[KEYCLOAK-18559] Fix SAML adapters so they allow unescaped characters in URIs

- Makes adapters bahavior consistent with containers that allow unescaped characters in URIs

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/OAuthRequestAuthenticator.java

@@ -151,7 +151,7 @@ public class OAuthRequestAuthenticator {
             }
             KeycloakUriBuilder secureUrl = KeycloakUriBuilder.fromUri(url).scheme("https").port(-1);
             if (port != 443) secureUrl.port(port);
-            url = secureUrl.build().toString();
+            url = secureUrl.buildAsString();
         }
 
         String loginHint = getQueryParamValue("login_hint");
@@ -197,7 +197,7 @@ public class OAuthRequestAuthenticator {
         scope = TokenUtil.attachOIDCScope(scope);
         redirectUriBuilder.queryParam(OAuth2Constants.SCOPE, scope);
 
-        return redirectUriBuilder.build().toString();
+        return redirectUriBuilder.buildAsString();
     }
 
     protected int sslRedirectPort() {
@@ -385,7 +385,7 @@ public class OAuthRequestAuthenticator {
                 .replaceQueryParam(OAuth2Constants.CODE, null)
                 .replaceQueryParam(OAuth2Constants.STATE, null)
                 .replaceQueryParam(OAuth2Constants.SESSION_STATE, null);
-        return builder.build().toString();
+        return builder.buildAsString();
     }
     
     private String rewrittenRedirectUri(String originalUri) {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/ServerRequest.java

@@ -292,7 +292,7 @@ public class ServerRequest {
         KeycloakUriBuilder builder = KeycloakUriBuilder.fromUri(uri)
                 .replaceQueryParam(OAuth2Constants.CODE, null)
                 .replaceQueryParam(OAuth2Constants.STATE, null);
-        return builder.build().toString();
+        return builder.buildAsString();
     }
 
 

adapters/saml/undertow/src/main/java/org/keycloak/adapters/saml/undertow/ServletSamlSessionStore.java

@@ -230,7 +230,7 @@ public class ServletSamlSessionStore implements SamlSessionStore {
         KeycloakUriBuilder uriBuilder = KeycloakUriBuilder.fromUri(exchange.getRequestURI())
                 .replaceQuery(exchange.getQueryString());
         if (!exchange.isHostIncludedInRequestURI()) uriBuilder.scheme(exchange.getRequestScheme()).host(exchange.getHostAndPort());
-        String uri = uriBuilder.build().toString();
+        String uri = uriBuilder.buildAsString();
 
         session.setAttribute(SAML_REDIRECT_URI, uri);
 

adapters/saml/wildfly-elytron/src/main/java/org/keycloak/adapters/saml/elytron/ElytronSamlSessionStore.java

@@ -212,11 +212,7 @@ public class ElytronSamlSessionStore implements SamlSessionStore, ElytronTokeSto
         if (!scope.exists()) {
             scope.create();
         }
-
+        scope.setAttachment(SAML_REDIRECT_URI, exchange.getRequest().getURI());
-        KeycloakUriBuilder uriBuilder = KeycloakUriBuilder.fromUri(exchange.getURI()).replaceQuery(exchange.getURI().getQuery());
-        String uri = uriBuilder.build().toString();
-
-        scope.setAttachment(SAML_REDIRECT_URI, uri);
     }
 
     @Override

adapters/spi/undertow-adapter-spi/src/main/java/org/keycloak/adapters/undertow/UndertowHttpFacade.java

@@ -96,7 +96,7 @@ public class UndertowHttpFacade implements HttpFacade {
             KeycloakUriBuilder uriBuilder = KeycloakUriBuilder.fromUri(exchange.getRequestURI())
                     .replaceQuery(exchange.getQueryString());
             if (!exchange.isHostIncludedInRequestURI()) uriBuilder.scheme(exchange.getRequestScheme()).host(exchange.getHostAndPort());
-            return uriBuilder.build().toString();
+            return uriBuilder.buildAsString();
         }
 
         @Override

common/src/main/java/org/keycloak/common/util/KeycloakUriBuilder.java

@@ -571,28 +571,33 @@ public class KeycloakUriBuilder {
         return buildFromValues(true, false, values);
     }
 
+    public String buildAsString(Object... values) throws IllegalArgumentException {
+        if (values == null) throw new IllegalArgumentException("values parameter is null");
+        return buildFromValuesAsString(true, false, values);
+    }
+
     protected URI buildFromValues(boolean encodeSlash, boolean encoded, Object... values) {
+        String buf = buildFromValuesAsString(encodeSlash, encoded, values);
+        try {
+            return new URI(buf);
+        } catch (Exception e) {
+            throw new RuntimeException("Failed to create URI: " + buf, e);
+        }
+    }
+
+    protected String buildFromValuesAsString(boolean encodeSlash, boolean encoded, Object... values) {
         List<String> params = getPathParamNamesInDeclarationOrder();
         if (values.length < params.size())
             throw new IllegalArgumentException("You did not supply enough values to fill path parameters");
 
         Map<String, Object> pathParams = new HashMap<String, Object>();
-
-
         for (int i = 0; i < params.size(); i++) {
             String pathParam = params.get(i);
             Object val = values[i];
             if (val == null) throw new IllegalArgumentException("A value was null");
             pathParams.put(pathParam, val.toString());
         }
-        String buf = null;
+        return buildString(pathParams, encoded, false, encodeSlash);
-        try {
-            buf = buildString(pathParams, encoded, false, encodeSlash);
-            return new URI(buf);
-            //return URI.create(buf);
-        } catch (Exception e) {
-            throw new RuntimeException("Failed to create URI: " + buf, e);
-        }
     }
 
     public KeycloakUriBuilder matrixParam(String name, Object... values) throws IllegalArgumentException {

core/src/main/java/org/keycloak/AbstractOAuthClient.java

@@ -130,7 +130,7 @@ public class AbstractOAuthClient {
         KeycloakUriBuilder builder = KeycloakUriBuilder.fromUri(uri)
                 .replaceQueryParam(OAuth2Constants.CODE, null)
                 .replaceQueryParam(OAuth2Constants.STATE, null);
-        return builder.build().toString();
+        return builder.buildAsString();
     }
 
 }