20300: Fix login callback redirect.

Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tom@curii.com>

diff --git a/lib/controller/federation_test.go b/lib/controller/federation_test.go
index 4fbb3440ed377103da603db406d2c4b29eeacd63..599686e3e6cc64866793114839f4167605328f86 100644 (file)
--- a/lib/controller/federation_test.go
+++ b/lib/controller/federation_test.go
@@ -707,7 +707,7 @@ func (s *FederationSuite) TestCreateRemoteContainerRequestCheckRuntimeToken(c *c
        s.testHandler.Cluster.API.MaxTokenLifetime = arvados.Duration(time.Hour)
 
        resp := s.testRequest(req).Result()
-       c.Check(resp.StatusCode, check.Equals, http.StatusOK)
+       c.Assert(resp.StatusCode, check.Equals, http.StatusOK)
 
        cr := s.getCRfromMockRequest(c)
 

diff --git a/services/api/app/controllers/user_sessions_controller.rb b/services/api/app/controllers/user_sessions_controller.rb
index ae34fa76006aabe6c7866cee09d8249f58254567..1a9cc797fc8d3212fccc4b08984cd9db4e691d24 100644 (file)
--- a/services/api/app/controllers/user_sessions_controller.rb
+++ b/services/api/app/controllers/user_sessions_controller.rb
@@ -105,13 +105,12 @@ class UserSessionsController < ApplicationController
     if params[:remote] !~ /^[0-9a-z]{5}$/ && !params[:remote].nil?
       return send_error 'Invalid remote cluster id', status: 400
     end
-    if current_user and params[:return_to]
+    if current_user && params[:return_to] == "https://controller.api.client.invalid"
       # Already logged in; just need to send a token to the requesting
-      # API client.
-      #
-      # FIXME: if current_user has never authorized this app before,
-      # ask for confirmation here!
-
+      # API client. Note, although this response looks like it's meant
+      # to be sent to a web browser, in fact the only supported use
+      # case is where our client is arvados-controller, giving us the
+      # placeholder URL https://controller.api.client.invalid.
       return send_api_token_to(params[:return_to], current_user, params[:remote])
     end
     p = []
@@ -173,7 +172,7 @@ class UserSessionsController < ApplicationController
       token = @api_client_auth.salted_token(remote: remote)
     end
     callback_url += 'api_token=' + token
-    redirect_to callback_url
+    redirect_to callback_url, allow_other_host: true
   end
 
   def cross_origin_forbidden