plugin/oauth2: cache OAuth2 tokens per authorization code

The CloudStack OAuth2 login flow exchanges the same one-time
authorization code twice: once in verifyOauthCodeAndGetUser to fetch
the user's email, and once in the subsequent oauthlogin call that
authenticates the user. Unconditionally exchanging the code broke the
login flow, as Google rejects the second exchange of a one-time code
with invalid_grant.

Cache the exchanged tokens keyed by the authorization code instead
(bounded size, short TTL): the second phase of a login reuses the
tokens obtained for its own code, while distinct logins never share
state, keeping the provider thread-safe. Failed exchanges are not
cached, so a failure cannot poison subsequent logins.

Tested on a 4.22.0.0 environment: concurrent Google logins succeed and
a failed login no longer breaks subsequent ones.

Author: rhenar0

plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/google/GoogleOAuth2Provider.java

@@ -17,6 +17,7 @@
 package org.apache.cloudstack.oauth2.google;
 
 import com.cloud.exception.CloudAuthenticationException;
+import com.cloud.utils.Pair;
 import com.cloud.utils.component.AdapterBase;
 import com.cloud.utils.exception.CloudRuntimeException;
 import com.google.api.client.googleapis.auth.oauth2.GoogleAuthorizationCodeFlow;
@@ -28,6 +29,9 @@
 import com.google.api.client.json.jackson2.JacksonFactory;
 import com.google.api.services.oauth2.Oauth2;
 import com.google.api.services.oauth2.model.Userinfo;
+import com.google.common.cache.Cache;
+import com.google.common.cache.CacheBuilder;
+import com.google.common.util.concurrent.UncheckedExecutionException;
 import org.apache.cloudstack.auth.UserOAuth2Authenticator;
 import org.apache.cloudstack.oauth2.dao.OauthProviderDao;
 import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
@@ -37,9 +41,19 @@
 import java.io.IOException;
 import java.util.Arrays;
 import java.util.List;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.TimeUnit;
 
 public class GoogleOAuth2Provider extends AdapterBase implements UserOAuth2Authenticator {
 
+    // The login flow exchanges the same one-time authorization code twice (once in
+    // verifyOauthCodeAndGetUser, once in the subsequent oauthlogin), so the tokens are
+    // cached per code; entries are short-lived as codes are only valid for a few minutes.
+    protected final Cache<String, Pair<String, String>> tokensByCode = CacheBuilder.newBuilder()
+            .maximumSize(1000)
+            .expireAfterWrite(10, TimeUnit.MINUTES)
+            .build();
+
     @Inject
     OauthProviderDao _oauthProviderDao;
 
@@ -92,16 +106,20 @@ public String verifyCodeAndFetchEmail(String secretCode) {
                 httpTransport, jsonFactory, clientSecrets, scopes)
                 .build();
 
-        GoogleTokenResponse tokenResponse = null;
+        Pair<String, String> tokens;
         try {
-            tokenResponse = flow.newTokenRequest(secretCode)
-                    .setRedirectUri(redirectURI)
-                    .execute();
-        } catch (IOException e) {
-            throw new CloudRuntimeException(String.format("Failed to exchange the OAuth2 authorization code for tokens: %s", e.getMessage()), e);
+            tokens = tokensByCode.get(secretCode, () -> {
+                GoogleTokenResponse tokenResponse = flow.newTokenRequest(secretCode)
+                        .setRedirectUri(redirectURI)
+                        .execute();
+                return new Pair<>(tokenResponse.getAccessToken(), tokenResponse.getRefreshToken());
+            });
+        } catch (ExecutionException | UncheckedExecutionException e) {
+            Throwable cause = e.getCause() != null ? e.getCause() : e;
+            throw new CloudRuntimeException(String.format("Failed to exchange the OAuth2 authorization code for tokens: %s", cause.getMessage()), cause);
         }
-        String accessToken = tokenResponse.getAccessToken();
-        String refreshToken = tokenResponse.getRefreshToken();
+        String accessToken = tokens.first();
+        String refreshToken = tokens.second();
 
         GoogleCredential credential = new GoogleCredential.Builder()
                 .setTransport(httpTransport)

plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/google/GoogleOAuth2ProviderTest.java

@@ -188,7 +188,7 @@ public void testVerifyUserEmail() throws IOException {
     }
 
     @Test
-    public void testVerifyCodeAndFetchEmailExchangesCodeOnEveryCall() throws IOException {
+    public void testVerifyCodeAndFetchEmailExchangesEachCodeIndependently() throws IOException {
         mockRegisteredProvider();
         GoogleAuthorizationCodeTokenRequest tokenRequest = mock(GoogleAuthorizationCodeTokenRequest.class);
         GoogleAuthorizationCodeFlow flow = mockTokenExchangeFlow(tokenRequest);
@@ -213,4 +213,30 @@ public void testVerifyCodeAndFetchEmailExchangesCodeOnEveryCall() throws IOExcep
             verify(tokenRequest, times(2)).execute();
         }
     }
+
+    @Test
+    public void testVerifyCodeAndFetchEmailReusesTokensForSameCode() throws IOException {
+        mockRegisteredProvider();
+        GoogleAuthorizationCodeTokenRequest tokenRequest = mock(GoogleAuthorizationCodeTokenRequest.class);
+        GoogleAuthorizationCodeFlow flow = mockTokenExchangeFlow(tokenRequest);
+        Oauth2 oauth2 = mock(Oauth2.class);
+        try (MockedConstruction<GoogleAuthorizationCodeFlow.Builder> ignoredFlow = Mockito.mockConstruction(GoogleAuthorizationCodeFlow.Builder.class,
+                (mock, context) -> when(mock.build()).thenReturn(flow));
+             MockedConstruction<Oauth2.Builder> ignored = Mockito.mockConstruction(Oauth2.Builder.class,
+                (mock, context) -> when(mock.build()).thenReturn(oauth2))) {
+            Userinfo userinfo = mock(Userinfo.class);
+            Oauth2.Userinfo userinfo1 = mock(Oauth2.Userinfo.class);
+            when(oauth2.userinfo()).thenReturn(userinfo1);
+            Oauth2.Userinfo.Get userinfoGet = mock(Oauth2.Userinfo.Get.class);
+            when(userinfo1.get()).thenReturn(userinfoGet);
+            when(userinfoGet.execute()).thenReturn(userinfo);
+            when(userinfo.getEmail()).thenReturn("email@example.com");
+
+            // the login flow uses the same one-time code twice: verifyOauthCodeAndGetUser then oauthlogin
+            assertEquals("email@example.com", _googleOAuth2Provider.verifyCodeAndFetchEmail("secretCode"));
+            assertTrue(_googleOAuth2Provider.verifyUser("email@example.com", "secretCode"));
+
+            verify(tokenRequest, times(1)).execute();
+        }
+    }
 }