GUACAMOLE-1289: Resolve relogin issue, remove spring dependency from Duo Auth, and update dependencies with vulnerabilities.

doc/licenses/okhttp-4.9.1/NOTICE → doc/licenses/okhttp-4.12.0/NOTICE

@@ -1,4 +1,4 @@
-Copyright 2021 Square, Inc.
+Copyright 2023 Square, Inc.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

doc/licenses/okhttp-4.9.1/README → doc/licenses/okhttp-4.12.0/README

@@ -1,7 +1,7 @@
 okhttp (https://square.github.io/okhttp/)
 ---------------------------------------------
 
-    Version: 4.9.1
+    Version: 4.12.0
     From: 'Square Inc'
     License(s):
         Apache 2.0

doc/licenses/okhttp-4.12.0/dep-coordinates.txt

@@ -0,0 +1,2 @@
+com.squareup.okhttp3:okhttp:jar:4.12.0
+com.squareup.okhttp3:logging-interceptor:jar:4.12.0

doc/licenses/okio-2.8.0/NOTICE → doc/licenses/okio-3.6.0/NOTICE

@@ -1,4 +1,4 @@
-Copyright 2020 Square, Inc.
+Copyright 2023 Square, Inc.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

doc/licenses/okio-2.8.0/README → doc/licenses/okio-3.6.0/README

@@ -1,7 +1,7 @@
 okio (https://square.github.io/okio/)
 ---------------------------------------------
 
-    Version: 2.8.0
+    Version: 3.6.0
     From: 'Square Inc'
     License(s):
         Apache 2.0 (bundled/retrofit-2.9.0/LICENSE.txt)

doc/licenses/okio-3.6.0/dep-coordinates.txt

@@ -0,0 +1,2 @@
+com.squareup.okio:okio:jar:3.6.0
+com.squareup.okio:okio-jvm:jar:3.6.0

extensions/guacamole-auth-duo/pom.xml

@@ -47,20 +47,32 @@
             <dependency>
                 <groupId>com.squareup.okhttp3</groupId>
                 <artifactId>okhttp</artifactId>
-                <version>4.9.1</version> <!-- Specify the desired version -->
+                <version>4.12.0</version> <!-- Specify the desired version -->
+            </dependency>
+
+            <dependency>
+                <groupId>com.squareup.okhttp3</groupId>
+                <artifactId>logging-interceptor</artifactId>
+                <version>4.12.0</version>
             </dependency>
 
             <!-- Force the use of a consistent version of Kotlin standard library common -->
             <dependency>
                 <groupId>org.jetbrains.kotlin</groupId>
                 <artifactId>kotlin-stdlib-common</artifactId>
-                <version>1.4.10</version>
+                <version>1.9.23</version>
             </dependency>
 
             <dependency>
                 <groupId>org.jetbrains.kotlin</groupId>
                 <artifactId>kotlin-stdlib</artifactId>
-                <version>1.4.10</version>
+                <version>1.9.23</version>
+            </dependency>
+
+            <dependency>
+                <groupId>org.jetbrains.kotlin</groupId>
+                <artifactId>kotlin-stdlib-jdk8</artifactId>
+                <version>1.9.23</version>
             </dependency>
 
         </dependencies>
@@ -95,20 +107,20 @@
             <version>2.5</version>
             <scope>provided</scope>
         </dependency>
+
+        <dependency>
+            <groupId>jakarta.ws.rs</groupId>
+            <artifactId>jakarta.ws.rs-api</artifactId>
+            <version>2.1.6</version>
+            <scope>provided</scope>
+        </dependency>
 
         <!-- Duo SDK -->
         <dependency>
             <groupId>com.duosecurity</groupId>
             <artifactId>duo-universal-sdk</artifactId>
             <version>1.1.3</version>
         </dependency>
-
-        <!-- spring-web -->
-        <dependency>
-            <groupId>org.springframework</groupId>
-            <artifactId>spring-web</artifactId>
-            <version>5.3.25</version>
-        </dependency>
 
     </dependencies>
 

extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java

@@ -27,6 +27,7 @@
 import java.net.URISyntaxException;
 import java.util.Collections;
 import javax.servlet.http.HttpServletRequest;
+import javax.ws.rs.core.UriBuilder;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.auth.duo.conf.ConfigurationService;
@@ -39,7 +40,6 @@
 import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
-import org.springframework.web.util.UriComponentsBuilder;
 
 /**
  * Service for verifying the identity of a user against Duo.
@@ -102,13 +102,9 @@ public void verifyAuthenticatedUser(AuthenticatedUser authenticatedUser)
 
         try {
 
-            String redirectUrl = confService.getRedirectUri().toString();
-
-            String builtUrl = UriComponentsBuilder
-                    .fromUriString(redirectUrl)
+            String builtUrl = UriBuilder.fromUri(confService.getRedirectUri().toString())
                     .queryParam(Credentials.RESUME_QUERY, DuoAuthenticationProvider.PROVIDER_IDENTIFER)
-                    .build()
-                    .toUriString();
+                    .build().toString();
 
             // Set up the Duo Client
             Client duoClient = new Client.Builder(
@@ -120,15 +116,10 @@ public void verifyAuthenticatedUser(AuthenticatedUser authenticatedUser)
 
             duoClient.healthCheck();
 
-            // Retrieve signed Duo Code and State from the request
-            String duoCode = request.getParameter(DUO_CODE_PARAMETER_NAME);
-            String duoState = request.getParameter(DUO_STATE_PARAMETER_NAME);
-
-            // If no code or state is received, assume Duo MFA redirect has not occured and do it
-            if (duoCode == null || duoState == null) {
+            if (!credentials.isAuthenticationResumed()) {
 
                 // Get a new session state from the Duo client
-                duoState = duoClient.generateState();
+                String duoState = duoClient.generateState();
                 long expirationTimestamp = System.currentTimeMillis() + (confService.getAuthTimeout() * 1000L);
 
                 // Request additional credentials
@@ -147,6 +138,9 @@ public void verifyAuthenticatedUser(AuthenticatedUser authenticatedUser)
                 );
 
             }
+
+            // Retrieve signed Duo Code and State from the request
+            String duoCode = request.getParameter(DUO_CODE_PARAMETER_NAME);
 
             // Get the token from the DuoClient using the code and username, and check status
             Token token = duoClient.exchangeAuthorizationCodeFor2FAResult(duoCode, username);