Update pac4j to 5.2.0

[Riliane]

See JENKINS-69462.

This needs jenkins-infra/helpdesk#3108 to successfully be built - now it will fail because of the shibboleth artifacts.
Now that we are dropping Java 8 we can update pac4j further.

Submitter checklist

• JIRA issue is well described
• Appropriate autotests or explanation to why this change has no tests

[kuisathaverat]

I am preparing the plugin for update pac4j, first I have to merge #261

[kuisathaverat]

I have resolved the conflicts and updated the major version

[kuisathaverat]

I will try to make some manual testing, If I do not see anything weird, I would merge and release a new version.

[kuisathaverat]

Summary of my tests, there is an error in the redirections 302 code is not correctly processed. The version of pac4j used is not the latest, is from about a year ago, it is possible to update to the latest with minor changes.

I have added comments with the changes needed to fix the 302 redirections and bump the pac4j version to 5.4.6

I have used this environment to test the incremental https://github.com/kuisathaverat/jenkins-issues/tree/main/test-pac4j-5, it is possible to test new binaries if you copy the saml.hpi file as test-pac4j-5/jenkins/jenkins_home/plugins/saml.jpi

[Riliane]

committed suggestions to pull them but still got things to fix (JEESessionStore)

[kuisathaverat]

tested Manually

[jkbszpg]

the new pac4j-saml 5.4.6, requires an Optional "Destination" field in the SAML response to be present unless disabled with a setting

cfg.setResponseDestinationAttributeMandatory(false);

pac4j/pac4j#1871

resulting in

WARNING o.j.p.saml.SamlSecurityRealm#doFinishLogin: Unable to validate the SAML Response: SAML configuration does not allow response Destination to be null
For more info check 'Maximum Authentication Lifetime' at https://github.com/jenkinsci/saml-plugin/blob/master/doc/CONFIGURE.md#configuring-plugin-settings
If you have issues check the troubleshoting guide at https://github.com/jenkinsci/saml-plugin/blob/master/doc/TROUBLESHOOTING.md
org.pac4j.saml.exceptions.SAMLEndpointMismatchException: SAML configuration does not allow response Destination to be null
        at org.pac4j.saml.profile.impl.AbstractSAML2ResponseValidator.verifyEndpoint(AbstractSAML2ResponseValidator.java:204)
        at org.pac4j.saml.sso.impl.SAML2AuthnResponseValidator.validateSamlProtocolResponse(SAML2AuthnResponseValidator.java:247)
        at org.pac4j.saml.sso.impl.SAML2AuthnResponseValidator.validate(SAML2AuthnResponseValidator.java:91)
        at org.pac4j.saml.profile.impl.AbstractSAML2MessageReceiver.receiveMessage(AbstractSAML2MessageReceiver.java:53)
        at org.pac4j.saml.sso.impl.SAML2WebSSOProfileHandler.receive(SAML2WebSSOProfileHandler.java:35)
        at org.pac4j.saml.credentials.extractor.SAML2CredentialsExtractor.receiveLogin(SAML2CredentialsExtractor.java:71)
        at org.pac4j.saml.credentials.extractor.SAML2CredentialsExtractor.extract(SAML2CredentialsExtractor.java:66)
        at org.pac4j.core.client.BaseClient.retrieveCredentials(BaseClient.java:71)
        at org.pac4j.core.client.IndirectClient.getCredentials(IndirectClient.java:145)
        at org.jenkinsci.plugins.saml.SamlProfileWrapper.process(SamlProfileWrapper.java:56)
Caused: org.springframework.security.authentication.BadCredentialsException: SAML configuration does not allow response Destination to be null
        at org.jenkinsci.plugins.saml.SamlProfileWrapper.process(SamlProfileWrapper.java:61)
        at org.jenkinsci.plugins.saml.SamlProfileWrapper.process(SamlProfileWrapper.java:35)

is there a way for saml-plugin to pass this config through?

[Palmer-Reed-bah]

@kuisathaverat, we are also seeing the above issue when upgrading to the latest SAML plugin version.

[kuisathaverat]

@jkbszpg @rdpa-bah I am not subscribed to PR (so comments here would not arrive in my inbox). I will take a look. It is simple to add that option. To file an issue, there is a Jira instance https://issues.jenkins.io/browse/, and for questions and so on, there are several groups. Please check https://www.jenkins.io/participate/report-issue/