fix #582

src/main/java/org/codelibs/fess/app/web/base/login/ActionLoginCredential.java

@@ -16,16 +16,15 @@
 package org.codelibs.fess.app.web.base.login;
 
 import java.util.Collections;
-import java.util.function.Function;
+import java.util.function.Supplier;
 
-import org.codelibs.fess.app.web.sso.SsoAction;
 import org.lastaflute.web.response.ActionResponse;
 
 public class ActionLoginCredential implements LoginCredential {
 
-    private final Function<SsoAction, ActionResponse> action;
+    private final Supplier<ActionResponse> action;
 
-    public ActionLoginCredential(final Function<SsoAction, ActionResponse> action) {
+    public ActionLoginCredential(final Supplier<ActionResponse> action) {
         this.action = action;
     }
 
@@ -43,7 +42,7 @@ public class ActionLoginCredential implements LoginCredential {
         return Collections.emptyMap();
     }
 
-    public ActionResponse execute(final SsoAction a) {
-        return action.apply(a);
+    public ActionResponse execute() {
+        return action.get();
     }
 }

src/main/java/org/codelibs/fess/app/web/sso/SsoAction.java

@@ -51,7 +51,7 @@ public class SsoAction extends FessLoginAction {
             }
             return redirect(LoginAction.class);
         } else if (loginCredential instanceof ActionLoginCredential) {
-            return ((ActionLoginCredential) loginCredential).execute(this);
+            return ((ActionLoginCredential) loginCredential).execute();
         }
         try {
             return fessLoginAssist.loginRedirect(loginCredential, op -> {}, () -> {
@@ -68,8 +68,4 @@ public class SsoAction extends FessLoginAction {
             return redirect(LoginAction.class);
         }
     }
-
-    public ActionResponse redirect(final String url) {
-        return HtmlResponse.fromRedirectPathAsIs(url);
-    }
 }

src/main/java/org/codelibs/fess/sso/oic/OpenIdConnectAuthenticator.java

@@ -32,6 +32,7 @@ import org.codelibs.fess.crawler.Constants;
 import org.codelibs.fess.mylasta.direction.FessConfig;
 import org.codelibs.fess.sso.SsoAuthenticator;
 import org.codelibs.fess.util.ComponentUtil;
+import org.lastaflute.web.response.HtmlResponse;
 import org.lastaflute.web.util.LaRequestUtil;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -64,8 +65,8 @@ public class OpenIdConnectAuthenticator implements SsoAuthenticator {
             final HttpSession session = request.getSession(false);
             if (session != null) {
                 final String sesState = (String) session.getAttribute(OIC_STATE);
-                session.removeAttribute(OIC_STATE);
                 if (StringUtil.isNotBlank(sesState)) {
+                    session.removeAttribute(OIC_STATE);
                     final String code = request.getParameter("code");
                     final String reqState = request.getParameter("state");
                     if (sesState.equals(reqState) && StringUtil.isNotBlank(code)) {
@@ -78,7 +79,7 @@ public class OpenIdConnectAuthenticator implements SsoAuthenticator {
                 }
             }
 
-            return new ActionLoginCredential(action -> action.redirect(getAuthUrl(request)));
+            return new ActionLoginCredential(() -> HtmlResponse.fromRedirectPathAsIs(getAuthUrl(request)));
         }).orElse(null);
     }
 

src/main/java/org/codelibs/fess/sso/spnego/SpnegoAuthenticator.java

@@ -86,7 +86,7 @@ public class SpnegoAuthenticator implements SsoAuthenticator {
 
                     // context/auth loop not yet complete
                     if (spnegoResponse.isStatusSet()) {
-                        return new ActionLoginCredential(action -> {
+                        return new ActionLoginCredential(() -> {
                             throw new RequestLoggingFilter.RequestClientErrorException("Your request is not authorized.",
                                     "401 Unauthorized", HttpServletResponse.SC_UNAUTHORIZED);
                         });

src/main/resources/fess_sso.xml

@@ -7,5 +7,7 @@
 
 	<component name="spnegoAuthenticator" class="org.codelibs.fess.sso.spnego.SpnegoAuthenticator">
 	</component>
+	<component name="oicAuthenticator" class="org.codelibs.fess.sso.oic.OpenIdConnectAuthenticator">
+	</component>
 
 </components>