UserResource.java

/*******************************************************************************
 * Copyright 2015 Defense Health Agency (DHA)
 *
 * If your use of this software does not include any GPLv2 components:
 * 	Licensed under the Apache License, Version 2.0 (the "License");
 * 	you may not use this file except in compliance with the License.
 * 	You may obtain a copy of the License at
 *
 * 	  http://www.apache.org/licenses/LICENSE-2.0
 *
 * 	Unless required by applicable law or agreed to in writing, software
 * 	distributed under the License is distributed on an "AS IS" BASIS,
 * 	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * 	See the License for the specific language governing permissions and
 * 	limitations under the License.
 * ----------------------------------------------------------------------------
 * If your use of this software includes any GPLv2 components:
 * 	This program is free software; you can redistribute it and/or
 * 	modify it under the terms of the GNU General Public License
 * 	as published by the Free Software Foundation; either version 2
 * 	of the License, or (at your option) any later version.
 *
 * 	This program is distributed in the hope that it will be useful,
 * 	but WITHOUT ANY WARRANTY; without even the implied warranty of
 * 	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * 	GNU General Public License for more details.
 *******************************************************************************/
package prerna.semoss.web.services.local;

import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.net.URLDecoder;
import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
import java.security.Principal;
import java.security.SecureRandom;
import java.util.ArrayList;
import java.util.Base64;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Set;
import java.util.TreeMap;
import java.util.UUID;

import org.apache.http.client.ClientProtocolException;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.javatuples.Pair;
import org.json.JSONArray;
import org.owasp.encoder.Encode;

import com.google.gson.Gson;
import com.google.gson.reflect.TypeToken;

import jakarta.annotation.security.PermitAll;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import jakarta.servlet.http.HttpSession;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.POST;
import jakarta.ws.rs.Path;
import jakarta.ws.rs.PathParam;
import jakarta.ws.rs.Produces;
import jakarta.ws.rs.QueryParam;
import jakarta.ws.rs.core.Context;
import jakarta.ws.rs.core.MultivaluedMap;
import jakarta.ws.rs.core.NewCookie;
import jakarta.ws.rs.core.Response;
import prerna.auth.AccessToken;
import prerna.auth.AuthProvider;
import prerna.auth.SyncUserAssetsThread;
import prerna.auth.User;
import prerna.auth.external.ExternalAuthorizationHelper;
import prerna.auth.utils.AbstractSecurityUtils;
import prerna.auth.utils.SecurityAPIUserUtils;
import prerna.auth.utils.SecurityAdminUtils;
import prerna.auth.utils.SecurityExternalConnectorsUtils;
import prerna.auth.utils.SecurityNativeUserUtils;
import prerna.auth.utils.SecurityUpdateUtils;
import prerna.auth.utils.SecurityUserUtils;
import prerna.cluster.util.ClusterUtil;
import prerna.io.connector.IAccessTokenFiller;
import prerna.io.connector.jira.JiraTokenFiller;
import prerna.io.connector.salesforce.SalesforceTokenFiller;
import prerna.io.connector.servicenow.ServiceNowTokenFiller;
import prerna.security.HttpHelperUtility;
import prerna.security.PKCEUtil;
import prerna.usertracking.AuditErrorCode;
import prerna.usertracking.AuditEventType;
import prerna.usertracking.AuditTargetType;
import prerna.usertracking.UserAuditTrailUtils;
import prerna.usertracking.UserTrackingUtils;
import prerna.util.Constants;
import prerna.util.SocialPropertiesUtil;
import prerna.util.Utility;
import prerna.util.ldap.ILdapAuthenticator;
import prerna.util.ldap.LDAPPasswordChangeRequiredException;
import prerna.util.linotp.LinOTPResponse;
import prerna.util.linotp.LinOTPUtil;
import prerna.web.conf.DBLoader;
import prerna.web.conf.UserSessionLoader;
import prerna.web.services.util.WebUtility;
import waffle.servlet.WindowsPrincipal;

@Path("/auth")
@PermitAll
public class UserResource {

	private static final Logger classLogger = LogManager.getLogger(UserResource.class);

	private static final String CUSTOM_REDIRECT_SESSION_KEY = "custom_redirect";
	private static final String OAUTH_DISABLE_REDIRECT_SESSION_KEY = "oauth_disable_redirect";

	private static final SecureRandom NONCE_RANDOM = new SecureRandom();

	/**
	 * What a login started with {@code disableRedirect=true} ends on instead of a
	 * redirect: the window the sign in ran in closes itself. The FE that opened it
	 * also closes it once it sees the login, so the page works without its script.
	 */
	private static final String LOGIN_COMPLETE_PAGE = """
			<!DOCTYPE html>
			<html lang="en">
				<head>
					<meta charset="utf-8">
					<title>Signed in</title>
				</head>
				<body>
					<p>You are signed in. You can close this window.</p>
					<script nonce="%s">window.close();</script>
				</body>
			</html>
			""";

	private static SocialPropertiesUtil socialData = null;
	static {
		socialData = SocialPropertiesUtil.getInstance();
	}

	/**
	 * Session attribute holding the PKCE code verifier between authorize and
	 * callback.
	 */
	private static final String PKCE_VERIFIER_ATTR = "pkce_code_verifier";

	/**
	 * Returns the active login providers for the current session user.
	 *
	 * @param request inbound HTTP request
	 * @return provider-name map response
	 */
	@GET
	@Path("/logins")
	public Response getAllLogins(@Context HttpServletRequest request) {
		List<NewCookie> newCookies = new ArrayList<>();
		HttpSession session = request.getSession(false);
		User semossUser = null;
		if (session != null) {
			semossUser = (User) session.getAttribute(Constants.SESSION_USER);
		}

		if (semossUser == null) {
			// not authenticated
			// remove any cookies we shouldn't have
			WebUtility.expireSessionCookies(request, newCookies);

			if (session != null && (session.isNew() || request.isRequestedSessionIdValid())) {
				session.invalidate();
			}
		}

		Map<String, String> retMap = User.getLoginNames(semossUser);
		return WebUtility.getResponse(retMap, 200, newCookies.toArray(new NewCookie[] {}));
	}

	/**
	 * Logs a user out of one provider or all providers in the current session.
	 *
	 * @param provider        provider name or {@code ALL}
	 * @param disableRedirect when true, do not send a redirect response
	 * @param request         inbound HTTP request
	 * @param response        outbound HTTP response
	 * @return logout result payload
	 * @throws IOException when redirect writing fails
	 */
	@GET
	@Produces("application/json")
	@Path("/logout/{provider}")
	public Response logout(@PathParam("provider") String provider,
			@QueryParam("disableRedirect") boolean disableRedirect, @Context HttpServletRequest request,
			@Context HttpServletResponse response) throws IOException {
		boolean noUser = false;
		boolean removed = false;

		provider = WebUtility.inputSanitizer(provider);

		HttpSession session = request.getSession();
		User thisUser = (User) session.getAttribute(Constants.SESSION_USER);
		if (thisUser == null) {
			Map<String, Object> ret = new HashMap<>();
			ret.put("success", false);
			ret.put(Constants.ERROR_MESSAGE, "No user is currently logged in the session");
			return WebUtility.getResponse(ret, 400);
		}

		// log the user logout
		classLogger.info("User is logging out of provider {}", provider);
		provider = WebUtility.inputSanitizer(provider);
		if (provider.equalsIgnoreCase("ALL")) {
			removed = true;
			noUser = true;
		} else {
			AuthProvider token = AuthProvider.valueOf(provider.toUpperCase());
			String assetEngineId = null;

			// TODO: what does this part do?
			// TODO: feel like when logout need to adjust the asset id
			if (thisUser.getLogins().size() == 1) {
				thisUser.getAssetProjectId(token);
			}
			removed = thisUser.dropAccessToken(token);
			if (thisUser.getLogins().isEmpty()) {
				noUser = true;
			} else {
				request.getSession().setAttribute(Constants.SESSION_USER, thisUser);
				Thread.ofVirtual().start(new SyncUserAssetsThread(assetEngineId));
				// put the new map for the user space
				session.setAttribute(Constants.USER_ASSET_IDS, thisUser.getAssetEngineMap());
			}
		}

		List<NewCookie> nullCookies = null;
		if (noUser) {
			// when we call session.invalidate() the UserSessionLoader will properly log is
			// user logout or tomcat ending
			session.setAttribute(UserSessionLoader.IS_USER_LOGOUT, true);
			session.setAttribute(UserSessionLoader.USER_LOGOUT_IP_ADDR, WebUtility.getClientIp(request));
			classLogger.info("User has logged out from all providers in the session");
			// well, you have logged out and we always require a login
			// so i will redirect you by default unless you specifically say not to
			if (!disableRedirect) {
				response.setStatus(302);

				String customUrl = DBLoader.getCustomLogoutUrl();
				if (customUrl != null && !customUrl.isEmpty()) {
					response.setHeader("redirect", customUrl);
					response.sendError(302, "Need to redirect to " + customUrl);
				} else {
					String redirectUrl = WebUtility.inputSanitizer(request.getHeader("referer"));
					if (DBLoader.useLogoutPage()) {
						String scheme = WebUtility.inputSanitizer(request.getScheme());
						if (!scheme.trim().equalsIgnoreCase("https") && !scheme.trim().equalsIgnoreCase("http")) {
							throw new IllegalArgumentException("scheme is invalid, please input proper scheme");
						}
						String serverName = WebUtility.inputSanitizer(request.getServerName()); // hostname.com
						int serverPort = request.getServerPort(); // 8080
						String contextPath = WebUtility.inputSanitizer(request.getContextPath()); // /Monolith

						redirectUrl = "";
						redirectUrl += scheme + "://" + serverName;
						if (serverPort != 80 && serverPort != 443) {
							redirectUrl += ":" + serverPort;
						}
						redirectUrl += contextPath + "/logout/";
						response.setHeader("redirect", redirectUrl);
						response.sendError(302, "Need to redirect to " + redirectUrl);
					} else {
						redirectUrl = redirectUrl + WebUtility.determineLoginExtension(request);
						String encodedRedirectUrl = Encode.forHtml(redirectUrl);
						response.setHeader("redirect", encodedRedirectUrl);
						response.sendError(302, "Need to redirect to " + encodedRedirectUrl);
					}
				}
			}

			// remove the cookie from the browser
			// for the session id
			classLogger.info("Removing session token");
			nullCookies = new ArrayList<>();
			WebUtility.expireSessionCookies(request, nullCookies);
			// invalidate the session
			session.invalidate();
		}

		Map<String, Boolean> ret = new HashMap<>();
		ret.put("success", removed);
		if (nullCookies == null) {
			return WebUtility.getResponse(ret, 200);
		}

		return WebUtility.getResponseNoCache(ret, 200, nullCookies.toArray(new NewCookie[] {}));
	}

	/**
	 * Adds or updates an authenticated access token in the current user session.
	 *
	 * @param token   normalized access token
	 * @param request inbound HTTP request
	 * @param autoAdd when true, create/update the user record automatically
	 */
	public static void addAccessToken(AccessToken token, HttpServletRequest request, boolean autoAdd) {
		HttpSession session = request.getSession(true);
		User semossUser = (User) session.getAttribute(Constants.SESSION_USER);
		// all of this is now in the user
		boolean firstLogin = semossUser == null;
		if (firstLogin) {
			semossUser = new User();
			session.setAttribute(Constants.SESSION_USER_ID_LOG, token.getId());
			// to prevent session fixation attacks
			if (!session.isNew()) {
				request.changeSessionId();
			}
		}
		// add new users into the database
		if (autoAdd) {
			SecurityUpdateUtils.addOAuthUser(token);
		}
		// validate the user's login
		// that they are not locked
		// and to update the last login date
		try {
			SecurityUpdateUtils.validateUserLogin(token);
		} catch (Exception e) {
			classLogger.error("Unexpected error in addAccessToken", e);
		}
		// also set the user metadata
		SecurityUserUtils.loadUserMetadata(token);

		semossUser.setAccessToken(token);
		semossUser.setAnonymous(false);

		session.setAttribute(Constants.SESSION_USER, semossUser);
		WebUtility.loggingContextLoginEvent(session);

		UserResource.userTrackingLogin(request, semossUser, token.getProvider());

		// log the user login
		classLogger.info("User is logging in with provider {}", token.getProvider());

		// only for first login
		// lets see if there is an external auth
		// that we should be loading
		if (firstLogin && Boolean
				.parseBoolean(Utility.getDIHelperProperty(Constants.EXTERNAL_PERMISSION_MANAGEMENT_ENABLED) + "")) {
			try {
				ExternalAuthorizationHelper.updateEnginePermissionsBasedOnApiCall(semossUser);
			} catch (Exception e) {
				classLogger.error("Unexpected error in addAccessToken", e);
			}
		}
	}

	/**
	 * Records a user login event in the tracking system.
	 *
	 * @param request    inbound HTTP request
	 * @param semossUser authenticated user
	 * @param ap         authentication provider used for login
	 */
	public static void userTrackingLogin(HttpServletRequest request, User semossUser, AuthProvider ap) {
		String ip = WebUtility.getClientIp(request);
		String sessionId = "NO_SESSION_ID";
		if (request.getSession() != null && request.getSession().getId() != null) {
			sessionId = request.getSession().getId();
			UserTrackingUtils.registerLogin(sessionId, ip, semossUser, ap);
		} else {
			UserTrackingUtils.registerLogin(sessionId, ip, semossUser, ap);
		}
		UserAuditTrailUtils.recordLogin(semossUser, ap, sessionId, ip);
	}

	/**
	 * User info method calls
	 */

	/**
	 * Gets user profile information for any OAuth provider.
	 * <p>
	 * Resolves the provider (handling aliases such as
	 * {@code microsoft}/{@code ms}), then refreshes the logged-in user's profile
	 * from that provider using its {@link IAccessTokenFiller} strategy - the same
	 * fetch/parse logic used at login, so no per-provider code is duplicated here.
	 *
	 * @param provider the provider path segment
	 * @param request  inbound HTTP request
	 * @return the user's display name, or a prompt to log in
	 */
	@GET
	@Produces("application/json")
	@Path("/userinfo/{provider}")
	public Response userinfoGeneric(@PathParam("provider") String provider, @Context HttpServletRequest request) {
		provider = WebUtility.inputSanitizer(provider);
		AuthProvider providerEnum = AuthProvider.getSocialPropKeysToEnum().getOrDefault(provider.toLowerCase(),
				AuthProvider.GENERIC);
		String prefix = AuthProvider.getSocialPrefixForPath(provider) + "_";

		Map<String, Object> ret = new HashMap<>();
		HttpSession session = request.getSession(false);
		User semossUser = (session != null) ? (User) session.getAttribute(Constants.SESSION_USER) : null;

		if (semossUser == null) {
			List<NewCookie> newCookies = new ArrayList<>();
			// not authenticated - remove any cookies we shouldn't have
			WebUtility.expireSessionCookies(request, newCookies);
			if (session != null && (session.isNew() || request.isRequestedSessionIdValid())) {
				session.invalidate();
			}
			ret.put(Constants.ERROR_MESSAGE, "Log into your " + providerEnum.getDisplayName() + " account");
			return WebUtility.getResponseNoCache(ret, 200, newCookies.toArray(new NewCookie[] {}));
		}

		try {
			AccessToken loggedInToken = semossUser.getAccessToken(providerEnum);
			if (loggedInToken == null) {
				throw new IllegalStateException(
						"No access token for provider " + providerEnum.name() + " - user needs to login");
			}
			// refresh the profile from the provider using its filler strategy (userinfo
			// GET/POST, id_token decode, etc. are all encapsulated in the filler)
			AccessToken newToken = new AccessToken();
			newToken.setAccess_token(loggedInToken.getAccess_token());
			providerEnum.newTokenFiller().fillAccessToken(newToken, prefix);
			ret.putAll(newToken.toProviderMap(false, null, false));
			return WebUtility.getResponse(ret, 200);
		} catch (Exception e) {
			classLogger.error("Failed to fetch user info for provider " + providerEnum.name(), e);
			ret.put(Constants.ERROR_MESSAGE, "Log into your " + providerEnum.getDisplayName() + " account");
			return WebUtility.getResponse(ret, 200);
		}
	}

	/**
	 * Initializes an OAuth login flow session and stores a custom redirect value
	 * when present, and whether the login should end without a redirect
	 * ({@code disableRedirect=true}).
	 *
	 * @param request inbound HTTP request
	 * @return existing or newly-created session
	 */
	private HttpSession initializeOAuthLoginSession(HttpServletRequest request) {
		HttpSession session = request.getSession(false);
		String customRedirect = WebUtility.cleanHttpResponse(request.getParameter("redirect"));
		if (customRedirect != null && !customRedirect.isEmpty()) {
			if (session == null) {
				session = request.getSession();
			}
			session.setAttribute(CUSTOM_REDIRECT_SESSION_KEY, customRedirect);
		}

		// the provider's callback does not carry the parameters the login started
		// with, so disableRedirect is kept in the session until the login ends. A
		// login that starts without it drops one an abandoned login left behind.
		if (!isOAuthCallback(request)) {
			if (Boolean.parseBoolean(request.getParameter("disableRedirect"))) {
				if (session == null) {
					session = request.getSession();
				}
				session.setAttribute(OAUTH_DISABLE_REDIRECT_SESSION_KEY, Boolean.TRUE);
			} else if (session != null) {
				session.removeAttribute(OAUTH_DISABLE_REDIRECT_SESSION_KEY);
			}
		}
		return session;
	}

	/**
	 * Whether a request to an OAuth login endpoint is the provider sending the user
	 * back, rather than the FE starting a login.
	 *
	 * @param request inbound HTTP request
	 * @return true for a provider callback
	 */
	private boolean isOAuthCallback(HttpServletRequest request) {
		return request.getParameter("code") != null || request.getParameter("state") != null
				|| request.getParameter("error") != null;
	}

	/**
	 * Ends a successful OAuth login. A login started with
	 * {@code disableRedirect=true}, such as one the FE opened in a popup, ends on a
	 * page that closes its window; every other login is redirected to the main page
	 * or its custom redirect.
	 *
	 * @param request  inbound HTTP request
	 * @param response outbound HTTP response
	 * @throws IOException when the response cannot be written
	 */
	private void finishOAuthLogin(HttpServletRequest request, HttpServletResponse response) throws IOException {
		HttpSession session = request.getSession();
		if (!Boolean.TRUE.equals(session.getAttribute(OAUTH_DISABLE_REDIRECT_SESSION_KEY))) {
			setMainPageRedirect(request, response);
			return;
		}

		session.removeAttribute(OAUTH_DISABLE_REDIRECT_SESSION_KEY);
		session.removeAttribute(CUSTOM_REDIRECT_SESSION_KEY);
		addSessionCookieHeader(request, response, session);

		byte[] nonceBytes = new byte[16];
		NONCE_RANDOM.nextBytes(nonceBytes);
		String nonce = Base64.getEncoder().encodeToString(nonceBytes);

		response.setStatus(HttpServletResponse.SC_OK);
		response.setContentType("text/html;charset=UTF-8");
		response.setHeader("Cache-Control", "no-store");
		// its own policy: only this page's one script may run
		response.setHeader("Content-Security-Policy", "default-src 'none'; script-src 'nonce-" + nonce
				+ "'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'");
		response.getWriter().write(LOGIN_COMPLETE_PAGE.formatted(nonce));
		// commit it here, since the resource method returns null
		response.flushBuffer();
	}

	/**
	 * Resolves the authenticated user from a session.
	 *
	 * @param session HTTP session
	 * @return session user or {@code null}
	 */
	private User getSessionUser(HttpSession session) {
		if (session == null) {
			return null;
		}
		return (User) session.getAttribute(Constants.SESSION_USER);
	}

	/**
	 * Reloads the session user after an OAuth callback updates session state.
	 *
	 * @param request inbound HTTP request
	 * @param session current session reference
	 * @return session user or {@code null}
	 */
	private User refreshSessionUser(HttpServletRequest request, HttpSession session) {
		if (session != null || (session = request.getSession(false)) != null) {
			return (User) session.getAttribute(Constants.SESSION_USER);
		}
		return null;
	}

	/**
	 * Checks whether a user has an access token for the requested provider.
	 *
	 * @param user     user to inspect
	 * @param provider authentication provider
	 * @return {@code true} when a token exists
	 */
	private boolean hasAccessToken(User user, AuthProvider provider) {
		return user != null && user.getAccessToken(provider) != null;
	}

	/**
	 * Encodes the request query string for safe OAuth parsing.
	 *
	 * @param request inbound HTTP request
	 * @return encoded query string
	 */
	private String getEncodedQueryString(HttpServletRequest request) {
		return WebUtility.encodeHTTPUri(request.getQueryString());
	}

	/**
	 * Checks whether the callback query contains an OAuth authorization code.
	 *
	 * @param queryString encoded callback query string
	 * @return {@code true} when a code parameter is present
	 */
	private boolean hasOAuthCode(String queryString) {
		return queryString != null && queryString.contains("code");
	}

	/**
	 * Handles ADFS OAuth login callback flow.
	 */
	@GET
	@Produces("application/json")
	@Path("/login/adfs")
	public Response loginADFS(@Context HttpServletRequest request, @Context HttpServletResponse response)
			throws IOException {
		// unified OAuth2/OIDC flow - see loginGeneric + AdfsTokenFiller (id_token mode)
		return loginGeneric("adfs", request, response);
	}

	/**
	 * Handles Dropbox OAuth login callback flow.
	 */
	@GET
	@Produces("application/json")
	@Path("/login/dropbox")
	public Response loginDropBox(@Context HttpServletRequest request, @Context HttpServletResponse response)
			throws IOException {
		// unified OAuth2 flow - see loginGeneric + DropboxTokenFiller
		return loginGeneric("dropbox", request, response);
	}

	/**
	 * Handles GitHub OAuth login callback flow.
	 * https://developer.github.com/apps/building-oauth-apps/authorization-options-for-oauth-apps/
	 */
	@GET
	@Produces("application/json")
	@Path("/login/github")
	public Response loginGithub(@Context HttpServletRequest request, @Context HttpServletResponse response)
			throws IOException {
		// unified OAuth2 flow - see loginGeneric + GithubTokenFiller
		// (form-encoded token exchange + git cert install live in the filler)
		return loginGeneric("github", request, response);
	}

	/**
	 * Handles GitLab OAuth login callback flow.
	 * https://docs.gitlab.com/13.12/ee/integration/oauth_provider.html
	 * https://docs.gitlab.com/13.12/ee/api/oauth2.html
	 */
	@GET
	@Produces("application/json")
	@Path("/login/gitlab")
	public Response loginGitlab(@Context HttpServletRequest request, @Context HttpServletResponse response)
			throws IOException {
		// unified OAuth2 flow - see loginGeneric + GitLabTokenFiller
		return loginGeneric("gitlab", request, response);
	}

	/**
	 * Handles Google OAuth login callback flow.
	 * https://developers.google.com/api-client-library/java/google-api-java-client/oauth2
	 */
	@GET
	@Produces("application/json")
	@Path("/login/google")
	public Response loginGoogle(@Context HttpServletRequest request, @Context HttpServletResponse response)
			throws IOException {
		// unified OAuth2 flow - see loginGeneric + GoogleTokenFiller
		return loginGeneric("google", request, response);
	}

	/**
	 * Handles Jira OAuth login callback and exchanges the authorization code for a
	 * token.
	 *
	 * @param request  inbound HTTP request
	 * @param response outbound HTTP response
	 * @return redirect response
	 * @throws IOException when redirect writing fails
	 */
	@GET
	@Produces("application/json")
	@Path("/login2/jira")
	public Response loginJiraDynamic(@Context HttpServletRequest request, @Context HttpServletResponse response)
			throws IOException {
		HttpSession session = initializeOAuthLoginSession(request);
		User userObj = getSessionUser(session);
		String queryString = getEncodedQueryString(request);
		if (hasOAuthCode(queryString)) {
			if (!hasAccessToken(userObj, AuthProvider.JIRA)) {
				String[] outputs = HttpHelperUtility.getCodes(queryString);
				String code = URLDecoder.decode(outputs[0], StandardCharsets.UTF_8);
				if (code.matches("[ -~]+")) {
					String state = URLDecoder.decode(outputs[1], StandardCharsets.UTF_8);
					String connectionId = session == null ? null : (String) session.getAttribute("sf_state_" + state);
					if (connectionId == null) {
						// invalid or tampered state
						response.setStatus(400);
						return null;
					}
					session.removeAttribute("sf_state_" + state);

					String redirectUri = WebUtility.getCurrentCallbackUrl(request);
					boolean autoAdd = true;
					Map<String, Object> details = SecurityExternalConnectorsUtils
							.getJiraConnectionDetails(connectionId);
					String clientId = (String) details.get("clientId");
					String clientSecret = (String) details.get("clientSecret");
					String userInfoUrl = (String) details.get("userInfoUrl");

					if (clientId == null || clientSecret == null || redirectUri == null) {
						classLogger.warn(
								"Jira credentials unavailable for connectionId='{}'; missing clientId={}, clientSecret={}, redirectUri={}",
								Utility.cleanLogString(connectionId), clientId == null, clientSecret == null,
								redirectUri == null);
						response.setContentType("text/plain; charset=UTF-8");
						response.setHeader("X-Content-Type-Options", "nosniff");
						response.setStatus(400);
						response.getWriter().write("Jira credentials not found for the requested connection");
						return null;
					}

					classLogger.debug(">> {}", Utility.cleanLogString(request.getQueryString()));

					Map<String, String> params = new HashMap<>();
					params.put("client_id", clientId);
					params.put("client_secret", clientSecret);
					params.put("redirect_uri", redirectUri);
					params.put("code", code);
					params.put("grant_type", "authorization_code");

					String url = "https://auth.atlassian.com/oauth/token";

					AccessToken accessToken = HttpHelperUtility.getAccessToken(url, params, true, true);
					if (accessToken == null) {
						// not authenticated
						response.setStatus(302);
						response.sendRedirect(getJiraRedirectDynamic(request, response, connectionId));
						return null;
					}
					accessToken.setProvider(AuthProvider.JIRA);
					// fill the access token with the other properties so we can properly create the
					// user
					JiraTokenFiller profiler = new JiraTokenFiller();
					profiler.fillAccessToken(accessToken, userInfoUrl, null, null, null);

					String cloudId = fetchJiraCloudId(accessToken.getAccess_token());
					if (cloudId != null) {
						accessToken.setId(cloudId);
					}

					addAccessToken(accessToken, request, autoAdd);

					classLogger.debug("Successfully processed Jira OAuth callback. Access Token is.. {}",
							accessToken.getAccess_token());
				}
			}
		}

		userObj = refreshSessionUser(request, session);
		if (!hasAccessToken(userObj, AuthProvider.JIRA)) {
			// not authenticated
			response.setStatus(302);
			response.sendRedirect(getJiraRedirectDynamic(request, response, null));
			return null;
		}

		finishOAuthLogin(request, response);
		return null;
	}

	/**
	 * Builds the Jira dynamic-credential authorization redirect URL.
	 *
	 * @param request      inbound HTTP request
	 * @param response     outbound HTTP response
	 * @param connectionId external-connector id
	 * @return Jira authorize URL or {@code null} when validation fails
	 * @throws UnsupportedEncodingException when redirect parameters cannot be URL
	 *                                      encoded
	 * @throws IOException                  when response writing fails
	 */
	private String getJiraRedirectDynamic(HttpServletRequest request, HttpServletResponse response, String connectionId)
			throws UnsupportedEncodingException, IOException {
		String redirectUri = WebUtility.getCurrentCallbackUrl(request);
		if (connectionId == null) {
			connectionId = request.getParameter("connectionId");
		}
		if (connectionId == null || connectionId.isEmpty()) {
			response.setStatus(400);
			response.getWriter().write("Missing required parameter: connectionId");
			return null;
		}

		String state = UUID.randomUUID().toString();
		request.getSession().setAttribute("sf_state_" + state, connectionId);

		Map<String, Object> details = SecurityExternalConnectorsUtils.getJiraConnectionDetails(connectionId);
		String clientId = (String) details.get("clientId");
		String scope = (String) details.get("scope");

		if (clientId == null || scope == null || redirectUri == null) {
			classLogger.warn(
					"Jira credentials unavailable for connectionId='{}'; missing clientId={}, scope={}, redirectUri={}",
					Utility.cleanLogString(connectionId), clientId == null, scope == null, redirectUri == null);
			response.setContentType("text/plain; charset=UTF-8");
			response.setHeader("X-Content-Type-Options", "nosniff");
			response.setStatus(400);
			response.getWriter().write("Jira credentials not found for the requested connection");
			return null;
		}

		String redirectUrl = "https://auth.atlassian.com/authorize" + "?audience=api.atlassian.com" + "&client_id="
				+ URLEncoder.encode(clientId, "UTF-8") + "&scope=" + URLEncoder.encode(scope, "UTF-8")
				+ "&redirect_uri=" + URLEncoder.encode(redirectUri, "UTF-8") + "&state="
				+ URLEncoder.encode(state, "UTF-8") + "&response_type=code" + "&prompt=consent";

		classLogger.debug("Sending Jira redirect.. {}", Utility.cleanLogString(redirectUrl));
		return redirectUrl;
	}

	/**
	 * Fetches the first accessible Jira cloud resource id for a bearer token.
	 *
	 * @param bearerToken Jira bearer token
	 * @return cloud id when available; otherwise {@code null}
	 */
	private String fetchJiraCloudId(String bearerToken) {
		try {
			String url = "https://api.atlassian.com/oauth/token/accessible-resources";
			Map<String, Object> params = new HashMap<>();
			String output = HttpHelperUtility.makeGetCall(url, bearerToken, params, true);
			JSONArray resources = new JSONArray(output);
			if (resources.length() > 0) {
				return resources.getJSONObject(0).getString("id");
			}
		} catch (Exception e) {
			classLogger.error("Failed to fetch Jira accessible resources (cloudId)", e);
		}
		return null;
	}

	/**
	 * Handles LinkedIn OAuth login callback flow.
	 */
	@GET
	@Produces("application/json")
	@Path("/login/linkedin")
	public Response loginLinkedin(@Context HttpServletRequest request, @Context HttpServletResponse response)
			throws IOException {
		// unified OAuth2 flow - see loginGeneric + LinkedInTokenFiller
		return loginGeneric("linkedin", request, response);
	}

	/**
	 * Deprecated alias for the Microsoft OAuth login endpoint.
	 */
	@GET
	@Produces("application/json")
	@Path("/login/ms")
	@Deprecated
	public Response loginMS(@Context HttpServletRequest request, @Context HttpServletResponse response)
			throws IOException {
		return loginMicrosoft(request, response);
	}

	/**
	 * Handles Microsoft OAuth login callback flow.
	 *
	 * @param request  inbound HTTP request
	 * @param response outbound HTTP response
	 * @return redirect response
	 * @throws IOException when redirect writing fails
	 */
	@GET
	@Produces("application/json")
	@Path("/login/microsoft")
	public Response loginMicrosoft(@Context HttpServletRequest request, @Context HttpServletResponse response)
			throws IOException {
		// unified OAuth2 flow - see loginGeneric + MicrosoftTokenFiller
		// (tenant-templated endpoints + login_external enforcement live in the filler)
		return loginGeneric("ms", request, response);
	}

	/**
	 * Handles Okta OAuth login callback flow.
	 */
	@GET
	@Produces("application/json")
	@Path("/login/okta")
	public Response loginOkta(@Context HttpServletRequest request, @Context HttpServletResponse response)
			throws IOException {
		// unified OAuth2 flow - see loginGeneric + OktaTokenFiller
		return loginGeneric("okta", request, response);
	}

	@Path("/login/producthunt")
	/**
	 * Handles Product Hunt OAuth login callback flow.
	 *
	 * @param request  inbound HTTP request
	 * @param response outbound HTTP response
	 * @return redirect response
	 * @throws IOException when redirect writing fails
	 */
	public Response loginProducthunt(@Context HttpServletRequest request, @Context HttpServletResponse response)
			throws IOException {
		// unified OAuth2 flow - see loginGeneric + ProductHuntTokenFiller
		return loginGeneric("producthunt", request, response);
	}

	/**
	 * Handles Salesforce OAuth login callback flow.
	 */
	@GET
	@Produces("application/json")
	@Path("/login/salesforce")
	public Response loginSalesforce(@Context HttpServletRequest request, @Context HttpServletResponse response)
			throws IOException {
		// unified OAuth2 flow - see loginGeneric + SalesforceTokenFiller
		return loginGeneric("salesforce", request, response);
	}

	/**
	 * Handles Salesforce OAuth callback flow using dynamic connector credentials.
	 */
	@GET
	@Produces("application/json")
	@Path("/login2/salesforce")
	public Response loginSalesforceDynamic(@Context HttpServletRequest request, @Context HttpServletResponse response)
			throws IOException {
		HttpSession session = initializeOAuthLoginSession(request);
		User userObj = getSessionUser(session);
		String queryString = getEncodedQueryString(request);
		if (hasOAuthCode(queryString)) {
			if (!hasAccessToken(userObj, AuthProvider.SALESFORCE)) {
				String[] outputs = HttpHelperUtility.getCodes(queryString);

				// oauth code should match [ -~]+ (1 or more ascii)
				// https://www.rfc-editor.org/rfc/rfc6749#appendix-A.11
				String code = URLDecoder.decode(outputs[0], StandardCharsets.UTF_8);
				if (code.matches("[ -~]+")) {
					String state = outputs[1];
					String connectionId = session == null ? null : (String) session.getAttribute("sf_state_" + state);
					if (connectionId == null) {
						// invalid or tampered state
						response.setStatus(400);
						return null;
					}
					session.removeAttribute("sf_state_" + state);

					// get credentials by UUID (ID) from SALESFORCE_CREDENTIALS table
					String redirectUri = WebUtility.getCurrentCallbackUrl(request);
					boolean autoAdd = true;

					Pair<String, String> details = SecurityExternalConnectorsUtils
							.getSalesforceConnectionDetails(connectionId);
					String clientId = details.getValue0();
					String clientSecret = details.getValue1();

					if (clientId == null || clientSecret == null || redirectUri == null) {
						classLogger.warn(
								"Salesforce credentials unavailable for connectionId='{}'; missing clientId={}, clientSecret={}, redirectUri={}",
								Utility.cleanLogString(connectionId), clientId == null, clientSecret == null,
								redirectUri == null);
						response.setContentType("text/plain; charset=UTF-8");
						response.setHeader("X-Content-Type-Options", "nosniff");
						response.setStatus(400);
						response.getWriter().write("Salesforce credentials not found for the requested connection");
						return null;
					}

					classLogger.debug(">> {}", Utility.cleanLogString(request.getQueryString()));

					Map<String, String> params = new HashMap<>();
					params.put("client_id", clientId);
					params.put("grant_type", "authorization_code");
					params.put("redirect_uri", redirectUri);
					params.put("code", code);
					params.put("client_secret", clientSecret);

					String url = "https://login.salesforce.com/services/oauth2/token";

					AccessToken accessToken = HttpHelperUtility.getAccessToken(url, params, true, true);
					if (accessToken == null) {
						// not authenticated
						response.setStatus(302);
						response.sendRedirect(getSalesforceRedirectDynamic(request, response, connectionId));
						return null;
					}
					accessToken.setProvider(AuthProvider.SALESFORCE);

					// fill the access token with the other properties so we can properly create the
					// user
					SalesforceTokenFiller profiler = new SalesforceTokenFiller();
					profiler.fillAccessToken(accessToken, null, null, null, null);
					addAccessToken(accessToken, request, autoAdd);

					classLogger.debug("Access Token is.. {}", accessToken.getAccess_token());
				}
			}
		}

		userObj = refreshSessionUser(request, session);
		if (!hasAccessToken(userObj, AuthProvider.SALESFORCE)) {
			// not authenticated
			response.setStatus(302);
			response.sendRedirect(getSalesforceRedirectDynamic(request, response, null));
			return null;
		}

		finishOAuthLogin(request, response);
		return null;
	}

	/**
	 * Builds the Salesforce dynamic-credential authorization redirect URL.
	 *
	 * @param request      inbound HTTP request
	 * @param response     outbound HTTP response
	 * @param connectionId external-connector id
	 * @return Salesforce authorize URL or {@code null} when validation fails
	 * @throws UnsupportedEncodingException when redirect parameters cannot be URL
	 *                                      encoded
	 * @throws IOException                  when response writing fails
	 */
	private String getSalesforceRedirectDynamic(HttpServletRequest request, @Context HttpServletResponse response,
			String connectionId) throws UnsupportedEncodingException, IOException {
		String redirectUri = WebUtility.getCurrentCallbackUrl(request);
		if (connectionId == null) {
			connectionId = request.getParameter("connectionId");
		}
		if (connectionId == null || connectionId.isEmpty()) {
			response.setStatus(400);
			response.getWriter().write("Missing required parameter: connectionId");
			return null;
		}

		String state = UUID.randomUUID().toString();
		// store the connection id in session
		request.getSession().setAttribute("sf_state_" + state, connectionId);

		Pair<String, String> details = SecurityExternalConnectorsUtils.getSalesforceConnectionDetails(connectionId);
		String clientId = details.getValue0();
		String redirectUrl = "https://login.salesforce.com/services/oauth2/authorize?" + "client_id="
				+ URLEncoder.encode(clientId, "UTF-8") + "&response_type=code" + "&redirect_uri="
				+ URLEncoder.encode(redirectUri, "UTF-8") + "&scope=" + URLEncoder.encode("api", "UTF-8") + "&state="
				+ state;

		classLogger.debug("Sending redirect {}", Utility.cleanLogString(redirectUrl));
		return redirectUrl;
	}

	/**
	 * Handles ServiceNow OAuth login callback flow.
	 */
	@GET
	@Produces("application/json")
	@Path("/login/servicenow")
	public Response loginServiceNow(@Context HttpServletRequest request, @Context HttpServletResponse response)
			throws IOException {
		// unified OAuth2 flow - see loginGeneric + ServiceNowTokenFiller
		return loginGeneric("servicenow", request, response);
	}

	/**
	 * Handles ServiceNow OAuth callback flow using dynamic connector credentials.
	 */
	@GET
	@Produces("application/json")
	@Path("/login2/servicenow")
	public Response loginServiceNowDynamic(@Context HttpServletRequest request, @Context HttpServletResponse response)
			throws IOException {
		HttpSession session = initializeOAuthLoginSession(request);
		User userObj = getSessionUser(session);
		String queryString = getEncodedQueryString(request);
		if (hasOAuthCode(queryString)) {
			if (!hasAccessToken(userObj, AuthProvider.SERVICENOW)) {
				String[] outputs = HttpHelperUtility.getCodes(queryString);

				// oauth code should match [ -~]+ (1 or more ascii)
				// https://www.rfc-editor.org/rfc/rfc6749#appendix-A.11
				String code = URLDecoder.decode(outputs[0], StandardCharsets.UTF_8);
				if (code.matches("[ -~]+")) {
					String state = outputs[1];
					String connectionId = session == null ? null : (String) session.getAttribute("sn_state_" + state);
					if (connectionId == null) {
						// invalid or tampered state
						response.setStatus(400);
						return null;
					}
					session.removeAttribute("sn_state_" + state);

					// get credentials by UUID (ID) from SERVICENOW_CREDENTIALS table
					String redirectUri = WebUtility.getCurrentCallbackUrl(request);
					boolean autoAdd = true;

					Map<String, String> details = SecurityExternalConnectorsUtils
							.getServiceNowConnectionDetails(connectionId);
					String instanceUrl = details.get("instanceUrl");
					String clientId = details.get("clientId");
					String clientSecret = details.get("clientSecret");
					String userInfoUrl = details.get("userProfileUrl"); // to pass to fillAccessToken method

					if (instanceUrl == null || clientId == null || clientSecret == null || redirectUri == null) {
						classLogger.warn(
								"ServiceNow credentials unavailable for connectionId='{}'; missing instanceUrl={}, clientId={}, clientSecret={}, redirectUri={}",
								Utility.cleanLogString(connectionId), instanceUrl == null, clientId == null,
								clientSecret == null, redirectUri == null);
						response.setContentType("text/plain; charset=UTF-8");
						response.setHeader("X-Content-Type-Options", "nosniff");
						response.setStatus(400);
						response.getWriter().write("ServiceNow credentials not found for the requested connection");
						return null;
					}

					classLogger.debug(">> {}", Utility.cleanLogString(request.getQueryString()));

					Map<String, String> params = new HashMap<>();
					params.put("client_id", clientId);
					params.put("grant_type", "authorization_code");
					params.put("redirect_uri", redirectUri);
					params.put("code", code);
					params.put("client_secret", clientSecret);

					String url = instanceUrl + "/oauth_token.do";

					AccessToken accessToken = HttpHelperUtility.getAccessToken(url, params, true, true);
					if (accessToken == null) {
						// not authenticated
						response.setStatus(302);
						response.sendRedirect(getServiceNowRedirectDynamic(request, response, connectionId));
						return null;
					}
					accessToken.setProvider(AuthProvider.SERVICENOW);

					// fill the access token with the other properties so we can properly create the
					// user
					ServiceNowTokenFiller profiler = new ServiceNowTokenFiller();
					profiler.fillAccessToken(accessToken, userInfoUrl, null, null, null);

					addAccessToken(accessToken, request, autoAdd);

					classLogger.debug("Access Token is.. {}", accessToken.getAccess_token());
				}
			}
		}

		userObj = refreshSessionUser(request, session);
		if (!hasAccessToken(userObj, AuthProvider.SERVICENOW)) {
			// not authenticated
			response.setStatus(302);
			response.sendRedirect(getServiceNowRedirectDynamic(request, response, null));
			return null;
		}

		finishOAuthLogin(request, response);
		return null;
	}

	/**
	 * Builds the ServiceNow dynamic-credential authorization redirect URL.
	 *
	 * @param request      inbound HTTP request
	 * @param response     outbound HTTP response
	 * @param connectionId external-connector id
	 * @return ServiceNow authorize URL or {@code null} when validation fails
	 * @throws UnsupportedEncodingException when redirect parameters cannot be URL
	 *                                      encoded
	 * @throws IOException                  when response writing fails
	 */
	private String getServiceNowRedirectDynamic(HttpServletRequest request, @Context HttpServletResponse response,
			String connectionId) throws UnsupportedEncodingException, IOException {
		String redirectUri = WebUtility.getCurrentCallbackUrl(request);
		if (connectionId == null) {
			connectionId = request.getParameter("connectionId");
		}
		if (connectionId == null || connectionId.isEmpty()) {
			response.setStatus(400);
			response.getWriter().write("Missing required parameter: connectionId");
			return null;
		}

		String state = UUID.randomUUID().toString();
		// store the connection id in session
		request.getSession().setAttribute("sn_state_" + state, connectionId);

		Map<String, String> details = SecurityExternalConnectorsUtils.getServiceNowConnectionDetails(connectionId);
		String instanceUrl = details.get("instanceUrl");
		String clientId = details.get("clientId");

		String redirectUrl = instanceUrl + "/oauth_auth.do?" + "client_id=" + URLEncoder.encode(clientId, "UTF-8")
				+ "&response_type=code" + "&redirect_uri=" + URLEncoder.encode(redirectUri, "UTF-8") + "&state="
				+ state;

		classLogger.debug("Sending redirect {}", Utility.cleanLogString(redirectUrl));
		return redirectUrl;
	}

	/**
	 * Handles SiteMinder OAuth login callback flow.
	 */
	@GET
	@Produces("application/json")
	@Path("/login/siteminder")
	public Response loginSiteminder(@Context HttpServletRequest request, @Context HttpServletResponse response)
			throws IOException {
		// unified OAuth2 flow - see loginGeneric + SiteminderTokenFiller
		return loginGeneric("siteminder", request, response);
	}

	/**
	 * Handles SurveyMonkey OAuth login callback flow.
	 */
	@GET
	@Produces("application/json")
	@Path("/login/surveymonkey")
	public Response loginSurveyMonkey(@Context HttpServletRequest request, @Context HttpServletResponse response)
			throws IOException {
		// unified OAuth2 flow - see loginGeneric + SurveyMonkeyTokenFiller
		return loginGeneric("surveymonkey", request, response);
	}

	/**
	 * Handles Twitter OAuth login callback flow.
	 * 
	 * @param request
	 * @param response
	 * @return
	 * @throws IOException
	 */
	@GET
	@Produces("application/json")
	@Path("/login/twitter")
	public Response loginTwitter(@Context HttpServletRequest request, @Context HttpServletResponse response)
			throws IOException {
		// unified OAuth2 + PKCE flow - see loginGeneric + TwitterTokenFiller (X API v2)
		return loginGeneric("twitter", request, response);
	}

	/**
	 * Handles OAuth login callback flow for a generic provider.
	 */
	@GET
	@Produces("application/json")
	@Path("/login/{provider}")
	public Response loginGeneric(@PathParam("provider") String provider, @Context HttpServletRequest request,
			@Context HttpServletResponse response) throws IOException {
		provider = WebUtility.inputSanitizer(provider);
		if (socialData.getLoginsAllowed().get(provider) == null || !socialData.getLoginsAllowed().get(provider)) {
			Map<String, Object> ret = new HashMap<>();
			ret.put(Constants.ERROR_MESSAGE, provider + " login is not allowed");
			return WebUtility.getResponse(ret, 400);
		}

		// resolve the provider (handles aliases such as microsoft/ms and producthunt),
		// its canonical social.properties prefix, and the token filler strategy.
		// Unknown
		// providers fall back to GENERIC + the raw path prefix so a fully config-driven
		// OAuth2 provider still works without any code change here.
		AuthProvider providerEnum = AuthProvider.getSocialPropKeysToEnum().getOrDefault(provider.toLowerCase(),
				AuthProvider.GENERIC);
		String prefix = AuthProvider.getSocialPrefixForPath(provider) + "_";
		IAccessTokenFiller filler = providerEnum.newTokenFiller();
		// we dont need to ever set redirect_uri so we will set a correct default
		filler.setDefaultRedirectUri(WebUtility.getCurrentCallbackUrl(request));

		HttpSession session = initializeOAuthLoginSession(request);
		User userObj = getSessionUser(session);
		String queryString = getEncodedQueryString(request);
		if (hasOAuthCode(queryString)) {
			if (!hasAccessToken(userObj, providerEnum)) {
				String[] outputs = HttpHelperUtility.getCodes(queryString);

				// oauth code should match [ -~]+ (1 or more ascii)
				// https://www.rfc-editor.org/rfc/rfc6749#appendix-A.11
				String code = URLDecoder.decode(outputs[0], StandardCharsets.UTF_8);
				if (code.matches("[ -~]+")) {
					boolean autoAdd = Boolean.parseBoolean(socialData.getProperty(prefix + "auto_add", "true"));

					classLogger.debug(">> {}", Utility.cleanLogString(request.getQueryString()));

					// PKCE: replay the code_verifier stashed at authorize time (null otherwise)
					String codeVerifier = filler.usesPKCE() ? (String) session.getAttribute(prefix + PKCE_VERIFIER_ATTR)
							: null;

					AccessToken accessToken = filler.exchangeCodeForToken(prefix, code, codeVerifier);
					if (accessToken == null) {
						// not authenticated
						response.setStatus(302);
						response.sendRedirect(buildProviderAuthorizeRedirect(filler, prefix, session));
						return null;
					}

					accessToken.setProvider(providerEnum);
					// fills the user profile (reads userinfo_url/jsonPattern/beanProps +
					// provider defaults internally); no-op for providers that fetch lazily
					filler.fillAccessToken(accessToken, prefix);
					// fill user groups
					filler.fillUserGroups(accessToken, prefix);

					addAccessToken(accessToken, request, autoAdd);

					classLogger.debug("Access Token is.. {}", accessToken.getAccess_token());
				}
			}
		}

		userObj = refreshSessionUser(request, session);
		if (!hasAccessToken(userObj, providerEnum)) {
			// not authenticated
			response.setStatus(302);
			response.sendRedirect(buildProviderAuthorizeRedirect(filler, prefix, session));
			return null;
		}

		finishOAuthLogin(request, response);
		return null;
	}

	/**
	 * Builds a provider's authorize redirect URL, generating and stashing a PKCE
	 * code verifier (and passing the derived challenge) when the provider uses
	 * PKCE.
	 *
	 * @param filler  the provider's token filler strategy
	 * @param prefix  social.properties prefix for the provider
	 * @param session the login session used to carry the PKCE verifier to the
	 *                callback
	 * @return the authorize redirect URL
	 */
	private String buildProviderAuthorizeRedirect(IAccessTokenFiller filler, String prefix, HttpSession session) {
		String state = UUID.randomUUID().toString();
		String codeChallenge = null;
		if (filler.usesPKCE()) {
			String codeVerifier = PKCEUtil.generateCodeVerifier();
			session.setAttribute(prefix + PKCE_VERIFIER_ATTR, codeVerifier);
			codeChallenge = PKCEUtil.codeChallenge(codeVerifier);
		}
		return filler.buildAuthorizeRedirect(prefix, state, codeChallenge);
	}

	/////////////////////////////////////////////////////////////////

	/**
	 * This portion of code is for semoss generated users
	 */

	/**
	 * Authenticates a native user with username and password credentials.
	 * 
	 * @param request
	 * @return true if the information provided to log in is valid otherwise error.
	 */
	@POST
	@Produces("application/json")
	@Path("/login")
	public Response loginNative(@Context HttpServletRequest request, @Context HttpServletResponse response) {
		Map<String, String> ret = new HashMap<>();

		if (socialData.getLoginsAllowed().get("native") == null || !socialData.getLoginsAllowed().get("native")) {
			ret.put(Constants.ERROR_MESSAGE, "Native login is not allowed");
			UserAuditTrailUtils.recordLoginFailed(request.getParameter("username"), AuthProvider.NATIVE.getLabel(),
					AuditErrorCode.LOGIN_METHOD_DISABLED, "Native login is not allowed",
					WebUtility.getClientIp(request), 400);
			return WebUtility.getResponse(ret, 400);
		}

		try {
			String username = WebUtility.inputSQLSanitizer(request.getParameter("username"));
			String password = WebUtility.inputSQLSanitizer(request.getParameter("password"));
			String redirect = WebUtility.cleanHttpResponse(request.getParameter("redirect"));
			// so that the default is to redirect
			Boolean disableRedirect = Boolean.parseBoolean(request.getParameter("disableRedirect") + "");

			if (username == null || password == null || username.isEmpty() || password.isEmpty()) {
				classLogger.warn("User is trying to login using username='{}' but user name or password are empty",
						username);
				ret.put(Constants.ERROR_MESSAGE, "The user name or password are empty");
				UserAuditTrailUtils.recordLoginFailed(username, AuthProvider.NATIVE.getLabel(),
						AuditErrorCode.MISSING_CREDENTIALS, "The user name or password are empty",
						WebUtility.getClientIp(request), 401);
				return WebUtility.getResponse(ret, 401);
			}

			boolean canLogin = SecurityNativeUserUtils.logIn(username, password);
			if (canLogin) {
				String name = SecurityNativeUserUtils.getNameUser(username);
				String email = SecurityNativeUserUtils.getUserEmail(username);

				String id = SecurityNativeUserUtils.getUserId(username);
				AccessToken authToken = new AccessToken();
				authToken.setProvider(AuthProvider.NATIVE);
				authToken.setId(id);
				authToken.setName(name);
				authToken.setUsername(username);
				authToken.setEmail(email);
				// no need to auto-add since to login native you must already exist
				addAccessToken(authToken, request, false);

				// add these to the return
				ret.put("success", "true");
				ret.put("username", username);
				ret.put("name", name);
				ret.put("email", email);

				// log the log in
				if (!disableRedirect) {
					setMainPageRedirect(request, response, redirect);
				}
			} else {
				HttpSession session = request.getSession(false);
				User user = null;
				if (session != null) {
					user = (User) session.getAttribute(Constants.SESSION_USER);
					if (!AbstractSecurityUtils.anonymousUsersEnabled() && user != null && user.getLogins().isEmpty()) {
						session.invalidate();
					}
				}
				classLogger.warn("User is trying to login using username='{}' but user name or password are empty",
						username);
				ret.put(Constants.ERROR_MESSAGE, "The user name or password are invalid.");
				UserAuditTrailUtils.recordLoginFailed(username, AuthProvider.NATIVE.getLabel(),
						AuditErrorCode.INVALID_CREDENTIALS, "The user name or password are invalid.",
						WebUtility.getClientIp(request), 401);
				return WebUtility.getResponse(ret, 401);
			}
		} catch (Exception e) {
			HttpSession session = request.getSession(false);
			if (session != null) {
				User user = (User) session.getAttribute(Constants.SESSION_USER);
				if (!AbstractSecurityUtils.anonymousUsersEnabled() && user != null && user.getLogins().isEmpty()) {
					session.invalidate();
				}
			}
			classLogger.error("Unexpected error in loginNative", e);
			UserAuditTrailUtils.recordLoginFailed(request.getParameter("username"), AuthProvider.NATIVE.getLabel(),
					AuditErrorCode.INTERNAL_ERROR, e.getMessage(), WebUtility.getClientIp(request), 500);
			ret.put(Constants.ERROR_MESSAGE, "An unexpected error happened. Please try again.");
			return WebUtility.getResponse(ret, 500);
		}

		return WebUtility.getResponse(ret, 200);
	}

	/**
	 * Authenticates a user with LDAP credentials.
	 * 
	 * @param request
	 * @return true if the information provided to log in is valid otherwise error.
	 */
	@POST
	@Produces("application/json")
	@Path("/loginLDAP")
	public Response loginLDAP(@Context HttpServletRequest request, @Context HttpServletResponse response) {
		Map<String, Object> ret = new HashMap<>();
		if (socialData.getLoginsAllowed().get("ldap") == null || !socialData.getLoginsAllowed().get("ldap")) {
			ret.put(Constants.ERROR_MESSAGE, "LDAP login is not allowed");
			UserAuditTrailUtils.recordLoginFailed(request.getParameter("username"), "LDAP",
					AuditErrorCode.LOGIN_METHOD_DISABLED, "LDAP login is not allowed", WebUtility.getClientIp(request),
					400);
			return WebUtility.getResponse(ret, 400);
		}

		ILdapAuthenticator authenticator = null;
		try {
			String username = WebUtility.inputSQLSanitizer(request.getParameter("username"));
			String password = WebUtility.inputSQLSanitizer(request.getParameter("password"));
			// so that the default is to redirect
			Boolean disableRedirect = Boolean.parseBoolean(request.getParameter("disableRedirect") + "");

			if (username == null || password == null || username.isEmpty() || password.isEmpty()) {
				ret.put(Constants.ERROR_MESSAGE, "The user name or password are empty");
				UserAuditTrailUtils.recordLoginFailed(username, "LDAP", AuditErrorCode.MISSING_CREDENTIALS,
						"The user name or password are empty", WebUtility.getClientIp(request), 401);
				return WebUtility.getResponse(ret, 401);
			}

			authenticator = socialData.getLdapAuthenticator();
			AccessToken authToken = authenticator.authenticate(username, password);
			if (authToken == null) {
				throw new IllegalArgumentException("Unable to parse any user attributes");
			}
			boolean autoAdd = Boolean
					.parseBoolean(socialData.getProperty(ILdapAuthenticator.LDAP + "auto_add", "true"));
			addAccessToken(authToken, request, autoAdd);
			ret.put("success", "true");
			ret.put("username", username);
			// log the log in
			if (!disableRedirect) {
				setMainPageRedirect(request, response);
			}
		} catch (LDAPPasswordChangeRequiredException e) {
			HttpSession session = request.getSession(false);
			if (session != null) {
				User user = (User) session.getAttribute(Constants.SESSION_USER);
				if (!AbstractSecurityUtils.anonymousUsersEnabled() && user != null && user.getLogins().isEmpty()) {
					session.invalidate();
				}
			}
			classLogger.error("Unexpected error in loginLDAP", e);
			ret.put(Constants.ERROR_MESSAGE, "User must change their password before login");
			ret.put(ILdapAuthenticator.LDAP_PASSWORD_CHANGE_RETURN_KEY, true);
			UserAuditTrailUtils.recordLoginFailed(request.getParameter("username"), "LDAP",
					AuditErrorCode.PASSWORD_CHANGE_REQUIRED, "User must change their password before login",
					WebUtility.getClientIp(request), 401);
			return WebUtility.getResponse(ret, 401);
		} catch (Exception e) {
			HttpSession session = request.getSession(false);
			if (session != null) {
				User user = (User) session.getAttribute(Constants.SESSION_USER);
				if (!AbstractSecurityUtils.anonymousUsersEnabled() && user != null && user.getLogins().isEmpty()) {
					session.invalidate();
				}
			}
			classLogger.error("Unexpected error in loginLDAP", e);
			ret.put(Constants.ERROR_MESSAGE, e.getMessage());
			UserAuditTrailUtils.recordLoginFailed(request.getParameter("username"), "LDAP",
					AuditErrorCode.INVALID_CREDENTIALS, e.getMessage(), WebUtility.getClientIp(request), 500);
			return WebUtility.getResponse(ret, 500);
		} finally {
			if (authenticator != null) {
				try {
					authenticator.close();
				} catch (IOException e) {
					classLogger.error("Unexpected error in loginLDAP", e);
				}
			}
		}

		return WebUtility.getResponse(ret, 200);
	}

	/**
	 * Changes an Active Directory user password.
	 * 
	 * @param request
	 * @return true if the information provided to log in is valid otherwise error.
	 */
	@POST
	@Produces("application/json")
	@Path("/changeADPassword")
	public Response changeADPassword(@Context HttpServletRequest request, @Context HttpServletResponse response) {
		Map<String, String> ret = new HashMap<>();
		if ((socialData.getLoginsAllowed().get("ldap") == null || !socialData.getLoginsAllowed().get("ldap"))
				&& !Boolean.parseBoolean(socialData.getProperty("linotp_check_ad", "false"))) {
			ret.put(Constants.ERROR_MESSAGE, "LDAP change password is not allowed/configured");
			return WebUtility.getResponse(ret, 400);
		}

		ILdapAuthenticator authenticator = null;
		try {
			String username = WebUtility.inputSQLSanitizer(request.getParameter("username"));
			String curPassword = WebUtility.inputSQLSanitizer(request.getParameter("curPassword"));
			String newPassword = WebUtility.inputSQLSanitizer(request.getParameter("newPassword"));

			if (username == null || curPassword == null || newPassword == null || username.isEmpty()
					|| curPassword.isEmpty() || newPassword.isEmpty()) {
				ret.put(Constants.ERROR_MESSAGE, "The user name, current password, or new password are empty");
				return WebUtility.getResponse(ret, 401);
			}

			authenticator = socialData.getLdapAuthenticator();
			authenticator.updateUserPassword(username, curPassword, newPassword);
			ret.put("success", "true");
			ret.put("username", username);
			return WebUtility.getResponse(ret, 200);
		} catch (Exception e) {
			HttpSession session = request.getSession(false);
			if (session != null) {
				User user = (User) session.getAttribute(Constants.SESSION_USER);
				if (!AbstractSecurityUtils.anonymousUsersEnabled() && user != null && user.getLogins().isEmpty()) {
					session.invalidate();
				}
			}
			classLogger.error("Unexpected error in changeADPassword", e);
			ret.put(Constants.ERROR_MESSAGE, e.getMessage());
			return WebUtility.getResponse(ret, 500);
		} finally {
			if (authenticator != null) {
				try {
					authenticator.close();
				} catch (IOException e) {
					classLogger.error("Unexpected error in changeADPassword", e);
				}
			}
		}
	}

	/**
	 * Authenticates a user by validating LinOTP one-time passcodes.
	 * 
	 * @param request
	 * @return true if the information provided to log in is valid otherwise error.
	 * @throws IOException
	 * @throws ClientProtocolException
	 */
	@POST
	@Produces("application/json")
	@Path("/loginLinOTP")
	public Response loginLinOTP(@Context HttpServletRequest request, @Context HttpServletResponse response)
			throws ClientProtocolException, IOException {
		Map<String, Object> returnMap = new HashMap<>();
		if (socialData.getLoginsAllowed().get("linotp") == null || !socialData.getLoginsAllowed().get("linotp")) {
			returnMap.put(Constants.ERROR_MESSAGE, "LinOTP login is not allowed");
			return WebUtility.getResponse(returnMap, 400);
		}

		String redirect = WebUtility.cleanHttpResponse(request.getParameter("redirect"));
		// so that the default is to redirect
		Boolean disableRedirect = Boolean.parseBoolean(request.getParameter("disableRedirect") + "");
		boolean autoAdd = Boolean.parseBoolean(socialData.getProperty("linotp_auto_add", "true"));

		LinOTPResponse linotpResponse = LinOTPUtil.login(request);
		returnMap = linotpResponse.getReturnMap();
		int responseCode = linotpResponse.getResponseCode();
		if (responseCode != 200) {
			// we just throw the error
			return WebUtility.getResponse(returnMap, responseCode);
		} else {
			// are we logged in?
			AccessToken token = linotpResponse.getToken();
			if (token == null) {
				// it is a 200 but we are not logged in
				// you likely need to enter otp in 2nd response
				return WebUtility.getResponse(returnMap, responseCode);
			}

			// we have a login
			addAccessToken(token, request, autoAdd);
			// log the log in
			if (!disableRedirect) {
				setMainPageRedirect(request, response, redirect);
			}

			return WebUtility.getResponse(returnMap, 200);
		}

	}

	/**
	 * Resets LinOTP failed-attempt counters for a user.
	 * 
	 * @param request
	 * @return true if the information provided to log in is valid otherwise error.
	 * @throws IOException
	 * @throws ClientProtocolException
	 */
	@POST
	@Produces("application/json")
	@Path("/resetLinOTPFailCounter")
	public Response resetLinOTPFailCounter(@Context HttpServletRequest request, @Context HttpServletResponse response)
			throws ClientProtocolException, IOException {
		try {
			LinOTPResponse linotpResponse = LinOTPUtil.resetCounter(request);
			Map<String, Object> returnMap = linotpResponse.getReturnMap();
			int responseCode = linotpResponse.getResponseCode();
			// this is simple, take response code and message and return
			return WebUtility.getResponse(returnMap, responseCode);
		} catch (Exception e) {
			classLogger.error("Unexpected error in resetLinOTPFailCounter", e);
			Map<String, Object> errorMessage = new HashMap<>();
			errorMessage.put(Constants.ERROR_MESSAGE,
					"Error occurred resetting the pin. Error message = " + e.getMessage());
			return WebUtility.getResponse(errorMessage, 500);
		}
	}

	/**
	 * Creates a native platform user. email)
	 * 
	 * @param request
	 * @return true if the user is created otherwise error.
	 */
	@POST
	@Produces("application/json")
	@Path("createUser")
	public Response createNativeUser(@Context HttpServletRequest request) {
		Map<String, String> ret = new HashMap<>();

		if (socialData.getLoginsAllowed().get("native") == null || !socialData.getLoginsAllowed().get("native")) {
			ret.put(Constants.ERROR_MESSAGE, "Native login is not allowed");
			return WebUtility.getResponse(ret, 400);
		}

		if (socialData.getLoginsAllowed().get("registration") == null
				|| !socialData.getLoginsAllowed().get("registration")) {
			ret.put(Constants.ERROR_MESSAGE, "Native registration is not allowed");
			return WebUtility.getResponse(ret, 400);
		}

		// get the connection to RDF_MAP.prop file to get the user default set values
		try {
			// Note - for native users
			// the id and the username are always the same
			String username = WebUtility.inputSQLSanitizer(request.getParameter("username"));
			String name = WebUtility.inputSQLSanitizer(request.getParameter("name"));
			String password = WebUtility.inputSQLSanitizer(request.getParameter("password"));
			String email = WebUtility.inputSQLSanitizer(request.getParameter("email"));
			String phone = WebUtility.inputSanitizer(request.getParameter("phone"));
			String phoneExtension = WebUtility.inputSanitizer(request.getParameter("phoneextension"));
			String countryCode = WebUtility.inputSanitizer(request.getParameter("countrycode"));

			AccessToken newUser = new AccessToken();

			newUser.setProvider(AuthProvider.NATIVE);
			newUser.setId(username);
			newUser.setUsername(username);
			newUser.setEmail(email);
			newUser.setName(name);
			newUser.setPhone(phone);
			newUser.setPhoneExtension(phoneExtension);
			newUser.setCountryCode(countryCode);

			// only admins set all-models defaults, so a registrant's limit fields are not
			// read and the user is saved with no default
			boolean userCreated = SecurityNativeUserUtils.addNativeUser(newUser, password);
			if (userCreated) {
				ret.put("success", "true");
				ret.put("username", username);
				return WebUtility.getResponse(ret, 200);
			} else {
				ret.put(Constants.ERROR_MESSAGE, "The user name or email aready exists.");
				return WebUtility.getResponse(ret, 400);
			}
		} catch (IllegalArgumentException iae) {
			classLogger.error("Unexpected error in createNativeUser", iae);
			ret.put(Constants.ERROR_MESSAGE, iae.getMessage());
			return WebUtility.getResponse(ret, 500);
		} catch (Exception e) {
			classLogger.error("Unexpected error in createNativeUser", e);
			ret.put(Constants.ERROR_MESSAGE, "An unexpected error happened. Please try again.");
			return WebUtility.getResponse(ret, 500);
		}
	}

	/**
	 * Creates an API user credential. email)
	 * 
	 * @param request
	 * @return true if the user is created otherwise error.
	 */
	@POST
	@Produces("application/json")
	@Path("createAPIUser")
	public Response createAPIUser(@Context HttpServletRequest request) {
		if (socialData.getLoginsAllowed().get("api_user") == null || !socialData.getLoginsAllowed().get("api_user")) {
			Map<String, String> ret = new HashMap<>();
			ret.put(Constants.ERROR_MESSAGE, "API User is not allowed for login");
			return WebUtility.getResponse(ret, 400);
		}

		if (Utility.getApplicationAdminOnlyCreateAPIUser()) {
			User user = (User) request.getSession().getAttribute(Constants.SESSION_USER);
			if (user == null) {
				Map<String, String> ret = new HashMap<>();
				ret.put(Constants.ERROR_MESSAGE, "No active session. Please login as an admin");
				return WebUtility.getResponse(ret, 401);
			}
			if (!SecurityAdminUtils.userIsAdmin(user)) {
				Map<String, String> ret = new HashMap<>();
				ret.put(Constants.ERROR_MESSAGE,
						"User is not an admin and does not have access. Please login as an admin");
				return WebUtility.getResponse(ret, 401);
			}
		}

		String name = WebUtility.inputSQLSanitizer(request.getParameter("name"));
		Map<String, String> oneTimeDetails = SecurityAPIUserUtils.createAPIUser(name);
		return WebUtility.getResponse(oneTimeDetails, 200);
	}

	//////////////////////////////////////////////////////////////////////

	/**
	 * Returns the map of enabled and disabled login providers. the FE
	 */

	@GET
	@Produces("application/json")
	@Path("/loginsAllowed/")
	public Response loginsAllowed(@Context HttpServletRequest request) {
		return WebUtility.getResponse(socialData.getLoginsAllowed(), 200);
	}

	/**
	 * Returns provider property values from social properties for admin users.
	 *
	 * @param request inbound HTTP request
	 * @return login-property map grouped by provider
	 */
	@GET
	@Produces("application/json")
	@Path("/loginProperties/")
	public Response loginProperties(@Context HttpServletRequest request) {
		User user = (User) request.getSession().getAttribute(Constants.SESSION_USER);
		if (user == null) {
			Map<String, String> ret = new HashMap<>();
			ret.put(Constants.ERROR_MESSAGE, "No user defined to access properties. Please login as an admin");
			return WebUtility.getResponse(ret, 401);
		}
		if (!SecurityAdminUtils.userIsAdmin(user)) {
			Map<String, String> ret = new HashMap<>();
			ret.put(Constants.ERROR_MESSAGE, "User is not an admin and does not have access. Please login as an admin");
			return WebUtility.getResponse(ret, 401);
		}

		// you have access - lets send all the info

		Map<String, Map<String, String>> loginApps = new TreeMap<>();

		Set<String> propSet = socialData.stringPropertyNames();
		for (String prop : propSet) {
			if (!prop.contains("_")) {
				// bad format
				// ignore
				continue;
			}
			String[] split = prop.toString().split("_", 2);
			String type = split[0];
			String type_key = split[1];

			if (!loginApps.containsKey(type)) {
				loginApps.put(type, new TreeMap<String, String>());
			}

			loginApps.get(type).put(type_key, socialData.getProperty(prop));
		}

		return WebUtility.getResponse(loginApps, 200);
	}

	/**
	 * Updates social properties for one provider.
	 *
	 * @param provider provider key
	 * @param form     form payload containing serialized modifications
	 * @param request  inbound HTTP request
	 * @return operation result
	 */
	@POST
	@Produces("application/json")
	@Path("/modifyLoginProperties/{provider}")
	public synchronized Response modifyLoginProperties(@PathParam("provider") String provider,
			MultivaluedMap<String, String> form, @Context HttpServletRequest request) {

		provider = WebUtility.inputSanitizer(provider);

		User user = (User) request.getSession().getAttribute(Constants.SESSION_USER);
		if (user == null) {
			return WebUtility.getResponse("No user defined to access properties. Please login as an admin", 400);
		}
		if (!SecurityAdminUtils.userIsAdmin(user)) {
			return WebUtility.getResponse("User is not an admin and does not have access. Please login as an admin",
					400);
		}

		Gson gson = new Gson();
		Map<String, String> mods = gson.fromJson(form.getFirst("modifications"), new TypeToken<Map<String, String>>() {
		}.getType());
		Map<String, String> sanitizedMods = new HashMap<>();

		for (String key : mods.keySet()) {
			sanitizedMods.put(WebUtility.inputSanitizer(key), WebUtility.inputSanitizer(mods.get(key)));
		}

		try {
			socialData.updateSocialProperties(provider, sanitizedMods);
		} catch (Exception e) {
			classLogger.error("Unexpected error in modifyLoginProperties", e);
			Map<String, String> errorRet = new HashMap<>();
			errorRet.put(Constants.ERROR_MESSAGE, e.getMessage());
			return WebUtility.getResponse(errorRet, 500);
		}
		// only the changed keys are audited; the values can be client secrets
		UserAuditTrailUtils.recordResourceEvent(user, AuditEventType.CONFIG_UPDATE, AuditTargetType.PLATFORM_CONFIG,
				"social.properties", provider, null, null, null,
				Map.of("provider", provider, "changedKeys", new ArrayList<>(sanitizedMods.keySet())));

		return WebUtility.getResponse(true, 200);
	}

	/**
	 * Replaces all social properties content.
	 *
	 * @param request inbound HTTP request
	 * @return operation result
	 */
	@POST
	@Produces("application/json")
	@Path("/modifyAllLoginProperties")
	public synchronized Response modifyAllLoginProperties(@Context HttpServletRequest request) {
		User user = (User) request.getSession().getAttribute(Constants.SESSION_USER);
		if (user == null) {
			return WebUtility.getResponse("No user defined to access properties. Please login as an admin", 400);
		}
		if (!SecurityAdminUtils.userIsAdmin(user)) {
			return WebUtility.getResponse("User is not an admin and does not have access. Please login as an admin",
					400);
		}

		String newSocialProperties = request.getParameter("socialProperties");
		try {
			socialData.updateAllProperties(newSocialProperties);
		} catch (Exception e) {
			classLogger.error("Unexpected error in modifyAllLoginProperties", e);
			Map<String, String> errorRet = new HashMap<>();
			errorRet.put(Constants.ERROR_MESSAGE, e.getMessage());
			return WebUtility.getResponse(errorRet, 500);
		}
		UserAuditTrailUtils.recordResourceEvent(user, AuditEventType.CONFIG_UPDATE, AuditTargetType.PLATFORM_CONFIG,
				"social.properties", "All login properties", null, null, null, Map.of("scope", "ALL"));

		return WebUtility.getResponse(true, 200);
	}

	/**
	 * Returns the full raw social-properties file content for admin users.
	 *
	 * @param request inbound HTTP request
	 * @return social-properties content response
	 */
	@GET
	@Produces("application/json")
	@Path("/getAllLoginProperties")
	public synchronized Response getAllLoginProperties(@Context HttpServletRequest request) {
		User user = (User) request.getSession().getAttribute(Constants.SESSION_USER);
		if (user == null) {
			return WebUtility.getResponse("No user defined to access properties. Please login as an admin", 400);
		}
		if (!SecurityAdminUtils.userIsAdmin(user)) {
			return WebUtility.getResponse("User is not an admin and does not have access. Please login as an admin",
					400);
		}

		try {
			String fileContent = socialData.getFileContents();
			Map<String, String> retMap = new HashMap<>();
			retMap.put("content", fileContent);
			return WebUtility.getResponse(retMap, 200);
		} catch (Exception e) {
			classLogger.error("Unexpected error in getAllLoginProperties", e);
			Map<String, String> errorRet = new HashMap<>();
			errorRet.put(Constants.ERROR_MESSAGE, e.getMessage());
			return WebUtility.getResponse(errorRet, 500);
		}
	}

	/**
	 * Redirects a successful login to the main app page or a stored custom
	 * redirect.
	 *
	 * @param request  inbound HTTP request
	 * @param response outbound HTTP response
	 */
	private void setMainPageRedirect(@Context HttpServletRequest request, @Context HttpServletResponse response) {
		String customRedirect = WebUtility.cleanHttpResponse(request.getParameter("redirect"));
		if (customRedirect == null || customRedirect.isEmpty()) {
			customRedirect = (String) request.getSession().getAttribute(CUSTOM_REDIRECT_SESSION_KEY);
			// also remove the attribute so additional logins dont do the redirect as well
			request.getSession().removeAttribute(CUSTOM_REDIRECT_SESSION_KEY);
		}
		setMainPageRedirect(request, response, customRedirect);
	}

	/**
	 * Redirects a successful login to the requested destination.
	 *
	 * @param request        inbound HTTP request
	 * @param response       outbound HTTP response
	 * @param customRedirect explicit redirect URL when provided
	 */
	private void setMainPageRedirect(@Context HttpServletRequest request, @Context HttpServletResponse response,
			String customRedirect) {
		// see if we have a location to redirect the user
		// if so, we will send them back to that URL
		// otherwise, we send them back to the FE
		HttpSession session = request.getSession();

		boolean useCustom = customRedirect != null && !customRedirect.isEmpty();
		boolean endpoint = session.getAttribute(Constants.ENDPOINT_REDIRECT_KEY) != null;
		response.setStatus(302);
		try {
			addSessionCookieHeader(request, response, session);
			if (useCustom) {
				response.addHeader("redirect", customRedirect);
				String encodedCustomRedirect = Encode.forHtml(customRedirect);
				response.sendError(302, "Need to redirect to " + encodedCustomRedirect);
			} else if (endpoint) {
				String redirectUrl = session.getAttribute(Constants.ENDPOINT_REDIRECT_KEY) + "";
				response.addHeader("redirect", redirectUrl);
				response.sendError(302, "Need to redirect to " + redirectUrl);
			} else {
				response.sendRedirect(socialData.getProperty("redirect"));
			}
		} catch (IOException e) {
			classLogger.error("Unexpected error in setMainPageRedirect", e);
		}
	}

	/**
	 * Adds the session cookie to the response directly, to allow for cross site
	 * login when the app is embedded as an iframe.
	 *
	 * @param request  inbound HTTP request
	 * @param response outbound HTTP response
	 * @param session  the logged in session
	 */
	private void addSessionCookieHeader(HttpServletRequest request, HttpServletResponse response, HttpSession session) {
		boolean secureRequest = "https".equalsIgnoreCase(WebUtility.getProtocol(request));
		String setCookieString = DBLoader.getSessionIdKey() + "=" + session.getId() + "; Path="
				+ request.getContextPath() + "; HttpOnly"
				+ ((ClusterUtil.IS_CLUSTER || secureRequest)
						? ("; Secure; SameSite=" + Utility.getSameSiteCookieValue())
						: "");
		response.addHeader("Set-Cookie", setCookieString);
	}

	//////////////////////////////////////////////////////////////////////

	/**
	 * Returns servlet-container principal details for the current request.
	 *
	 * @param request  inbound HTTP request
	 * @param response outbound HTTP response
	 * @return principal and group metadata payload
	 */
	@GET
	@Produces("application/json")
	@Path("/whoami")
	public Response show(@Context HttpServletRequest request, @Context HttpServletResponse response) {
		Principal principal = request.getUserPrincipal();
		Map<String, Object> output = new HashMap<>();
		if (principal != null) {
			output.put("name", principal.getName());
			if (principal instanceof WindowsPrincipal) {
				WindowsPrincipal windowsPrincipal = (WindowsPrincipal) principal;
				List<Map<String, Object>> gropus = new ArrayList<>();
				for (waffle.windows.auth.WindowsAccount account : windowsPrincipal.getGroups().values()) {
					Map<String, Object> m = new HashMap<>();
					m.put("name", account.getName());
					m.put("domain", account.getDomain());
					m.put("fqn", account.getFqn());
					m.put("sid", account.getSidString());
					gropus.add(m);
				}
				output.put("groups", gropus);
			}
		} else {
			HttpSession session = request.getSession(false);
			if (session != null) {
				User user = (User) session.getAttribute(Constants.SESSION_USER);
				if (user != null) {
					AccessToken token = user.getAccessToken(user.getPrimaryLogin());
					output.put("name", token.getId());
					output.put("warning", "null principal - grab from user");
				}
			}
			if (output.isEmpty()) {
				output.put(Constants.ERROR_MESSAGE, "null principal");
			}
		}
		return WebUtility.getResponse(output, 200);
	}

}