JAAS login loses GET parameters when using an auto-login hook

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 6.2.X EE, 7.0.0 DXP SP1, Master
• Fix Version/s: 6.2.X EE, 7.0.0 DXP FP8, 7.0.0 DXP SP2, 7.0.3 CE GA4, 7.1.X, Master
• Component/s: Application Security, Application Security > Auto Login
• Labels:
  • ee-ts
  • liferay-digital-enterprise-70-sp2
  • liferay-fixpack-de-8-7010
  • liferay-fixpack-portal-125-6210
• Branch Version/s:
  7.0.x, 6.2.x
• Backported to Branch:
  Committed
• Story Points: 1.5
• Fix Priority: 3
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/44220

Reproduction steps for master/7.0:

1. Set up a master on tomcat with JAAS:
   $CATALINA_HOME/conf/jaas.config

   PortalRealm {
           com.liferay.portal.security.jaas.PortalLoginModule required debug=true;
   };
   

   $CATALINA_HOME/bin/setenv.bat/sh

   # Add as new line
   CATALINA_OPTS="$CATALINA_OPTS -Djava.security.auth.login.config=$CATALINA_BASE/conf/jaas.config"
   

   portal-ext.properties

   company.security.auth.type=screenName
   portal.jaas.auth.type=screenName
   

   $CATALINA_BASE/conf/Catalina/localhost/ROOT.xml

   <Context path="" crossContext="true">
   
           <!-- JAAS -->
   
           <Realm
                   className="org.apache.catalina.realm.JAASRealm"
                   appName="PortalRealm"
                   userClassNames="com.liferay.portal.kernel.security.jaas.PortalPrincipal"
                   roleClassNames="com.liferay.portal.kernel.security.jaas.PortalRole"
                   useContextClassLoader="true"
           />
   </Context>
   

2. Enable JAAS through the portal-ext.properties file:

   portal.jaas.enable=true
   

3. Deploy attached custom-autologin module - put it into

   $LIFERAY_HOME/osgi/modules

4. In the default site, create a page named "protected", so that it has the following URL: http://localhost:8080/web/guest/protected
5. Log out and make a request to http://localhost:8080/web/guest/protected?one=1&two=2&three=3

Actual Result: Autologin takes place and you'll be on the http://localhost:8080/web/guest/protected?one=1 URL signed in as Test Test

Expected result: After autologin, user should arrive at http://localhost:8080/web/guest/protected?one=1&two=2&three=3