Cannot use query params with OIDC providers with no redirect_uri wildcard support

[p-kimberley]

According to the OAuth 2.0 spec, redirect URIs must be absolute (i.e. may not be fragments, so no wildcards).

Some providers support wildcards when defining redirect URIs for a particular client, while others do not.

Normally this isn't an issue, where the only URI entered by users in a browser is https://<stroom uri>/. However where query string parameters are used (like those used to open a dashboard), Stroom includes the entire URI (with the query string) in the redirect_uri parameter. This causes authentication requests against OIDC providers that don't support wildcards, to fail.

The general recommendation is for application state to be stored by the client against the unique state ID passed between the backend and the IDP. Currently this is done and the stored URI is used for the final post-auth redirect and the value of redirect_uri.

A potential fix is to strip the query string from the redirect_uri parameter sent to the authorisation endpoint. This will ensure that IDPs without wildcard support, will permit the value of redirect_uri (sans query string).