After OAUTH, SAML auth completion, Redirect to App custom url scheme with token data as query params. (#16447)

* Added redirection after Auth complete

* Fixed gofmt

* Handling error while parsing the url, added util function to check for a valid mobile redirect url

* Added check for custom scheme url validation

* Added test to verify custom schele url

* Added mobile message screens

* Translation strings for mobile screens

* Added mobile specific screens for success and error

* Added error logs and changed variable name for consistency with oauth.go

* i18n fix

* Reusing assigned variable instead of map

* Added AppCustomUrlScheme property

* Code refactor and removed dependency from cookies to build the final url

* Changed util function

* Updated util test

* Fixed go lint

* Code refactor and unsused code removed

* Code refactor

* simplified boolean checks

* Added support of whitelist of appCustomURLSchemes

* Changed i18 en

* Fixed validating redirecturl for web

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>

web/saml.go

@@ -12,6 +12,7 @@ import (
 	"github.com/mattermost/mattermost-server/v5/audit"
 	"github.com/mattermost/mattermost-server/v5/mlog"
 	"github.com/mattermost/mattermost-server/v5/model"
+	"github.com/mattermost/mattermost-server/v5/utils"
 )
 
 func (w *Web) InitSaml() {
@@ -34,7 +35,7 @@ func loginWithSaml(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 	action := r.URL.Query().Get("action")
 	isMobile := action == model.OAUTH_ACTION_MOBILE
-	redirectTo := r.URL.Query().Get("redirect_to")
+	redirectURL := r.URL.Query().Get("redirect_to")
 	relayProps := map[string]string{}
 	relayState := ""
 
@@ -46,8 +47,13 @@ func loginWithSaml(c *Context, w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	if redirectTo != "" {
-		relayProps["redirect_to"] = redirectTo
+	if redirectURL != "" {
+		if isMobile && !utils.IsValidMobileAuthRedirectURL(c.App.Config(), redirectURL) {
+			invalidSchemeErr := model.NewAppError("loginWithOAuth", "api.invalid_custom_url_scheme", nil, "", http.StatusBadRequest)
+			utils.RenderMobileError(c.App.Config(), w, invalidSchemeErr, redirectURL)
+			return
+		}
+		relayProps["redirect_to"] = redirectURL
 	}
 
 	relayProps[model.USER_AUTH_SERVICE_IS_MOBILE] = strconv.FormatBool(isMobile)
@@ -96,22 +102,39 @@ func completeSaml(c *Context, w http.ResponseWriter, r *http.Request) {
 	action := relayProps["action"]
 	auditRec.AddMeta("action", action)
 
-	user, err := samlInterface.DoLogin(encodedXML, relayProps)
-	if err != nil {
-		c.LogAudit("fail")
-		if action == model.OAUTH_ACTION_MOBILE {
+	isMobile := action == model.OAUTH_ACTION_MOBILE
+	redirectURL := ""
+	hasRedirectURL := false
+	if val, ok := relayProps["redirect_to"]; ok {
+		redirectURL = val
+		hasRedirectURL = len(val) > 0
+	}
+
+	handleError := func(err *model.AppError) {
+		if isMobile {
 			err.Translate(c.App.T)
-			w.Write([]byte(err.ToJson()))
+			if hasRedirectURL {
+				utils.RenderMobileError(c.App.Config(), w, err, redirectURL)
+			} else {
+				w.Write([]byte(err.ToJson()))
+			}
 		} else {
 			c.Err = err
 			c.Err.StatusCode = http.StatusFound
 		}
+	}
+
+	user, err := samlInterface.DoLogin(encodedXML, relayProps)
+	if err != nil {
+		c.LogAudit("fail")
+		mlog.Error(err.Error())
+		handleError(err)
 		return
 	}
 
 	if err = c.App.CheckUserAllAuthenticationCriteria(user, ""); err != nil {
-		c.Err = err
-		c.Err.StatusCode = http.StatusFound
+		mlog.Error(err.Error())
+		handleError(err)
 		return
 	}
 
@@ -143,13 +166,10 @@ func completeSaml(c *Context, w http.ResponseWriter, r *http.Request) {
 	auditRec.AddMeta("obtained_user_id", user.Id)
 	c.LogAuditWithUserId(user.Id, "obtained user")
 
-	isMobile, parseErr := strconv.ParseBool(relayProps[model.USER_AUTH_SERVICE_IS_MOBILE])
-	if parseErr != nil {
-		mlog.Warn("Error parsing boolean property from relay props", mlog.Err(parseErr))
-	}
 	err = c.App.DoLogin(w, r, user, "", isMobile, false, true)
 	if err != nil {
-		c.Err = err
+		mlog.Error(err.Error())
+		handleError(err)
 		return
 	}
 
@@ -158,12 +178,23 @@ func completeSaml(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	c.App.AttachSessionCookies(w, r)
 
-	if val, ok := relayProps["redirect_to"]; ok {
-		http.Redirect(w, r, c.GetSiteURLHeader()+val, http.StatusFound)
+	if hasRedirectURL {
+		if isMobile {
+			// Mobile clients with redirect url support
+			redirectURL = utils.AppendQueryParamsToURL(redirectURL, map[string]string{
+				model.SESSION_COOKIE_TOKEN: c.App.Session().Token,
+				model.SESSION_COOKIE_CSRF:  c.App.Session().GetCSRF(),
+			})
+			utils.RenderMobileAuthComplete(w, redirectURL)
+		} else {
+			redirectURL = c.GetSiteURLHeader() + redirectURL
+			http.Redirect(w, r, redirectURL, http.StatusFound)
+		}
 		return
 	}
 
 	switch action {
+	// Mobile clients with web view implementation
 	case model.OAUTH_ACTION_MOBILE:
 		ReturnStatusOK(w)
 	case model.OAUTH_ACTION_EMAIL_TO_SSO: