SEC-1349: Allow configuration of OpenID with parameters which should be transferred to the return_to URL.

The OpenIDAuthenticationFilter now has a returnToUrlParameters property (a Set). If this is set, the named parameters will be copied from the incoming submitted request to the return_to URL. If not set, it defaults to the "parameter" property of the AbstractRememberMeServices of the parent class. If remember-me is not in use, it defaults to the empty set.

Enabled remember-me in the OpenID sample.

web/src/main/java/org/springframework/security/web/authentication/rememberme/AbstractRememberMeServices.java

@@ -165,7 +165,17 @@ public abstract class AbstractRememberMeServices implements RememberMeServices,
 
         String cookieAsPlainText = new String(Base64.decode(cookieValue.getBytes()));
 
-        return StringUtils.delimitedListToStringArray(cookieAsPlainText, DELIMITER);
+        String[] tokens = StringUtils.delimitedListToStringArray(cookieAsPlainText, DELIMITER);
+
+        if (tokens[0].equalsIgnoreCase("http") && tokens[1].startsWith("//")) {
+            // Assume we've accidentally split a URL (OpenID identifier)
+            String[] newTokens = new String[tokens.length - 1];
+            newTokens[0] = "http:" + tokens[1];
+            System.arraycopy(tokens, 2, newTokens, 1, newTokens.length - 1);
+            tokens = newTokens;
+        }
+
+        return tokens;
     }
 
     /**

web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLoginPageGeneratingFilter.java

@@ -147,7 +147,7 @@ public class DefaultLoginPageGeneratingFilter extends GenericFilterBean {
             sb.append("    <tr><td>Identity:</td><td><input type='text' name='");
             sb.append(openIDusernameParameter).append("'/></td></tr>\n");
 
-            if (rememberMeParameter != null) {
+            if (openIDrememberMeParameter != null) {
                 sb.append("    <tr><td><input type='checkbox' name='").append(openIDrememberMeParameter).append("'></td><td>Remember me on this computer.</td></tr>\n");
             }
 

web/src/test/java/org/springframework/security/web/authentication/rememberme/AbstractRememberMeServicesTests.java

@@ -35,7 +35,7 @@ public class AbstractRememberMeServicesTests {
 
     @Test
     public void cookieShouldBeCorrectlyEncodedAndDecoded() {
-        String[] cookie = new String[] {"the", "cookie", "tokens", "blah"};
+        String[] cookie = new String[] {"http://name", "cookie", "tokens", "blah"};
         MockRememberMeServices services = new MockRememberMeServices();
 
         String encoded = services.encodeCookie(cookie);
@@ -44,7 +44,7 @@ public class AbstractRememberMeServicesTests {
         String[] decoded = services.decodeCookie(encoded);
 
         assertEquals(4, decoded.length);
-        assertEquals("the", decoded[0]);
+        assertEquals("http://name", decoded[0]);
         assertEquals("cookie", decoded[1]);
         assertEquals("tokens", decoded[2]);
         assertEquals("blah", decoded[3]);