Replace OpenID 2.0 with OAuth 2.0/OIDC login

.dockerignore

@@ -0,0 +1,5 @@
+.git
+docker/postgresql-data
+docker/postgresql-16-data
+docker/roller-data
+it-selenium

Dockerfile

@@ -23,17 +23,9 @@
 
 FROM maven:3-eclipse-temurin-17 AS builder
 
-COPY ./docker /project/docker
-
-# Build Apache Roller
-
-WORKDIR /tmp
-RUN apt-get update && apt-get install -y git
-RUN git clone https://github.com/apache/roller.git
-WORKDIR /tmp/roller
-# change to branch/tag you prefer
-RUN git checkout tags/roller-6.1.0; \
-mvn -Duser.home=/builder/home -DskipTests=true -B clean install
+COPY . /project
+WORKDIR /project
+RUN mvn -Duser.home=/builder/home -DskipTests=true -B clean install
 
 
 # STAGE 2 - PACKAGE ------------------------------------------------
@@ -51,7 +43,7 @@ ARG DATABASE_JDBC_DRIVERCLASS=org.postgresql.Driver
 ARG DATABASE_JDBC_CONNECTIONURL=jdbc:postgresql://postgresql/rollerdb
 ARG DATABASE_JDBC_USERNAME=scott
 ARG DATABASE_JDBC_PASSWORD=tiger
-ARG DATABASE_HOST=postgresql:5434
+ARG DATABASE_HOST=postgresql:5432
 
 ENV STORAGE_ROOT ${STORAGE_ROOT}
 ENV DATABASE_JDBC_DRIVERCLASS ${DATABASE_JDBC_DRIVERCLASS}
@@ -63,7 +55,7 @@ ENV DATABASE_HOST ${DATABASE_HOST}
 # install Roller WAR as ROOT.war, create data dirs
 
 WORKDIR /usr/local/roller
-COPY --from=builder /tmp/roller/app/target/roller.war /usr/local/tomcat/webapps/ROOT.war
+COPY --from=builder /project/app/target/roller.war /usr/local/tomcat/webapps/ROOT.war
 RUN mkdir -p data/mediafiles data/searchindex
 
 # download PostgreSQL and MySQL drivers plus Mail and Activation JARs
@@ -78,8 +70,8 @@ RUN wget https://repo1.maven.org/maven2/org/eclipse/angus/angus-activation/2.0.2
 
 # Add Roller entry-point and go!
 
-COPY --from=builder /project/docker/entry-point.sh /usr/local/tomcat/bin
-COPY --from=builder /project/docker/wait-for-it.sh /usr/local/tomcat/bin
+COPY docker/entry-point.sh /usr/local/tomcat/bin
+COPY docker/wait-for-it.sh /usr/local/tomcat/bin
 RUN chgrp -R 0 /usr/local/tomcat
 RUN chmod -R g+rw /usr/local/tomcat
 

app/pom.xml

@@ -485,6 +485,24 @@ limitations under the License.
             </exclusions>
         </dependency>
 
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-oauth2-client</artifactId>
+            <version>${spring.security.version}</version>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-oauth2-jose</artifactId>
+            <version>${spring.security.version}</version>
+        </dependency>
+
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-databind</artifactId>
+            <version>2.18.3</version>
+        </dependency>
+
         <!-- Other deps include Guice and ROME -->
 
         <dependency>

app/src/main/java/org/apache/roller/weblogger/config/AuthMethod.java

@@ -17,11 +17,14 @@
  */
 package org.apache.roller.weblogger.config;
 
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
 public enum AuthMethod {
     ROLLERDB("db"),
     LDAP("ldap"),
-    OPENID("openid"),
-    DB_OPENID("db-openid"),
+    OIDC("oidc"),
+    DB_OIDC("db-oidc"),
     CMA("cma");
 
     private final String propertyName;
@@ -34,7 +37,22 @@ public String getPropertyName() {
         return propertyName;
     }
 
+    private static final Log log = LogFactory.getLog(AuthMethod.class);
+    private static boolean warnedAboutOpenId;
+
     public static AuthMethod getAuthMethod(String propertyName) {
+        // OpenID 2.0 was replaced by OIDC; accept the old property values so
+        // an upgraded install boots instead of failing on every request
+        if ("openid".equals(propertyName) || "db-openid".equals(propertyName)) {
+            AuthMethod replacement = "openid".equals(propertyName) ? OIDC : DB_OIDC;
+            if (!warnedAboutOpenId) {
+                warnedAboutOpenId = true;
+                log.warn("authentication.method=" + propertyName + " is no longer supported and is "
+                        + "treated as " + replacement.getPropertyName() + "; update the property and "
+                        + "configure an oidc.{id}.* provider registration");
+            }
+            return replacement;
+        }
         for (AuthMethod test : AuthMethod.values()) {
             if (test.getPropertyName().equals(propertyName)) {
                 return test;

app/src/main/java/org/apache/roller/weblogger/ui/core/RollerContext.java

@@ -45,6 +45,7 @@
 import org.apache.roller.weblogger.ui.core.plugins.UIPluginManager;
 import org.apache.roller.weblogger.ui.core.plugins.UIPluginManagerImpl;
 import org.apache.roller.weblogger.ui.core.security.AutoProvision;
+import org.apache.roller.weblogger.ui.core.security.RollerClientRegistrationRepository;
 import org.apache.roller.weblogger.util.Reflection;
 import org.apache.roller.weblogger.util.cache.CacheManager;
 import org.apache.velocity.runtime.RuntimeSingleton;
@@ -309,7 +310,10 @@ private DelegatingPasswordEncoder createPasswordEncoder() {
 
         // supported encoders
         encoders.put("bcrypt", new BCryptPasswordEncoder());
-        encoders.put("pbkdf2", Pbkdf2PasswordEncoder.defaultsForSpringSecurity_v5_8());
+        // pbkdf2 stores only salt+hash, so its parameters must stay as they were
+        // when existing passwords were encoded or those passwords stop verifying.
+        // scrypt and argon2 encode their parameters, so they can take v5_8.
+        encoders.put("pbkdf2", Pbkdf2PasswordEncoder.defaultsForSpringSecurity_v5_5());
         // provided by bouncy castle dependency
         encoders.put("scrypt", SCryptPasswordEncoder.defaultsForSpringSecurity_v5_8());
         encoders.put("argon2", Argon2PasswordEncoder.defaultsForSpringSecurity_v5_8());
@@ -340,6 +344,21 @@ private DelegatingPasswordEncoder createPasswordEncoder() {
     }
 
 
+    /**
+     * The OIDC client registrations declared in security.xml, or null when
+     * OIDC is not configured.
+     */
+    public static RollerClientRegistrationRepository getClientRegistrationRepository() {
+        ApplicationContext ctx =
+                WebApplicationContextUtils.getRequiredWebApplicationContext(servletContext);
+        try {
+            return ctx.getBean("clientRegistrationRepository", RollerClientRegistrationRepository.class);
+        } catch (NoSuchBeanDefinitionException exc) {
+            log.debug("No clientRegistrationRepository bean in context", exc);
+            return null;
+        }
+    }
+
     /**
      * Flush user from any caches maintained by security system.
      */

app/src/main/java/org/apache/roller/weblogger/ui/core/RollerSession.java

@@ -34,6 +34,9 @@
 import org.apache.roller.weblogger.business.UserManager;
 import org.apache.roller.weblogger.pojos.User;
 import org.apache.roller.weblogger.ui.core.security.AutoProvision;
+import org.apache.roller.weblogger.ui.core.security.RollerOidcUserService;
+import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
+import org.springframework.security.oauth2.core.oidc.user.OidcUser;
 
 
 /**
@@ -90,6 +93,15 @@ public static RollerSession getRollerSession(HttpServletRequest request) {
                     UserManager umgr = WebloggerFactory.getWeblogger().getUserManager();
                     User user = umgr.getUserByUserName(principal.getName());
 
+                    // For OIDC-authenticated users, look up by OIDC subject
+                    if (user == null && principal instanceof OAuth2AuthenticationToken oauthToken) {
+                        Object oauthPrincipal = oauthToken.getPrincipal();
+                        if (oauthPrincipal instanceof OidcUser oidcUser) {
+                            String oidcSubject = RollerOidcUserService.toOidcSubject(oidcUser);
+                            user = umgr.getUserByOpenIdUrl(oidcSubject);
+                        }
+                    }
+
                     // try one time to auto-provision, only happens if user==null
                     // which means installation has LDAP enabled in security.xml
                     if (user == null && WebloggerConfig.getBooleanProperty("users.ldap.autoProvision.enabled")) {