Rails OAuth2系统中SAML认证的会话丢失与user_redirect_to为空问题

方案1：基于Doorkeeper授权请求的状态关联存储 #

Doorkeeper处理/oauth/authorize请求时会生成关联授权上下文的state参数，可利用此机制将跳转地址绑定到授权请求记录，替代session存储：

1. 修改Doorkeeper授权控制器，跳转SAML登录前保存跳转地址到授权记录：

# app/controllers/doorkeeper/authorizations_controller.rb
class Doorkeeper::AuthorizationsController < Doorkeeper::ApplicationController
  def new
    if pre_auth.authorizable?
      if current_user
        authorize_response
      else
        # 存储跳转地址到Doorkeeper授权记录
        authorization = Doorkeeper::Authorization.create(
          client_id: pre_auth.client.id,
          redirect_uri: pre_auth.redirect_uri,
          response_type: pre_auth.response_type,
          scope: pre_auth.scope,
          state: pre_auth.state,
          user_redirect_to: session['user_redirect_to']
        )
        # 加密授权记录ID后传给SAML登录
        encrypted_auth_id = encrypt(authorization.id.to_s)
        redirect_to user_saml_omniauth_authorize_path(auth_id: encrypted_auth_id)
      end
    else
      render :error
    end
  end

  private
  # 用Rails自带加密工具实现加解密
  def encrypt(value)
    ActiveSupport::MessageEncryptor.new(Rails.application.credentials.secret_key_base.byteslice(0..31)).encrypt_and_sign(value)
  end
end

2. SAML回调控制器中恢复跳转地址：

# app/controllers/users/omniauth_callbacks_controller.rb
class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
  def saml
    @user = User.from_omniauth(request.env["omniauth.auth"])
    if @user.persisted?
      # 解密获取授权记录ID，恢复跳转地址
      auth_id = decrypt(params[:auth_id])
      authorization = Doorkeeper::Authorization.find_by(id: auth_id)
      if authorization
        session['user_redirect_to'] = authorization.user_redirect_to
        authorization.destroy # 一次性使用，避免重复触发
        sign_in_and_redirect @user, event: :authentication
      else
        redirect_to root_path
      end
    else
      redirect_to new_user_registration_path
    end
  end

  private
  def decrypt(value)
    ActiveSupport::MessageEncryptor.new(Rails.application.credentials.secret_key_base.byteslice(0..31)).decrypt_and_verify(value)
  end
end

方案2：修复SAML认证的会话保持配置 #

会话丢失常与Cookie设置或OmniAuth配置有关，可从以下方向排查：

• 调整Rails Cookie配置：确保跨域跳转时会话Cookie不丢失：

# config/initializers/session_store.rb
Rails.application.config.session_store :cookie_store, 
  key: '_your_app_session', 
  same_site: :none, # 跨域场景需设为none
  secure: Rails.env.production?, # 配合none必须开启HTTPS
  httponly: true

• 优化OmniAuth SAML配置：开启会话状态保留：

# config/initializers/omniauth.rb
Rails.application.config.middleware.use OmniAuth::Builder do
  provider :saml, {
    # 其他SAML配置（Azure元数据、实体ID等）
    callback_path: '/users/auth/saml/callback',
    provider_ignores_state: false, # 保留state参数关联会话
    uid_attribute: 'nameID'
  }
end

方案3：加密临时存储保存跳转地址 #

通过数据库或Redis创建临时存储表，用加密token关联跳转地址：

1. 创建临时存储模型：

# app/models/temporary_redirect.rb
class TemporaryRedirect < ApplicationRecord
  validates :token, :redirect_url, presence: true
  default_scope -> { where('created_at > ?', 15.minutes.ago) } # 自动清理过期记录
end

2. 跳转SAML前生成加密token：

# 在登录跳转逻辑中
token = SecureRandom.urlsafe_base64
encrypted_token = encrypt(token)
TemporaryRedirect.create(token: token, redirect_url: session['user_redirect_to'])
redirect_to user_saml_omniauth_authorize_path(redirect_token: encrypted_token)

3. SAML回调时恢复跳转地址：

# 回调控制器中
encrypted_token = params[:redirect_token]
token = decrypt(encrypted_token)
temp_redirect = TemporaryRedirect.find_by(token: token)
if temp_redirect
  session['user_redirect_to'] = temp_redirect.redirect_url
  temp_redirect.destroy
  sign_in_and_redirect @user, event: :authentication
else
  redirect_to root_path
end

核心注意事项 #

• 所有传递的参数必须加密，避免敏感信息泄露
• 临时存储记录需设置过期时间，防止数据冗余
• 确认Azure SAML回调URL与Rails应用配置完全一致，避免跨域会话拦截

内容的提问来源于stack exchange，提问作者Nijeesh Joshy