if (confService.isPKCERequired()) {
                 // Recover session
@@ -163,7 +165,7 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
             }
             String code = credentials.getParameter("code");
             if (code != null && (confService.isPKCERequired() == false || verifier != null)) {
-                JwtClaims claims = tokenService.validateCode(code, verifier);
+                JwtClaims claims = tokenService.validateTokenOrCode(code, verifier);
                 if (claims != null) {
                     username = tokenService.processUsername(claims);
                     groups = tokenService.processGroups(claims);
@@ -194,21 +196,16 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
 
     @Override
     public URI getLoginURI() throws GuacamoleException {
-        if (confService.getFlowType().equals("implicit")) {
+        UriBuilder builder = UriBuilder.fromUri(confService.getAuthorizationEndpoint())
-            return UriBuilder.fromUri(confService.getAuthorizationEndpoint())
+                .queryParam("scope", confService.getScope())
-                    .queryParam("scope", confService.getScope())
+                .queryParam("response_type", confService.getResponseType().toString())
-                    .queryParam("response_type", IMPLICIT_TOKEN_PARAMETER_NAME)
+                .queryParam("client_id", confService.getClientID())
-                    .queryParam("client_id", confService.getClientID())
+                .queryParam("redirect_uri", confService.getRedirectURI());
-                    .queryParam("redirect_uri", confService.getRedirectURI())
-                    .queryParam("nonce", nonceService.generate(confService.getMaxNonceValidity() * 60000L))
-                    .build();
-        } else  {
-            UriBuilder builder = UriBuilder.fromUri(confService.getAuthorizationEndpoint())
-                    .queryParam("scope", confService.getScope())
-                    .queryParam("response_type", CODE_TOKEN_PARAMETER_NAME)
-                    .queryParam("client_id", confService.getClientID())
-                    .queryParam("redirect_uri", confService.getRedirectURI());
 
+        if (confService.isImplicitFlow()) {
+            builder.queryParam("nonce", nonceService.generate(confService.getMaxNonceValidity() * 60000L));
+        }
+        else  {
             if (confService.isPKCERequired()) {
                 String codeVerifier = PKCEUtil.generateCodeVerifier();
                 String codeChallenge;
@@ -222,7 +219,7 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
 
                 // Store verifier for authenticateUser
                 OpenIDAuthenticationSession session = new OpenIDAuthenticationSession(codeVerifier,
-                            confService.getAuthenticationTimeout() * 60000L);
+                            confService.getMaxPKCEVerifierValidity() * 60000L);
                 String identifier = IdentifierGenerator.generateIdentifier();
                 sessionManager.defer(session, identifier);
 
@@ -230,9 +227,9 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
                        .queryParam("code_challenge_method", "S256")
                        .queryParam(AUTH_SESSION_QUERY_PARAM, identifier);
             }
-
-            return builder.build();
         }
+
+        return builder.build();
     }
 
     @Override

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/AuthenticationProviderService.java.orig

@@ -1,274 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.guacamole.auth.openid;
-
-import com.google.inject.Inject;
-import com.google.inject.Provider;
-import com.google.inject.Singleton;
-import java.net.URI;
-import java.util.Arrays;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.Map;
-import java.util.Set;
-import javax.ws.rs.core.UriBuilder;
-import org.apache.guacamole.auth.openid.conf.ConfigurationService;
-import org.apache.guacamole.auth.openid.OpenIDAuthenticationSessionManager;
-import org.apache.guacamole.auth.openid.token.TokenValidationService;
-import org.apache.guacamole.auth.openid.util.PKCEUtil;
-import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.auth.sso.NonceService;
-import org.apache.guacamole.auth.sso.SSOAuthenticationProviderService;
-import org.apache.guacamole.auth.sso.user.SSOAuthenticatedUser;
-import org.apache.guacamole.form.Field;
-import org.apache.guacamole.form.RedirectField;
-import org.apache.guacamole.language.TranslatableMessage;
-import org.apache.guacamole.net.auth.Credentials;
-import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
-import org.apache.guacamole.net.auth.credentials.GuacamoleInvalidCredentialsException;
-import org.apache.guacamole.net.auth.IdentifierGenerator;
-import org.jose4j.jwt.JwtClaims;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import org.apache.guacamole.net.auth.IdentifierGenerator;
-
-/**
- * Service that authenticates Guacamole users by processing OpenID tokens.
- */
-@Singleton
-public class AuthenticationProviderService implements SSOAuthenticationProviderService {
-
-    /**
-     * Logger for this class.
-     */
-    private final Logger logger = LoggerFactory.getLogger(AuthenticationProviderService.class);
-
-    /**
-     * The standard HTTP parameter which will be included within the URL by all
-     * OpenID services upon successful implicit flow authentication.
-     */
-    public static final String IMPLICIT_TOKEN_PARAMETER_NAME = "id_token";
-
-    /**
-     * The standard HTTP parameter which will be included within the URL by all
-     * OpenID services upon successful code flow authentication. Used to recover
-     * the stored user state.
-     */
-    public static final String CODE_TOKEN_PARAMETER_NAME = "code";
-
-    /**
-     * The name of the query parameter that identifies an active authentication
-     * session (in-progress OpenID authentication attempt).
-     */
-    public static final String AUTH_SESSION_QUERY_PARAM = "state";
-
-    /**
-     * The REST API used for a local rediect and callback for the IdP to
-     * return a code and access stored PKCE verifiers
-     */
-    public static final String CODE_REDIRECT_API = "/api/ext/openid/redirect";
-
-    /**
-     * Service for retrieving OpenID configuration information.
-     */
-    @Inject
-    private ConfigurationService confService;
-
-    /**
-     * Manager of active SAML authentication attempts.
-     */
-    @Inject
-    private OpenIDAuthenticationSessionManager sessionManager;
-
-    /**
-     * Service for validating and generating unique nonce values.
-     */
-    @Inject
-    private NonceService nonceService;
-
-    /**
-     * Service for validating received ID tokens.
-     */
-    @Inject
-    private TokenValidationService tokenService;
-
-    /**
-     * Provider for AuthenticatedUser objects.
-     */
-    @Inject
-    private Provider<SSOAuthenticatedUser> authenticatedUserProvider;
-
-    /**
-     * Return the value of the session identifier associated with the given
-     * credentials, or null if no session identifier is found in the
-     * credentials.
-     *
-     * @param credentials
-     *     The credentials from which to extract the session identifier.
-     *
-     * @return
-     *     The session identifier associated with the given credentials, or
-     *     null if no identifier is found.
-     */
-    public static String getSessionIdentifier(Credentials credentials) {
-
-        // Return the session identifier from the request params, if set, or
-        // null otherwise
-        return credentials != null ? credentials.getParameter(AUTH_SESSION_QUERY_PARAM) : null;
-    }
-
-    @Override
-    public SSOAuthenticatedUser authenticateUser(Credentials credentials)
-            throws GuacamoleException {
-
-        String username = null;
-        Set<String> groups = null;
-        Map<String,String> tokens = Collections.emptyMap();
-
-        logger.debug("OpenID authentication with {} flow (ID: {}, Secret: {}, PKCE: {})",
-                  confService.getFlowType(),
-                  confService.getClientID(),
-                  confService.getClientSecret(),
-                  confService.isPKCERequired());
-
-        if (confService.getFlowType().equals("implicit")) {
-            String token = credentials.getParameter(IMPLICIT_TOKEN_PARAMETER_NAME);
-            if (token != null) {
-                JwtClaims claims = tokenService.validateToken(token);
-                if (claims != null) {
-                    username = tokenService.processUsername(claims);
-                    groups = tokenService.processGroups(claims);
-                    tokens = tokenService.processAttributes(claims);
-                }
-            }
-        } else {
-            String verifier = null;
-            if (confService.isPKCERequired()) {
-                // Recover session
-                String identifier = getSessionIdentifier(credentials);
-                if (identifier != null) {
-                    verifier = sessionManager.getVerifier(identifier);
-                }
-            }
-            String code = credentials.getParameter("code");
-            if (code != null && (confService.isPKCERequired() == false || verifier != null)) {
-                JwtClaims claims = tokenService.validateCode(code, verifier);
-                if (claims != null) {
-                    username = tokenService.processUsername(claims);
-                    groups = tokenService.processGroups(claims);
-                    tokens = tokenService.processAttributes(claims);
-                }
-            }
-        }
-
-        // If the username was successfully retrieved from the token, produce
-        // authenticated user
-        if (username != null) {
-            // Create corresponding authenticated user
-            SSOAuthenticatedUser authenticatedUser = authenticatedUserProvider.get();
-            authenticatedUser.init(username, credentials, groups, tokens);
-            return authenticatedUser;
-        }
-
-        // Request OpenID token (will automatically redirect the user to the
-        // OpenID authorization page via JavaScript)
-        throw new GuacamoleInvalidCredentialsException("Invalid login.",
-            new CredentialsInfo(Arrays.asList(new Field[] {
-                new RedirectField(AUTH_SESSION_QUERY_PARAM, getLoginURI(),
-                        new TranslatableMessage("LOGIN.INFO_IDP_REDIRECT_PENDING"))
-            }))
-        );
-    }
-
-    @Override
-    public URI getLoginURI() throws GuacamoleException {
-        if (confService.getFlowType().equals("implicit")) {
-            return UriBuilder.fromUri(confService.getAuthorizationEndpoint())
-                    .queryParam("scope", confService.getScope())
-                    .queryParam("response_type", IMPLICIT_TOKEN_PARAMETER_NAME)
-                    .queryParam("client_id", confService.getClientID())
-                    .queryParam("redirect_uri", confService.getRedirectURI())
-                    .queryParam("nonce", nonceService.generate(confService.getMaxNonceValidity() * 60000L))
-                    .build();
-        } else  {
-            UriBuilder builder = UriBuilder.fromUri(confService.getAuthorizationEndpoint())
-                    .queryParam("scope", confService.getScope())
-                    .queryParam("response_type", CODE_TOKEN_PARAMETER_NAME)
-                    .queryParam("client_id", confService.getClientID())
-                    .queryParam("redirect_uri", confService.getRedirectURI());
-
-            if (confService.isPKCERequired()) {
-                String codeVerifier = PKCEUtil.generateCodeVerifier();
-                String codeChallenge;
-
-                try {
-                    codeChallenge = PKCEUtil.generateCodeChallenge(codeVerifier);
-                }
-                catch (Exception e) {
-                    throw new GuacamoleException("Unable to compute PKCE challenge", e);
-                }
-
-                // Store verifier for authenticateUser
-                OpenIDAuthenticationSession session = new OpenIDAuthenticationSession(codeVerifier,
-                            confService.getAuthenticationTimeout() * 60000L);
-                String identifier = IdentifierGenerator.generateIdentifier();
-                sessionManager.defer(session, identifier);
-
-                builder.queryParam("code_challenge", codeChallenge)
-                       .queryParam("code_challenge_method", "S256")
-                       .queryParam(AUTH_SESSION_QUERY_PARAM, identifier);
-            }
-
-            return builder.build();
-        }
-    }
-
-    @Override
-    public URI getLogoutURI(String idToken) throws GuacamoleException {
-
-        // If no logout endpoint is configured, return null
-        URI logoutEndpoint = confService.getLogoutEndpoint();
-        if (logoutEndpoint == null)
-            return null;
-
-        // Build the logout URI with appropriate parameters
-        UriBuilder logoutUriBuilder = UriBuilder.fromUri(logoutEndpoint);
-
-        // Add post_logout_redirect_uri parameter
-        logoutUriBuilder.queryParam("post_logout_redirect_uri",
-                confService.getPostLogoutRedirectURI());
-
-        // Add id_token_hint if available, otherwise add client_id
-        if (idToken != null && !idToken.isEmpty())
-            logoutUriBuilder.queryParam("id_token_hint", idToken);
-        else
-            logoutUriBuilder.queryParam("client_id", confService.getClientID());
-
-        return logoutUriBuilder.build();
-    }
-
-    @Override
-    public void shutdown() {
-        sessionManager.shutdown();
-    }
-
-}

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/OpenIDAuthenticationProviderModule.java

@@ -21,8 +21,10 @@ package org.apache.guacamole.auth.openid;
 
 import com.google.inject.AbstractModule;
 import com.google.inject.Scopes;
+import com.google.inject.Singleton;
 import org.apache.guacamole.auth.openid.conf.ConfigurationService;
 import org.apache.guacamole.auth.openid.conf.OpenIDEnvironment;
+import org.apache.guacamole.auth.openid.conf.OpenIDWellKnown;
 import org.apache.guacamole.auth.openid.OpenIDAuthenticationSessionManager;
 import org.apache.guacamole.auth.sso.NonceService;
 import org.apache.guacamole.auth.openid.token.TokenValidationService;
@@ -44,6 +46,7 @@ public class OpenIDAuthenticationProviderModule extends AbstractModule {
         bind(NonceService.class).in(Scopes.SINGLETON);
         bind(TokenValidationService.class);
         bind(OpenIDAuthenticationSessionManager.class);
+
         bind(Environment.class).toInstance(environment);
     }
 

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/OpenIDAuthenticationProviderModule.java.rej

@@ -1,11 +0,0 @@
---- extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/OpenIDAuthenticationProviderModule.java	2026-04-08 19:37:41.518619970 +0200
-+++ extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/OpenIDAuthenticationProviderModule.java	2026-04-08 16:43:54.617087120 +0200
-@@ -37,7 +37,7 @@
-      * The configuration environment for this server and extension.
-      */
-     private final Environment environment = new OpenIDEnvironment();
--
-+    
-     @Override
-     protected void configure() {
-         bind(ConfigurationService.class);

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/OpenIDAuthenticationSession.java

@@ -24,6 +24,7 @@ import org.apache.guacamole.net.auth.AuthenticationSession;
 /**
  * Representation of an in-progress OpenID authentication attempt.
  */
+
 public class OpenIDAuthenticationSession extends AuthenticationSession {
     /**
      * The PKCE challenge verifier.

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/conf/ConfigurationService.java

@@ -24,9 +24,12 @@ import java.net.URI;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.List;
+import org.apache.guacamole.auth.openid.conf.OpenIDResponseType;
+import org.apache.guacamole.auth.openid.conf.OpenIDWellKnown;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.environment.Environment;
 import org.apache.guacamole.properties.BooleanGuacamoleProperty;
+import org.apache.guacamole.properties.EnumGuacamoleProperty;
 import org.apache.guacamole.properties.IntegerGuacamoleProperty;
 import org.apache.guacamole.properties.StringGuacamoleProperty;
 import org.apache.guacamole.properties.URIGuacamoleProperty;
@@ -38,9 +41,9 @@ import org.apache.guacamole.properties.URIGuacamoleProperty;
 public class ConfigurationService {
 
     /**
-     * The default OICD flow type
+     * The default OICD reponse type
      */
-    private static final String DEFAULT_FLOW_TYPE = "implicit";
+    private static final OpenIDResponseType DEFAULT_RESPONSE_TYPE = OpenIDResponseType.ID_TOKEN;
 
     /**
      * The default claim type to use to retrieve an authenticated user's
@@ -82,6 +85,12 @@ public class ConfigurationService {
      */
     private static final int DEFAULT_MAX_NONCE_VALIDITY = 10;
 
+    /**
+     * The default maximum amount of time that a pkce verifier generated by the
+     * Guacamole server should remain valid, in minutes.
+     */
+    private static final int DEFAULT_MAX_PKCE_VERIFIER_VALIDITY = 10;
+
     /**
      * The authorization endpoint (URI) of the OpenID service.
      */
@@ -121,20 +130,19 @@ public class ConfigurationService {
      */
     private static final URIGuacamoleProperty OPENID_TOKEN_ENDPOINT =
             new URIGuacamoleProperty() {
+
         @Override
-        public String getName() {
+        public String getName() { return "openid-token-endpoint"; }
-            return "openid-token-endpoint";
-        }
     };
 
     /**
-     * The flow type of the OpenID service.
+     * The reponse type of the OpenID service.
      */
-    private static final StringGuacamoleProperty OPENID_FLOW_TYPE =
+    private static final EnumGuacamoleProperty<OpenIDResponseType> OPENID_RESPONSE_TYPE =
-            new StringGuacamoleProperty() {
+            new EnumGuacamoleProperty<OpenIDResponseType>(OpenIDResponseType.class) {
 
         @Override
-        public String getName() { return "openid-flow-type"; }
+        public String getName() { return "openid-response-type"; }
 
     };
 
@@ -144,10 +152,9 @@ public class ConfigurationService {
      */
     private static final StringGuacamoleProperty OPENID_CLIENT_SECRET =
             new StringGuacamoleProperty() {
+
         @Override
-        public String getName() {
+        public String getName() { return "openid-client-secret"; }
-            return "openid-client-secret";
-        }
     };
 
     /**
@@ -155,27 +162,27 @@ public class ConfigurationService {
      */
     private static final BooleanGuacamoleProperty OPENID_PKCE_REQUIRED =
             new BooleanGuacamoleProperty() {
+
         @Override
-        public String getName() {
+        public String getName() { return "openid-pkce-required"; }
-            return "openid-pkce-required";
-        }
     };
 
     /**
-     * The maximum amount of time to allow for an in-progress OpenID
+     * The maximum amount of time that a PKCE verifier generated by the
-     * authentication attempt to be completed, in minutes. A user that takes
+     * Guacamole server should remain valid, in minutes. As each OpenID request
-     * longer than this amount of time to complete authentication with their
+     * requiring PKCE has a unique verifier, this imposes an upper limit on the
-     * identity provider will be redirected back to the identity provider to
+     * amount of time any particular OpenID request can result in successful
-     * try again.
+     * authentication within Guacamole. By default, each generated PKCE verifier
+     * expires after 10 minutes.
      */
-    private static final IntegerGuacamoleProperty OPENID_AUTH_TIMEOUT =
+    private static final IntegerGuacamoleProperty OPENID_MAX_PKCE_VERIFIER_VALIDITY =
             new IntegerGuacamoleProperty() {
+
         @Override
-        public String getName() { return "openid-auth-timeout"; }
+        public String getName() { return "openid-max-pkce-verifier-validity"; }
 
     };
 
-
     /**
      * The claim type which contains the authenticated user's username within
      * any valid JWT.
@@ -317,6 +324,12 @@ public class ConfigurationService {
     @Inject
     private Environment environment;
     
+    /**
+     * Service for retrieving OpenID well-known data.
+     */
+    @Inject
+    private OpenIDWellKnown confWellKnown;
+
     /**
      * Returns the authorization endpoint (URI) of the OpenID service as
      * configured with guacamole.properties.
@@ -326,11 +339,16 @@ public class ConfigurationService {
      *     guacamole.properties.
      *
      * @throws GuacamoleException
-     *     If guacamole.properties cannot be parsed, or if the authorization
+     *     If guacamole.properties cannot be parsed, or it authorization and
-     *     endpoint property is missing.
+     *     well-known endpoints are property is missing.
      */
     public URI getAuthorizationEndpoint() throws GuacamoleException {
-        return environment.getRequiredProperty(OPENID_AUTHORIZATION_ENDPOINT);
+        URI authorization_endpoint = environment.getProperty(OPENID_AUTHORIZATION_ENDPOINT);
+        authorization_endpoint = authorization_endpoint == null ? confWellKnown.getAuthorizationEndpoint() : authorization_endpoint;
+        if (authorization_endpoint == null) {
+            throw new GuacamoleException("Property openid-authorization-endpoint or openid-well-known-endpoint is required");
+        }
+        return authorization_endpoint;
     }
 
     /**
@@ -379,10 +397,15 @@ public class ConfigurationService {
      *
      * @throws GuacamoleException
      *     If guacamole.properties cannot be parsed, or if the issuer property
-     *     is missing.
+     *     and well-known endpoints are property is missing.
      */
     public String getIssuer() throws GuacamoleException {
-        return environment.getRequiredProperty(OPENID_ISSUER);
+        String issuer = environment.getProperty(OPENID_ISSUER);
+        issuer = issuer == null ? confWellKnown.getIssuer() : issuer;
+        if (issuer == null) {
+            throw new GuacamoleException("Property openid-issuer or openid-well-known-endpoint is required");
+        }
+        return issuer;
     }
 
     /**
@@ -396,11 +419,16 @@ public class ConfigurationService {
      *     guacamole.properties.
      *
      * @throws GuacamoleException
-     *     If guacamole.properties cannot be parsed, or if the JWKS endpoint
+     *     If guacamole.properties cannot be parsed, or if the JWKS and
-     *     property is missing.
+     *     well-known endpoints are property is missing.
      */
     public URI getJWKSEndpoint() throws GuacamoleException {
-        return environment.getRequiredProperty(OPENID_JWKS_ENDPOINT);
+        URI jwks_uri =  environment.getProperty(OPENID_JWKS_ENDPOINT);
+        jwks_uri = jwks_uri == null ? confWellKnown.getJWKSEndpoint() : jwks_uri;
+        if (jwks_uri == null) {
+            throw new GuacamoleException("Property openid-jwks-endpoint or openid-well-known-endpoint is required");
+        }
+        return jwks_uri;
     }
 
     /**
@@ -412,25 +440,44 @@ public class ConfigurationService {
      *     guacamole.properties.
      *
      * @throws GuacamoleException
-     *     If guacamole.properties cannot be parsed, or if the authorization
+     *     If guacamole.properties cannot be parsed, or if the token and
-     *     endpoint property is missing.
+     *     well-known endpoints are property is missing.
      */
     public URI getTokenEndpoint() throws GuacamoleException {
-        return environment.getRequiredProperty(OPENID_TOKEN_ENDPOINT);
+        URI token_endpoint = environment.getProperty(OPENID_TOKEN_ENDPOINT);
+        token_endpoint = token_endpoint == null ? confWellKnown.getTokenEndpoint() : token_endpoint;
+        if (token_endpoint == null) {
+            throw new GuacamoleException("Property openid-token-endpoint or openid-well-known-endpoint is required");
+        }
+        return token_endpoint;
     }
 
     /**
-     * Returns the flow type of the OpenID service as configured with guacamole.properties.
+     * Returns the reponse type of the OpenID service as configured with guacamole.properties.
      *
      * @return
-     *     The flow type of the OpenID service, as configured with guacamole.properties. Can
+     *     The reponse type of the OpenID service, as configured with guacamole.properties. Can
-     *     be either 'implicit' or 'code'.
+     *     be either 'id_token', 'token' or 'code'.
      *
      * @throws GuacamoleException
      *     If guacamole.properties cannot be parsed.
      */
-    public String getFlowType() throws GuacamoleException {
+    public OpenIDResponseType getResponseType() throws GuacamoleException {
-        return environment.getProperty(OPENID_FLOW_TYPE, DEFAULT_FLOW_TYPE);
+        return environment.getProperty(OPENID_RESPONSE_TYPE, DEFAULT_RESPONSE_TYPE);
+    }
+
+    /**
+     * Returns true if the response type defines an implict flow
+     *
+     * @return
+     *     The whether implicit flow is used or not, as configured with guacamole.properties.
+     *
+     * @throws GuacamoleException
+     *     If guacamole.properties cannot be parsed.
+     */
+    public boolean isImplicitFlow() throws GuacamoleException {
+        OpenIDResponseType response_type = environment.getProperty(OPENID_RESPONSE_TYPE, DEFAULT_RESPONSE_TYPE);
+        return response_type != OpenIDResponseType.CODE;
     }
 
     /**
@@ -444,8 +491,7 @@ public class ConfigurationService {
      *     as configured with guacamole.properties.
      *
      * @throws GuacamoleException
-     *     If guacamole.properties cannot be parsed, or if the client ID
+     *     If guacamole.properties cannot be parsed.
-     *     property is missing.
      */
     public String getClientSecret() throws GuacamoleException {
        return environment.getProperty(OPENID_CLIENT_SECRET);
@@ -469,21 +515,21 @@ public class ConfigurationService {
     }
 
     /**
-     * Returns the maximum amount of time to allow for an in-progress OpenID
+     * Returns the maximum amount of time that a PKCE verifier generated by the
-     * authentication attempt to be completed, in minutes. A user that takes
+     * Guacamole server should remain valid, in minutes. As each OpenID request
-     * longer than this amount of time to complete authentication with their
+     * requiring PKCE has a unique verifier, this imposes an upper limit on the
-     * identity provider will be redirected back to the identity provider to
+     * amount of time any particular OpenID request can result in successful
-     * try again.
+     * authentication within Guacamole. By default, this will be 10.
      *
      * @return
-     *     The maximum amount of time to allow for an in-progress SAML
+     *     The maximum amount of time that a PKCE verifier generated by the
-     *     authentication attempt to be completed, in minutes.
+     *     Guacamole server should remain valid, in minutes.
      *
      * @throws GuacamoleException
-     *     If the authentication timeout cannot be parsed.
+     *     If guacamole.properties cannot be parsed.
      */
-    public int getAuthenticationTimeout() throws GuacamoleException {
+    public int getMaxPKCEVerifierValidity() throws GuacamoleException {
-        return environment.getProperty(OPENID_AUTH_TIMEOUT, 5);
+        return environment.getProperty(OPENID_MAX_PKCE_VERIFIER_VALIDITY, DEFAULT_MAX_PKCE_VERIFIER_VALIDITY);
     }
 
     /**

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/conf/ConfigurationService.java.orig

@@ -1,639 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.guacamole.auth.openid.conf;
-
-import com.google.inject.Inject;
-import java.net.URI;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.List;
-import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.environment.Environment;
-import org.apache.guacamole.properties.BooleanGuacamoleProperty;
-import org.apache.guacamole.properties.IntegerGuacamoleProperty;
-import org.apache.guacamole.properties.StringGuacamoleProperty;
-import org.apache.guacamole.properties.URIGuacamoleProperty;
-
-/**
- * Service for retrieving configuration information regarding the OpenID
- * service.
- */
-public class ConfigurationService {
-
-    /**
-     * The default OICD flow type
-     */
-    private static final String DEFAULT_FLOW_TYPE = "implicit";
-
-    /**
-     * The default claim type to use to retrieve an authenticated user's
-     * username.
-     */
-    private static final String DEFAULT_USERNAME_CLAIM_TYPE = "email";
-
-    /**
-     * The default claim type to use to retrieve an authenticated user's
-     * groups.
-     */
-    private static final String DEFAULT_GROUPS_CLAIM_TYPE = "groups";
-
-    /**
-     * The default JWT claims list to map to tokens.
-     */
-    private static final List<String> DEFAULT_ATTRIBUTES_CLAIM_TYPE = Collections.emptyList();
-
-    /**
-     * The default space-separated list of OpenID scopes to request.
-     */
-    private static final String DEFAULT_SCOPE = "openid email profile";
-
-    /**
-     * The default amount of clock skew tolerated for timestamp comparisons
-     * between the Guacamole server and OpenID service clocks, in seconds.
-     */
-    private static final int DEFAULT_ALLOWED_CLOCK_SKEW = 30;
-
-    /**
-     * The default maximum amount of time that an OpenID token should remain
-     * valid, in minutes.
-     */
-    private static final int DEFAULT_MAX_TOKEN_VALIDITY = 300;
-
-    /**
-     * The default maximum amount of time that a nonce generated by the
-     * Guacamole server should remain valid, in minutes.
-     */
-    private static final int DEFAULT_MAX_NONCE_VALIDITY = 10;
-
-    /**
-     * The authorization endpoint (URI) of the OpenID service.
-     */
-    private static final URIGuacamoleProperty OPENID_AUTHORIZATION_ENDPOINT =
-            new URIGuacamoleProperty() {
-
-        @Override
-        public String getName() { return "openid-authorization-endpoint"; }
-
-    };
-
-    /**
-     * The endpoint (URI) of the JWKS service which defines how received ID
-     * tokens (JWTs) shall be validated.
-     */
-    private static final URIGuacamoleProperty OPENID_JWKS_ENDPOINT =
-            new URIGuacamoleProperty() {
-
-        @Override
-        public String getName() { return "openid-jwks-endpoint"; }
-
-    };
-
-    /**
-     * The issuer to expect for all received ID tokens.
-     */
-    private static final StringGuacamoleProperty OPENID_ISSUER =
-            new StringGuacamoleProperty() {
-
-        @Override
-        public String getName() { return "openid-issuer"; }
-
-    };
-
-    /**
-     * The token endpoint (URI) of the OIDC service.
-     */
-    private static final URIGuacamoleProperty OPENID_TOKEN_ENDPOINT =
-            new URIGuacamoleProperty() {
-        @Override
-        public String getName() {
-            return "openid-token-endpoint";
-        }
-    };
-
-    /**
-     * The flow type of the OpenID service.
-     */
-    private static final StringGuacamoleProperty OPENID_FLOW_TYPE =
-            new StringGuacamoleProperty() {
-
-        @Override
-        public String getName() { return "openid-flow-type"; }
-
-    };
-
-    /**
-     * OIDC client secret which should be submitted to the OIDC service when
-     * validating tokens with code flow
-     */
-    private static final StringGuacamoleProperty OPENID_CLIENT_SECRET =
-            new StringGuacamoleProperty() {
-        @Override
-        public String getName() {
-            return "openid-client-secret";
-        }
-    };
-
-    /**
-     * True if "Proof Key for Code Exchange" (PKCE) must be used.
-     */
-    private static final BooleanGuacamoleProperty OPENID_PKCE_REQUIRED =
-            new BooleanGuacamoleProperty() {
-        @Override
-        public String getName() {
-            return "openid-pkce-required";
-        }
-    };
-
-    /**
-     * The maximum amount of time to allow for an in-progress OpenID
-     * authentication attempt to be completed, in minutes. A user that takes
-     * longer than this amount of time to complete authentication with their
-     * identity provider will be redirected back to the identity provider to
-     * try again.
-     */
-    private static final IntegerGuacamoleProperty OPENID_AUTH_TIMEOUT =
-            new IntegerGuacamoleProperty() {
-        @Override
-        public String getName() { return "openid-auth-timeout"; }
-
-    };
-
-
-    /**
-     * The claim type which contains the authenticated user's username within
-     * any valid JWT.
-     */
-    private static final StringGuacamoleProperty OPENID_USERNAME_CLAIM_TYPE =
-            new StringGuacamoleProperty() {
-
-        @Override
-        public String getName() { return "openid-username-claim-type"; }
-
-    };
-
-    /**
-     * The claim type which contains the authenticated user's groups within
-     * any valid JWT.
-     */
-    private static final StringGuacamoleProperty OPENID_GROUPS_CLAIM_TYPE =
-            new StringGuacamoleProperty() {
-
-        @Override
-        public String getName() { return "openid-groups-claim-type"; }
-
-    };
-
-    /**
-     * The claims within any valid JWT that should be mapped to
-     * the authenticated user's tokens, as configured with guacamole.properties.
-     */
-    private static final StringGuacamoleProperty OPENID_ATTRIBUTES_CLAIM_TYPE =
-            new StringGuacamoleProperty() {
-                @Override
-                public String getName() { return "openid-attributes-claim-type"; }
-            };
-
-    /**
-     * The space-separated list of OpenID scopes to request.
-     */
-    private static final StringGuacamoleProperty OPENID_SCOPE =
-            new StringGuacamoleProperty() {
-
-        @Override
-        public String getName() { return "openid-scope"; }
-
-    };
-
-    /**
-     * The amount of clock skew tolerated for timestamp comparisons between the
-     * Guacamole server and OpenID service clocks, in seconds.
-     */
-    private static final IntegerGuacamoleProperty OPENID_ALLOWED_CLOCK_SKEW =
-            new IntegerGuacamoleProperty() {
-
-        @Override
-        public String getName() { return "openid-allowed-clock-skew"; }
-
-    };
-
-    /**
-     * The maximum amount of time that an OpenID token should remain valid, in
-     * minutes.
-     */
-    private static final IntegerGuacamoleProperty OPENID_MAX_TOKEN_VALIDITY =
-            new IntegerGuacamoleProperty() {
-
-        @Override
-        public String getName() { return "openid-max-token-validity"; }
-
-    };
-
-    /**
-     * The maximum amount of time that a nonce generated by the Guacamole server
-     * should remain valid, in minutes. As each OpenID request has a unique
-     * nonce value, this imposes an upper limit on the amount of time any
-     * particular OpenID request can result in successful authentication within
-     * Guacamole.
-     */
-    private static final IntegerGuacamoleProperty OPENID_MAX_NONCE_VALIDITY =
-            new IntegerGuacamoleProperty() {
-
-        @Override
-        public String getName() { return "openid-max-nonce-validity"; }
-
-    };
-
-    /**
-     * OpenID client ID which should be submitted to the OpenID service when
-     * necessary. This value is typically provided by the OpenID service when
-     * OpenID credentials are generated for your application.
-     */
-    private static final StringGuacamoleProperty OPENID_CLIENT_ID =
-            new StringGuacamoleProperty() {
-
-        @Override
-        public String getName() { return "openid-client-id"; }
-
-    };
-
-    /**
-     * The URI that the OpenID service should redirect to after the
-     * authentication process is complete. This must be the full URL that a
-     * user would enter into their browser to access Guacamole.
-     */
-    private static final URIGuacamoleProperty OPENID_REDIRECT_URI =
-            new URIGuacamoleProperty() {
-
-        @Override
-        public String getName() { return "openid-redirect-uri"; }
-
-    };
-
-    /**
-     * The logout endpoint (URI) of the OpenID service. If specified, users
-     * will be redirected to this endpoint when they log out, allowing them
-     * to log out from the OpenID provider as well.
-     */
-    private static final URIGuacamoleProperty OPENID_LOGOUT_ENDPOINT =
-            new URIGuacamoleProperty() {
-
-        @Override
-        public String getName() { return "openid-logout-endpoint"; }
-
-    };
-
-    /**
-     * The URI that the OpenID service should redirect to after logout is
-     * complete. If not specified, the main redirect URI will be used.
-     */
-    private static final URIGuacamoleProperty OPENID_POST_LOGOUT_REDIRECT_URI =
-            new URIGuacamoleProperty() {
-
-        @Override
-        public String getName() { return "openid-post-logout-redirect-uri"; }
-
-    };
-
-    /**
-     * The Guacamole server environment.
-     */
-    @Inject
-    private Environment environment;
-
-    /**
-     * Returns the authorization endpoint (URI) of the OpenID service as
-     * configured with guacamole.properties.
-     *
-     * @return
-     *     The authorization endpoint of the OpenID service, as configured with
-     *     guacamole.properties.
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties cannot be parsed, or if the authorization
-     *     endpoint property is missing.
-     */
-    public URI getAuthorizationEndpoint() throws GuacamoleException {
-        return environment.getRequiredProperty(OPENID_AUTHORIZATION_ENDPOINT);
-    }
-
-    /**
-     * Returns the OpenID client ID which should be submitted to the OpenID
-     * service when necessary, as configured with guacamole.properties. This
-     * value is typically provided by the OpenID service when OpenID credentials
-     * are generated for your application.
-     *
-     * @return
-     *     The client ID to use when communicating with the OpenID service,
-     *     as configured with guacamole.properties.
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties cannot be parsed, or if the client ID
-     *     property is missing.
-     */
-    public String getClientID() throws GuacamoleException {
-        return environment.getRequiredProperty(OPENID_CLIENT_ID);
-    }
-
-    /**
-     * Returns the URI that the OpenID service should redirect to after
-     * the authentication process is complete, as configured with
-     * guacamole.properties. This must be the full URL that a user would enter
-     * into their browser to access Guacamole.
-     *
-     * @return
-     *     The client secret to use when communicating with the OpenID service,
-     *     as configured with guacamole.properties.
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties cannot be parsed, or if the redirect URI
-     *     property is missing.
-     */
-    public URI getRedirectURI() throws GuacamoleException {
-        return environment.getRequiredProperty(OPENID_REDIRECT_URI);
-    }
-
-    /**
-     * Returns the issuer to expect for all received ID tokens, as configured
-     * with guacamole.properties.
-     *
-     * @return
-     *     The issuer to expect for all received ID tokens, as configured with
-     *     guacamole.properties.
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties cannot be parsed, or if the issuer property
-     *     is missing.
-     */
-    public String getIssuer() throws GuacamoleException {
-        return environment.getRequiredProperty(OPENID_ISSUER);
-    }
-
-    /**
-     * Returns the endpoint (URI) of the JWKS service which defines how
-     * received ID tokens (JWTs) shall be validated, as configured with
-     * guacamole.properties.
-     *
-     * @return
-     *     The endpoint (URI) of the JWKS service which defines how received ID
-     *     tokens (JWTs) shall be validated, as configured with
-     *     guacamole.properties.
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties cannot be parsed, or if the JWKS endpoint
-     *     property is missing.
-     */
-    public URI getJWKSEndpoint() throws GuacamoleException {
-        return environment.getRequiredProperty(OPENID_JWKS_ENDPOINT);
-    }
-
-    /**
-     * Returns the token endpoint (URI) of the OIDC service as
-     * configured with guacamole.properties.
-     *
-     * @return
-     *     The token endpoint of the OIDC service, as configured with
-     *     guacamole.properties.
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties cannot be parsed, or if the authorization
-     *     endpoint property is missing.
-     */
-    public URI getTokenEndpoint() throws GuacamoleException {
-        return environment.getRequiredProperty(OPENID_TOKEN_ENDPOINT);
-    }
-
-    /**
-     * Returns the flow type of the OpenID service as configured with guacamole.properties.
-     *
-     * @return
-     *     The flow type of the OpenID service, as configured with guacamole.properties. Can
-     *     be either 'implicit' or 'code'.
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties cannot be parsed.
-     */
-    public String getFlowType() throws GuacamoleException {
-        return environment.getProperty(OPENID_FLOW_TYPE, DEFAULT_FLOW_TYPE);
-    }
-
-    /**
-     * Returns the OIDC client secret used for toen validation, as configured
-     * with guacamole.properties. This value is typically provided by the OIDC
-     * service when OIDC credentials are generated for your application, and
-     * may be null.
-     *
-     * @return
-     *     The client secret to use when communicating with the OIDC service,
-     *     as configured with guacamole.properties.
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties cannot be parsed, or if the client ID
-     *     property is missing.
-     */
-    public String getClientSecret() throws GuacamoleException {
-       return environment.getProperty(OPENID_CLIENT_SECRET);
-    }
-
-    /**
-     * Returns  a boolean value of whether "Proof Key for Code Exchange (PKCE)"
-     * will be used, as configured with guacamole.properties. The choice of
-     * whether to use PKCE is up to you, but the OIDC service must support
-     * it. By default will be false.
-     *
-     * @return
-     *     The whether to use PKCE or not, as configured with guacamole.properties.
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties cannot be parsed.
-     */
-    public boolean isPKCERequired() throws GuacamoleException {
-        Boolean enabled = environment.getProperty(OPENID_PKCE_REQUIRED);
-        return enabled != null && enabled;
-    }
-
-    /**
-     * Returns the maximum amount of time to allow for an in-progress OpenID
-     * authentication attempt to be completed, in minutes. A user that takes
-     * longer than this amount of time to complete authentication with their
-     * identity provider will be redirected back to the identity provider to
-     * try again.
-     *
-     * @return
-     *     The maximum amount of time to allow for an in-progress SAML
-     *     authentication attempt to be completed, in minutes.
-     *
-     * @throws GuacamoleException
-     *     If the authentication timeout cannot be parsed.
-     */
-    public int getAuthenticationTimeout() throws GuacamoleException {
-        return environment.getProperty(OPENID_AUTH_TIMEOUT, 5);
-    }
-
-
-    /**
-     * Returns the claim type which contains the authenticated user's username
-     * within any valid JWT, as configured with guacamole.properties. By
-     * default, this will be "email".
-     *
-     * @return
-     *     The claim type which contains the authenticated user's username
-     *     within any valid JWT, as configured with guacamole.properties.
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties cannot be parsed.
-     */
-    public String getUsernameClaimType() throws GuacamoleException {
-        return environment.getProperty(OPENID_USERNAME_CLAIM_TYPE, DEFAULT_USERNAME_CLAIM_TYPE);
-    }
-
-    /**
-     * Returns the claim type which contains the authenticated user's groups
-     * within any valid JWT, as configured with guacamole.properties. By
-     * default, this will be "groups".
-     *
-     * @return
-     *     The claim type which contains the authenticated user's groups
-     *     within any valid JWT, as configured with guacamole.properties.
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties cannot be parsed.
-     */
-    public String getGroupsClaimType() throws GuacamoleException {
-        return environment.getProperty(OPENID_GROUPS_CLAIM_TYPE, DEFAULT_GROUPS_CLAIM_TYPE);
-    }
-
-    /**
-     * Returns the claims list within any valid JWT that should be mapped to
-     * the authenticated user's tokens, as configured with guacamole.properties.
-     * Empty by default.
-     *
-     * @return
-     *     The claims list within any valid JWT that should be mapped to
-     *     the authenticated user's tokens, as configured with guacamole.properties.
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties cannot be parsed.
-     */
-    public Collection<String> getAttributesClaimType() throws GuacamoleException {
-        return environment.getPropertyCollection(OPENID_ATTRIBUTES_CLAIM_TYPE, DEFAULT_ATTRIBUTES_CLAIM_TYPE);
-    }
-
-    /**
-     * Returns the space-separated list of OpenID scopes to request. By default,
-     * this will be "openid email profile". The OpenID scopes determine the
-     * information returned within the OpenID token, and thus affect what
-     * values can be used as an authenticated user's username.
-     *
-     * @return
-     *     The space-separated list of OpenID scopes to request when identifying
-     *     a user.
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties cannot be parsed.
-     */
-    public String getScope() throws GuacamoleException {
-        return environment.getProperty(OPENID_SCOPE, DEFAULT_SCOPE);
-    }
-
-    /**
-     * Returns the amount of clock skew tolerated for timestamp comparisons
-     * between the Guacamole server and OpenID service clocks, in seconds. Too
-     * much clock skew will affect token expiration calculations, possibly
-     * allowing old tokens to be used. By default, this will be 30.
-     *
-     * @return
-     *     The amount of clock skew tolerated for timestamp comparisons, in
-     *     seconds.
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties cannot be parsed.
-     */
-    public int getAllowedClockSkew() throws GuacamoleException {
-        return environment.getProperty(OPENID_ALLOWED_CLOCK_SKEW, DEFAULT_ALLOWED_CLOCK_SKEW);
-    }
-
-    /**
-     * Returns the maximum amount of time that an OpenID token should remain
-     * valid, in minutes. A token received from an OpenID service which is
-     * older than this amount of time will be rejected, even if it is otherwise
-     * valid. By default, this will be 300 (5 hours).
-     *
-     * @return
-     *     The maximum amount of time that an OpenID token should remain valid,
-     *     in minutes.
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties cannot be parsed.
-     */
-    public int getMaxTokenValidity() throws GuacamoleException {
-        return environment.getProperty(OPENID_MAX_TOKEN_VALIDITY, DEFAULT_MAX_TOKEN_VALIDITY);
-    }
-
-    /**
-     * Returns the maximum amount of time that a nonce generated by the
-     * Guacamole server should remain valid, in minutes. As each OpenID request
-     * has a unique nonce value, this imposes an upper limit on the amount of
-     * time any particular OpenID request can result in successful
-     * authentication within Guacamole. By default, this will be 10.
-     *
-     * @return
-     *     The maximum amount of time that a nonce generated by the Guacamole
-     *     server should remain valid, in minutes.
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties cannot be parsed.
-     */
-    public int getMaxNonceValidity() throws GuacamoleException {
-        return environment.getProperty(OPENID_MAX_NONCE_VALIDITY, DEFAULT_MAX_NONCE_VALIDITY);
-    }
-
-    /**
-     * Returns the logout endpoint (URI) of the OpenID service, as configured
-     * with guacamole.properties. If configured, users will be redirected to
-     * this endpoint when they log out from Guacamole.
-     *
-     * @return
-     *     The logout endpoint of the OpenID service, as configured with
-     *     guacamole.properties, or null if not configured.
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties cannot be parsed.
-     */
-    public URI getLogoutEndpoint() throws GuacamoleException {
-        return environment.getProperty(OPENID_LOGOUT_ENDPOINT);
-    }
-
-    /**
-     * Returns the URI that the OpenID service should redirect to after logout
-     * is complete, as configured with guacamole.properties. If not configured,
-     * the main redirect URI will be used.
-     *
-     * @return
-     *     The post-logout redirect URI, as configured with
-     *     guacamole.properties, or the main redirect URI if not specified.
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties cannot be parsed.
-     */
-    public URI getPostLogoutRedirectURI() throws GuacamoleException {
-        return environment.getProperty(OPENID_POST_LOGOUT_REDIRECT_URI, getRedirectURI());
-    }
-
-}

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/conf/OpenIDResponseType.java

@@ -0,0 +1,67 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.openid.conf;
+
+import org.apache.guacamole.properties.EnumGuacamoleProperty.PropertyValue;
+
+/**
+ * This enum represents the valid OIDC reponse types that can be used
+ */
+ public enum OpenIDResponseType {
+     /*
+      * Response type "id_token" used for implciit flow as specified in the OpenID standard
+      */
+     @PropertyValue("id_token")
+     ID_TOKEN("id_token"),
+     
+     /* Response type "token" used for implicit flow by certain Identity Providers, notably
+      * AWS Cognito. This corresponds to the official OIDC response_type "id_token token" 
+      * that returns both the "id_token" and "access_token" parameters
+      */
+     @PropertyValue("token")
+     TOKEN("token"),
+     
+     /**
+      * Response type "code" used for code flow authentication
+      */
+     @PropertyValue("code")
+     CODE("code");
+     
+     /*
+      * The string value of the response type used
+      */
+     public final String STRING_VALUE;
+     
+    /**
+     * Initializes the response type such that it is associated with the
+     * given string value.
+     *
+     * @param value
+     *     The string value that will be associated with the enum value.
+     */
+    private OpenIDResponseType(String value) {
+        this.STRING_VALUE = value;
+    }
+    
+    @Override
+    public String toString() {
+        return STRING_VALUE;
+    }
+}

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/conf/OpenIDWellKnown.java

@@ -0,0 +1,227 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.openid.conf;
+
+import com.google.inject.Inject;
+import com.google.inject.Singleton;
+import java.io.IOException;
+import java.net.URI;
+import java.net.URL;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.TimeUnit;
+import java.util.Map;
+import javax.ws.rs.core.UriBuilder;
+import org.apache.guacamole.auth.openid.util.JsonUrlReader;
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.environment.Environment;
+import org.apache.guacamole.properties.URIGuacamoleProperty;
+import org.jose4j.json.JsonUtil;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Class for retrieving well-known endpoint data.
+ */
+@Singleton
+public class OpenIDWellKnown {
+
+    /**
+     * Logger for this class.
+     */
+    private static final Logger logger = LoggerFactory.getLogger(OpenIDWellKnown.class);
+
+
+    /**
+     * The number of attempts to the well-known endpoint to get the values before giving up
+     */
+    private static final int MAX_ATTEMPTS = 24;
+
+    /**
+     * The delay between each attempt to well-known endpoint in seconds
+     */
+    private static final long DELAY_SECONDS = 5;
+
+    /**
+     * The detected issuer
+     */
+    private static String issuer = null;
+
+    /**
+     * The detected authorization endpoint
+     */
+    private static URI authorization_endpoint = null;
+
+    /**
+     * The detected token endpoint
+     */
+    private static URI token_endpoint = null;
+
+    /**
+     * The detected jwks_uri
+     */
+    private static URI jwks_uri = null;
+    
+    /**
+     * Empty constructor of the class to populate data recovered from a OIDC
+     * well-known URL. The class will be populated on injection by Guice
+     */
+    public OpenIDWellKnown() { }
+
+    /**
+     * The well-known endpoint (URI) of the OIDC service.
+     */
+    private static final URIGuacamoleProperty OPENID_WELL_KNOWN_ENDPOINT =
+            new URIGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "openid-well-known-endpoint"; }
+    };
+
+    /**
+     * Returns the well-known endpoint (URI) of the OIDC service as
+     * configured with guacamole.properties.
+     *
+     * @return
+     *     The well-known endpoint of the OIDC service, as configured with
+     *     guacamole.properties.
+     *
+     * @throws GuacamoleException
+     *     If guacamole.properties cannot be parsed, or if the well-known
+     *     endpoint property is missing.
+     */
+    private URI getWellKnownEndpoint() throws GuacamoleException {
+        return environment.getProperty(OPENID_WELL_KNOWN_ENDPOINT);
+    }
+
+    /**
+     * Returns the issuer to expect for all received ID tokens, as configured
+     * from the well_known endpoint.
+     *
+     * @return
+     *     The issuer to expect for all received ID tokens, as returned by the
+     *     well-known endpoint.
+     */
+    public String getIssuer() {
+        return issuer;
+    }
+
+    /**
+     * Returns the authorization endpoint (URI) of the OpenID service as
+     * configured from the well_known endpoint.
+     *
+     * @return
+     *     The authorization endpoint of the OpenID service, as returned by the
+     *     well-known endpoint.
+     */
+    public URI getAuthorizationEndpoint() {
+        return authorization_endpoint;
+    }
+
+    /**
+     * Returns the token endpoint (URI) of the OpenID service as
+     * configured from the well_known endpoint.
+     *
+     * @return
+     *     The token endpoint of the OpenID service, as returned by the
+     *     well-known endpoint.
+     */
+    public URI getTokenEndpoint() {
+        return token_endpoint;
+    }
+
+    /**
+     * Returns the endpoint (URI) of the JWKS service which defines how
+     * received ID tokens (JWTs) shall be validated, as configured from
+     * the well-known endpoint.
+     *
+     * @return
+     *     The endpoint (URI) of the JWKS service which defines how received ID
+     *     tokens (JWTs) shall be validated, as configured from the
+     *     well-known endpoint.
+     */
+    public URI getJWKSEndpoint() {
+        return jwks_uri;
+    }
+
+    /**
+     * The Guacamole server environment.
+     */
+    @Inject
+    private Environment environment;
+
+    /*
+     * On injection, when the environment is non null, populates the OpenIDWellKnown 
+     * class by reading the json from an OIDC well-known endpoint and saves these values
+     * for later use. Use Guice to ensure environment exists before initializing.
+     */
+    @Inject
+    public void init() {
+        // Fast return if there is no well-known endpoint or its unreadable
+        try {
+            if (getWellKnownEndpoint() == null) {
+                return;
+            }
+        }
+        catch (Exception e) {
+            return;
+        }
+    
+        // Call to well-known endpoint might fail, so allow several tries before giving up
+        ScheduledExecutorService scheduler = Executors.newSingleThreadScheduledExecutor();
+        
+        Runnable task = new Runnable() {
+            int attempts = 0;
+
+            @Override
+            public void run() {
+                attempts++;
+
+                try {
+                    Map<String,Object> json = JsonUrlReader.fetch("GET", getWellKnownEndpoint(), "");
+                    issuer = (String) json.get("issuer");
+                    authorization_endpoint = UriBuilder.fromUri((String) json.get("authorization_endpoint")).build();
+                    token_endpoint = UriBuilder.fromUri((String) json.get("token_endpoint")).build();
+                    jwks_uri = UriBuilder.fromUri((String) json.get("jwks_uri")).build();
+
+                    logger.info("OIDC well-known\n" +
+                                "  issuer                 : {}\n" +
+                                "  authorization_endpoint : {}\n" +
+                                "  token_endpoint         : {}\n" +
+                                "  jwks_uri               : {}\n",
+                                issuer, authorization_endpoint, token_endpoint, jwks_uri);
+
+                    scheduler.shutdown();
+                    return;
+                }
+                catch (Exception e) {
+                    logger.debug("Rejecting well-known endpoint : {}", e.getMessage());
+                }
+
+                if (attempts >= MAX_ATTEMPTS) {
+                    logger.info("Timeout on well-known on endpoint");
+                    scheduler.shutdown();
+                }
+            }
+        };
+
+        scheduler.scheduleAtFixedRate(task, 0, DELAY_SECONDS, TimeUnit.SECONDS);
+    }
+}

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java

@@ -20,13 +20,7 @@
 package org.apache.guacamole.auth.openid.token;
 
 import com.google.inject.Inject;
-import java.io.BufferedReader;
-import java.io.OutputStream;
-import java.io.InputStreamReader;
-import java.net.HttpURLConnection;
-import java.net.URL;
 import java.net.URLEncoder;
-import java.net.URI;
 import java.nio.charset.StandardCharsets;
 import java.util.Collection;
 import java.util.Collections;
@@ -35,13 +29,11 @@ import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
-
-import javax.ws.rs.core.UriBuilder;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.auth.openid.conf.ConfigurationService;
+import org.apache.guacamole.auth.openid.util.JsonUrlReader;
 import org.apache.guacamole.auth.sso.NonceService;
 import org.apache.guacamole.token.TokenName;
-import org.jose4j.json.JsonUtil;
 import org.jose4j.jwk.HttpsJwks;
 import org.jose4j.jwt.JwtClaims;
 import org.jose4j.jwt.MalformedClaimException;
@@ -81,20 +73,26 @@ public class TokenValidationService {
     private NonceService nonceService;
 
     /**
-     * Validates the given ID token, using implicit flow, returning the JwtClaims
+     * Validates the given ID token, using implicit flow. Also validates codes,
-     * contained therein. If the ID token is invalid, null is returned.
+     * exchanging them for id_tokens before validation. If the id_token or
+     * code is invalid, null is returned, otherwise the JwtClaims in the
+     * id_token are returned.
      *
      * @param token
-     *     The ID token to validate.
+     *     The ID token to validate if implicit flow or the code to exchange for
+     *     an id_token and then validate.
+     *
+     * @param verifier
+     *     A PKCE verifier or null if not used. Only used with code flow
      *
      * @return
-     *     The JWT claims contained within the given ID token if it passes tests,
+     *     The JWT claims contained within the id_token if it passes tests,
-     *     or null if the token is not valid.
+     *     or null if the id_token is not valid.
      *
      * @throws GuacamoleException
      *     If guacamole.properties could not be parsed.
      */
-    public JwtClaims validateToken(String token) throws GuacamoleException {
+    public JwtClaims validateTokenOrCode(String token, String verifier) throws GuacamoleException {
         // Validating the token requires a JWKS key resolver
         HttpsJwks jwks = new HttpsJwks(confService.getJWKSEndpoint().toString());
         HttpsJwksVerificationKeyResolver resolver = new HttpsJwksVerificationKeyResolver(jwks);
@@ -110,25 +108,35 @@ public class TokenValidationService {
                 .setVerificationKeyResolver(resolver)
                 .build();
                 
+        /* Exchange code → token */
+        if (! confService.isImplicitFlow()) {
+            token = exchangeCode(token, verifier);                
+        }
+        
         try {
             // Validate JWT
             JwtClaims claims = jwtConsumer.processToClaims(token);
 
-            // Verify a nonce is present
+            if (confService.isImplicitFlow()) {
-            String nonce = claims.getStringClaimValue("nonce");
+                // Verify a nonce is present
-            if (nonce != null) {
+                String nonce = claims.getStringClaimValue("nonce");
-                // Verify that we actually generated the nonce, and that it has not
+                if (nonce != null) {
-                // already been used
+                    // Verify that we actually generated the nonce, and that it has not
-                if (nonceService.isValid(nonce)) {
+                    // already been used
-                    // nonce is valid, consider claims valid
+                    if (nonceService.isValid(nonce)) {
-                    return claims;
+                        // nonce is valid, consider claims valid
+                        return claims;
+                    }
+                    else {
+                        logger.info("Rejected OpenID token with invalid/old nonce.");
+                    }
                 }
                 else {
-                    logger.info("Rejected OpenID token with invalid/old nonce.");
+                    logger.info("Rejected OpenID token without nonce.");
                 }
             }
             else {
-                logger.info("Rejected OpenID token without nonce.");
+                return claims;
             }
         }
         // Log any failures to validate/parse the JWT
@@ -142,54 +150,6 @@ public class TokenValidationService {
         return null;
     }
 
-    /**
-     * Validates the given ID token, using code flow, returning the JwtClaims
-     * contained therein. If the ID token is invalid, null is returned.
-     *
-     * @param code
-     *     The code to validate and receive the id_token.
-     *
-     * @param verifier
-     *     A PKCE verifier or null if not used.
-     *
-     * @return
-     *     The JWT claims contained within the given ID token if it passes tests,
-     *     or null if the token is not valid.
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties could not be parsed.
-     */
-    public JwtClaims validateCode(String code, String verifier) throws GuacamoleException {
-        // Validating the token requires a JWKS key resolver
-        HttpsJwks jwks = new HttpsJwks(confService.getJWKSEndpoint().toString());
-        HttpsJwksVerificationKeyResolver resolver = new HttpsJwksVerificationKeyResolver(jwks);
-
-        /* Exchange code → token */
-        String token = exchangeCode(code, verifier);
-
-        // Create JWT consumer for validating received token
-        JwtConsumer jwtConsumer = new JwtConsumerBuilder()
-                .setRequireExpirationTime()
-                .setMaxFutureValidityInMinutes(confService.getMaxTokenValidity())
-                .setAllowedClockSkewInSeconds(confService.getAllowedClockSkew())
-                .setRequireSubject()
-                .setExpectedIssuer(confService.getIssuer())
-                .setExpectedAudience(confService.getClientID())
-                .setVerificationKeyResolver(resolver)
-                .build();
-
-        try {
-            // Validate JWT
-            return jwtConsumer.processToClaims(token);
-        }
-        // Log any failures to validate/parse the JWT
-        catch (InvalidJwtException e) {
-            logger.info("Rejected invalid OpenID token: {}", e.getMessage(), e);
-        }
-
-        return null;
-    }
-    
     /**
      * URLEncodes a key/value pair
      *
@@ -215,6 +175,7 @@ public class TokenValidationService {
      *
      * @param code
      *     The authorization code received from the IdP.
+     *
      * @param codeVerifier
      *     The PKCE verifier (or null if PKCE is disabled).
      *
@@ -243,50 +204,14 @@ public class TokenValidationService {
                 bodyBuilder.append("&").append(urlencode("code_verifier", verifier));
             }
 
-            // Build the final URI and convert to a URL
+            Map<String,Object> json = 
-            URL url = confService.getTokenEndpoint().toURL();
+                    JsonUrlReader.fetch("POST", confService.getTokenEndpoint(),
-
+                                        bodyBuilder.toString());
-            // Open connection, using HttpURLConnection
-            HttpURLConnection conn = (HttpURLConnection) url.openConnection();
-
-            conn.setRequestMethod("POST");
-            conn.setDoOutput(true);
-            conn.setRequestProperty("Content-Type", "application/x-www-form-urlencoded; charset=UTF-8"
-            );
-
-            try (OutputStream out = conn.getOutputStream()) {
-                byte [] body = bodyBuilder.toString().getBytes(StandardCharsets.UTF_8);
-                out.write(body, 0, body.length);
-            }
-
-            // Read response
-            int status = conn.getResponseCode();
-
-            BufferedReader reader = new BufferedReader(
-                    new InputStreamReader(
-                            status >= 200 && status < 300
-                                    ? conn.getInputStream()
-                                    : conn.getErrorStream(),
-                            StandardCharsets.UTF_8
-                    )
-            );
-
-            StringBuilder responseBody = new StringBuilder();
-            String line;
-            while ((line = reader.readLine()) != null) {
-                responseBody.append(line);
-            }
-            reader.close();
-
-            Map<String,Object> json = JsonUtil.parseJson(responseBody.toString());
-
-            if (status < 200 || status >= 300) {
-                throw new GuacamoleException("Token endpoint error (" + status + "): " + json.toString());
-            }
 
             return (String) json.get("id_token");
 
-        } catch (Exception e) {
+        }
+        catch (Exception e) {
             logger.info("Rejected invalid OpenID code exchange: {}", e.getMessage(), e);
         }
         return null;

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java.orig

@@ -1,430 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.guacamole.auth.openid.token;
-
-import com.google.inject.Inject;
-import java.io.BufferedReader;
-import java.io.OutputStream;
-import java.io.InputStreamReader;
-import java.net.HttpURLConnection;
-import java.net.URL;
-import java.net.URLEncoder;
-import java.net.URI;
-import java.nio.charset.StandardCharsets;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.core.UriBuilder;
-import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.auth.openid.conf.ConfigurationService;
-import org.apache.guacamole.auth.sso.NonceService;
-import org.apache.guacamole.token.TokenName;
-import org.jose4j.json.JsonUtil;
-import org.jose4j.jwk.HttpsJwks;
-import org.jose4j.jwt.JwtClaims;
-import org.jose4j.jwt.MalformedClaimException;
-import org.jose4j.jwt.consumer.InvalidJwtException;
-import org.jose4j.jwt.consumer.JwtConsumer;
-import org.jose4j.jwt.consumer.JwtConsumerBuilder;
-import org.jose4j.keys.resolvers.HttpsJwksVerificationKeyResolver;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Service for validating ID tokens forwarded to us by the client, verifying
- * that they did indeed come from the OpenID service.
- */
-public class TokenValidationService {
-
-    /**
-     * Logger for this class.
-     */
-    private final Logger logger = LoggerFactory.getLogger(TokenValidationService.class);
-
-    /**
-     * The prefix to use when generating token names.
-     */
-    public static final String OIDC_ATTRIBUTE_TOKEN_PREFIX = "OIDC_";
-
-    /**
-     * Service for retrieving OpenID configuration information.
-     */
-    @Inject
-    private ConfigurationService confService;
-
-    /**
-     * Service for validating and generating unique nonce values.
-     */
-    @Inject
-    private NonceService nonceService;
-
-    /**
-     * Validates the given ID token, using implicit flow, returning the JwtClaims
-     * contained therein. If the ID token is invalid, null is returned.
-     *
-     * @param token
-     *     The ID token to validate.
-     *
-     * @return
-     *     The JWT claims contained within the given ID token if it passes tests,
-     *     or null if the token is not valid.
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties could not be parsed.
-     */
-    public JwtClaims validateToken(String token) throws GuacamoleException {
-        // Validating the token requires a JWKS key resolver
-        HttpsJwks jwks = new HttpsJwks(confService.getJWKSEndpoint().toString());
-        HttpsJwksVerificationKeyResolver resolver = new HttpsJwksVerificationKeyResolver(jwks);
-
-        // Create JWT consumer for validating received token
-        JwtConsumer jwtConsumer = new JwtConsumerBuilder()
-                .setRequireExpirationTime()
-                .setMaxFutureValidityInMinutes(confService.getMaxTokenValidity())
-                .setAllowedClockSkewInSeconds(confService.getAllowedClockSkew())
-                .setRequireSubject()
-                .setExpectedIssuer(confService.getIssuer())
-                .setExpectedAudience(confService.getClientID())
-                .setVerificationKeyResolver(resolver)
-                .build();
-
-        try {
-            // Validate JWT
-            JwtClaims claims = jwtConsumer.processToClaims(token);
-
-            // Verify a nonce is present
-            String nonce = claims.getStringClaimValue("nonce");
-            if (nonce != null) {
-                // Verify that we actually generated the nonce, and that it has not
-                // already been used
-                if (nonceService.isValid(nonce)) {
-                    // nonce is valid, consider claims valid
-                    return claims;
-                }
-                else {
-                    logger.info("Rejected OpenID token with invalid/old nonce.");
-                }
-            }
-            else {
-                logger.info("Rejected OpenID token without nonce.");
-            }
-        }
-        // Log any failures to validate/parse the JWT
-        catch (MalformedClaimException e) {
-            logger.info("Rejected OpenID token with malformed claim: {}", e.getMessage(), e);
-        }
-        catch (InvalidJwtException e) {
-            logger.info("Rejected invalid OpenID token: {}", e.getMessage(), e);
-        }
-
-        return null;
-    }
-
-    /**
-     * Validates the given ID token, using code flow, returning the JwtClaims
-     * contained therein. If the ID token is invalid, null is returned.
-     *
-     * @param code
-     *     The code to validate and receive the id_token.
-     *
-     * @param verifier
-     *     A PKCE verifier or null if not used.
-     *
-     * @return
-     *     The JWT claims contained within the given ID token if it passes tests,
-     *     or null if the token is not valid.
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties could not be parsed.
-     */
-    public JwtClaims validateCode(String code, String verifier) throws GuacamoleException {
-        // Validating the token requires a JWKS key resolver
-        HttpsJwks jwks = new HttpsJwks(confService.getJWKSEndpoint().toString());
-        HttpsJwksVerificationKeyResolver resolver = new HttpsJwksVerificationKeyResolver(jwks);
-
-        /* Exchange code → token */
-        String token = exchangeCode(code, verifier);
-
-        // Create JWT consumer for validating received token
-        JwtConsumer jwtConsumer = new JwtConsumerBuilder()
-                .setRequireExpirationTime()
-                .setMaxFutureValidityInMinutes(confService.getMaxTokenValidity())
-                .setAllowedClockSkewInSeconds(confService.getAllowedClockSkew())
-                .setRequireSubject()
-                .setExpectedIssuer(confService.getIssuer())
-                .setExpectedAudience(confService.getClientID())
-                .setVerificationKeyResolver(resolver)
-                .build();
-
-        try {
-            // Validate JWT
-            return jwtConsumer.processToClaims(token);
-        }
-        // Log any failures to validate/parse the JWT
-        catch (InvalidJwtException e) {
-            logger.info("Rejected invalid OpenID token: {}", e.getMessage(), e);
-        }
-
-        return null;
-    }
-
-    /**
-     * URLEncodes a key/value pair
-     *
-     * @param key
-     *     The key to encode
-     *
-     * @param value
-     *     The value to encode
-     *
-     * @return
-     *     The urlencoded kay/value pair
-     */
-     private String urlencode(String key, String value) {
-         StringBuilder builder = new StringBuilder();
-         return builder.append(URLEncoder.encode(key, StandardCharsets.UTF_8))
-                       .append("=")
-                       .append(URLEncoder.encode(value, StandardCharsets.UTF_8))
-                       .toString();
-     }
-
-    /**
-     * Exchanges the authorization code for tokens.
-     *
-     * @param code
-     *     The authorization code received from the IdP.
-     * @param codeVerifier
-     *     The PKCE verifier (or null if PKCE is disabled).
-     *
-     * @return
-     *     The token string returned.
-     *
-     * @throws GuacamoleException
-     *     If a valid token is not returned.
-     */
-    private String exchangeCode(String code, String verifier) throws GuacamoleException {
-
-        try {
-            StringBuilder bodyBuilder = new StringBuilder();
-            bodyBuilder.append(urlencode("grant_type", "authorization_code")).append("&");
-            bodyBuilder.append(urlencode("code", code)).append("&");
-            bodyBuilder.append(urlencode("redirect_uri", confService.getRedirectURI().toString())).append("&");
-            bodyBuilder.append(urlencode("scope", confService.getScope())).append("&");
-            bodyBuilder.append(urlencode("client_id", confService.getClientID()));
-
-            String clientSecret = confService.getClientSecret();
-            if (clientSecret != null && !clientSecret.trim().isEmpty()) {
-                bodyBuilder.append("&").append(urlencode("client_secret", clientSecret));
-            }
-
-            if (confService.isPKCERequired()) {
-                bodyBuilder.append("&").append(urlencode("code_verifier", verifier));
-            }
-
-            // Build the final URI and convert to a URL
-            URL url = confService.getTokenEndpoint().toURL();
-
-            // Open connection, using HttpURLConnection
-            HttpURLConnection conn = (HttpURLConnection) url.openConnection();
-
-            conn.setRequestMethod("POST");
-            conn.setDoOutput(true);
-            conn.setRequestProperty("Content-Type", "application/x-www-form-urlencoded; charset=UTF-8"
-            );
-
-            try (OutputStream out = conn.getOutputStream()) {
-                byte [] body = bodyBuilder.toString().getBytes(StandardCharsets.UTF_8);
-                out.write(body, 0, body.length);
-            }
-
-            // Read response
-            int status = conn.getResponseCode();
-
-            BufferedReader reader = new BufferedReader(
-                    new InputStreamReader(
-                            status >= 200 && status < 300
-                                    ? conn.getInputStream()
-                                    : conn.getErrorStream(),
-                            StandardCharsets.UTF_8
-                    )
-            );
-
-            StringBuilder responseBody = new StringBuilder();
-            String line;
-            while ((line = reader.readLine()) != null) {
-                responseBody.append(line);
-            }
-            reader.close();
-
-            Map<String,Object> json = JsonUtil.parseJson(responseBody.toString());
-
-            if (status < 200 || status >= 300) {
-                throw new GuacamoleException("Token endpoint error (" + status + "): " + json.toString());
-            }
-
-            return (String) json.get("id_token");
-
-        } catch (Exception e) {
-            logger.info("Rejected invalid OpenID code exchange: {}", e.getMessage(), e);
-        }
-        return null;
-    }
-
-    /**
-     * Parses the given JwtClaims, returning the username contained
-     * therein, as defined by the username claim type given in
-     * guacamole.properties. If the username claim type is missing or
-     * is invalid, null is returned.
-     *
-     * @param claims
-     *     A valid JwtClaims to extract the username from.
-     *
-     * @return
-     *     The username contained within the given JwtClaims, or null if the
-     *     claim is not valid or the username claim type is missing,
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties could not be parsed.
-     */
-    public String processUsername(JwtClaims claims) throws GuacamoleException {
-        String usernameClaim = confService.getUsernameClaimType();
-
-        if (claims != null) {
-            try {
-                // Pull username from claims
-                String username = claims.getStringClaimValue(usernameClaim);
-                if (username != null)
-                    return username;
-            }
-            catch (MalformedClaimException e) {
-                logger.info("Rejected OpenID token with malformed claim: {}", e.getMessage(), e);
-            }
-
-            // Warn if username was not present in token, as it likely means
-            // the system is not set up correctly
-            logger.warn("Username claim \"{}\" missing from token. Perhaps the "
-                    + "OpenID scope and/or username claim type are "
-                    + "misconfigured?", usernameClaim);
-        }
-
-        // Could not retrieve username from JWT
-        return null;
-    }
-
-    /**
-     * Parses the given JwtClaims, returning the groups contained
-     * therein, as defined by the groups claim type given in
-     * guacamole.properties. If the groups claim type is missing or
-     * is invalid, an empty set is returned.
-     *
-     * @param claims
-     *     A valid JwtClaims to extract groups from.
-     *
-     * @return
-     *     A Set of String representing the groups the user is member of
-     *     from the OpenID provider point of view, or an empty Set if
-     *     claim is not valid or the groups claim type is missing,
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties could not be parsed.
-     */
-    public Set<String> processGroups(JwtClaims claims) throws GuacamoleException {
-        String groupsClaim = confService.getGroupsClaimType();
-
-        if (claims != null) {
-            try {
-                // Pull groups from claims
-                List<String> oidcGroups = claims.getStringListClaimValue(groupsClaim);
-                if (oidcGroups != null && !oidcGroups.isEmpty())
-                    return Collections.unmodifiableSet(new HashSet<>(oidcGroups));
-            }
-            catch (MalformedClaimException e) {
-                logger.info("Rejected OpenID token with malformed claim: {}", e.getMessage(), e);
-            }
-        }
-
-        // Could not retrieve groups from JWT
-        return Collections.emptySet();
-    }
-
-    /**
-     * Parses the given JwtClaims, returning the attributes contained
-     * therein, as defined by the attributes claim type given in
-     * guacamole.properties. If the attributes claim type is missing or
-     * is invalid, an empty set is returned.
-     *
-     * @param claims
-     *     A valid JwtClaims to extract attributes from.
-     *
-     * @return
-     *     A Map of String,String representing the attributes and values
-     *     from the OpenID provider point of view, or an empty Map if
-     *     claim is not valid or the attributes claim type is missing.
-     *
-     * @throws GuacamoleException
-     *     If guacamole.properties could not be parsed.
-     */
-    public Map<String, String> processAttributes(JwtClaims claims) throws GuacamoleException {
-        Collection<String> attributesClaim = confService.getAttributesClaimType();
-
-        if (claims != null && !attributesClaim.isEmpty()) {
-            try {
-                logger.debug("Iterating over attributes claim list : {}", attributesClaim);
-
-                // We suppose all claims are resolved, so the hashmap is initialised to
-                // the size of the configuration list
-                Map<String, String> tokens = new HashMap<String, String>(attributesClaim.size());
-
-                // We iterate over the configured attributes
-                for (String key: attributesClaim) {
-                    // Retrieve the corresponding claim
-                    String oidcAttr = claims.getStringClaimValue(key);
-
-                    // We do have a matching claim and it is not empty
-                    if (oidcAttr != null && !oidcAttr.isEmpty()) {
-                        // append the prefixed claim value to the token map with its value
-                        String tokenName = TokenName.canonicalize(key, OIDC_ATTRIBUTE_TOKEN_PREFIX);
-                        tokens.put(tokenName, oidcAttr);
-                        logger.debug("Claim {} found and set to {}", key, tokenName);
-                    }
-                    else {
-                        // wanted attribute is not found in the claim
-                        logger.debug("Claim {} not found in JWT.", key);
-                    }
-                }
-
-                // We did process all the expected claims
-                return Collections.unmodifiableMap(tokens);
-            }
-            catch (MalformedClaimException e) {
-                logger.info("Rejected OpenID token with malformed claim: {}", e.getMessage(), e);
-            }
-        }
-
-        // Could not retrieve attributes from JWT
-        logger.debug("Attributes claim not defined. Returning empty map.");
-        return Collections.emptyMap();
-    }
-}

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/util/JsonUrlReader.java

@@ -0,0 +1,106 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.openid.util;
+
+import java.io.IOException;
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.nio.charset.StandardCharsets;
+import java.util.Map;
+import java.util.concurrent.CompletableFuture;
+import org.jose4j.json.JsonUtil;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+
+/*
+ * Utility class to open a http connection to a URL, send a body
+ * and receive a response in the form of a parsed JSON
+ */
+
+public final class JsonUrlReader {
+    /**
+     * Logger for this class.
+     */
+    private static final Logger logger = LoggerFactory.getLogger(JsonUrlReader.class);
+
+    /**
+     * Class to GET and POST to a URL and read the returned JSON. This class should
+     * not be instantiated.
+     */
+    private JsonUrlReader() {}
+
+    /**
+     * Method to POST or GET to a URL and recover the JSON in the form of a Map
+     *
+     * @param String method
+     *      The http method to use. Should be "GET", "POST" or "PATCH".
+     *
+     * @param URI uri
+     *      A URI value giving the address where to recover the JSON
+     *
+     * @param String body
+     *      A pre-encoded body string to be sent to the address if the method is
+     *      "POST" or "PATCH". Ignored if the method is "GET".
+     *
+     * @return
+     *      A Map<String,Object> containing the decoded json values.
+     */
+    public static Map<String, Object> fetch(String method, URI uri, String body) throws IOException {
+        if (uri == null || uri.toString().isEmpty()) {
+            throw new IOException("JsonUrlReader: Missing URL");
+        }
+
+        try {
+            HttpClient client = HttpClient.newHttpClient();
+            HttpRequest.Builder requestBuilder = HttpRequest.newBuilder().uri(uri);
+            if (method != "GET") {
+                // FIXME: If this function is ever used to post json bodies this header
+                // will need to be configurable
+                requestBuilder.header("Content-Type", "application/x-www-form-urlencoded; charset=UTF-8")
+                .method(method, HttpRequest.BodyPublishers.ofString(body == null ? "" : body,
+                                                                    StandardCharsets.UTF_8));
+            }
+            else {
+                requestBuilder.GET();
+            }
+
+            // Asynchronous, non-blocking send, so that tomcat servlets are not blocked by outbound connection
+            CompletableFuture<HttpResponse<String>> future = client.sendAsync(requestBuilder.build(),
+                    HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));
+
+            HttpResponse<String> response = future.join();
+            int status = response.statusCode();
+            logger.debug("Response body: {}", response.body());
+            Map<String, Object> json = JsonUtil.parseJson(response.body());
+
+            if (status < 200 || status >= 300) {
+                throw new IOException("(status: " + status + "): " + json.toString());
+            }
+
+            return json;
+        }
+        catch (Exception e) {
+            throw new IOException("JsonUrlReader error: " + e.getMessage());
+        }
+    }
+}

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/util/PKCEUtil.java

@@ -30,13 +30,21 @@ import java.security.SecureRandom;
  *   - code_challenge (S256)
  */
 public final class PKCEUtil {
-
+    /**
+     * Get the verifier data from a cryptographically secure random source
+     */
     private static final SecureRandom RANDOM = new SecureRandom();
 
+    /*
+     * Class to create PKCE challenges and verifiers. This class should not be instantiated
+     */
     private PKCEUtil() {}
 
     /**
      * Generates a high-entropy PKCE code_verifier.
+     *
+     * @return
+     *      A 256bit or 64 byte random Base64 URL encode string
      */
     public static String generateCodeVerifier() {
         byte[] bytes = new byte[64];
@@ -46,6 +54,13 @@ public final class PKCEUtil {
 
     /**
      * Computes the PKCE code_challenge = BASE64URL(SHA256(code_verifier)).
+     *
+     * @param String verifier
+     *      A string containing the S256 verifier calculated bu generateCodeVerifier
+     *
+     * @return
+     *      The generated S256 code challenge used for the PKCE request encoded 
+     *      in Base64 URL format.
      */
     public static String generateCodeChallenge(String verifier) throws Exception {
         MessageDigest sha = MessageDigest.getInstance("SHA-256");
@@ -55,6 +70,12 @@ public final class PKCEUtil {
 
     /**
      * Base64URL encoding without padding.
+     *
+     * @param bytes
+     *      The bytes to be Base64 URL encoded
+     *
+     * @return
+     *      The Base64 URL encoded string value corresponding to the bytes 
      */
     public static String base64Url(byte[] bytes) {
         return java.util.Base64.getUrlEncoder()