handle public edge component URL in settings

crates/defguard_common/src/db/models/settings.rs

@@ -10,7 +10,7 @@ use url::Url;
 use utoipa::ToSchema;
 use uuid::Uuid;
 
-use crate::{db::Id, global_value, secret::SecretStringWrapper};
+use crate::{db::Id, global_value, secret::SecretStringWrapper, types::AuthFlowType};
 
 global_value!(SETTINGS, Option<Settings>, None, set_settings, get_settings);
 
@@ -529,6 +529,19 @@ impl Settings {
     pub fn proxy_public_url(&self) -> Result<Url, url::ParseError> {
         Url::parse(&self.public_proxy_url)
     }
+
+    /// Returns configured Edge Component URL with the correct callback path appended depending on auth flow type.
+    pub fn edge_callback_url(&self, auth_flow_type: AuthFlowType) -> Result<Url, url::ParseError> {
+        let mut url = self.proxy_public_url()?;
+        // Append callback segments to the URL.
+        if let Ok(mut path_segments) = url.path_segments_mut() {
+            match auth_flow_type {
+                AuthFlowType::Enrollment => path_segments.extend(&["openid", "callback"]),
+                AuthFlowType::Mfa => path_segments.extend(&["openid", "mfa", "callback"]),
+            };
+        }
+        Ok(url)
+    }
 }
 
 #[derive(Serialize)]
@@ -676,4 +689,35 @@ mod test {
             "https://defguard.example.com:8443/path/auth/callback"
         );
     }
+
+    #[test]
+    fn test_edge_callback_url() {
+        let mut s = Settings {
+            public_proxy_url: "https://edge.example.com".into(),
+            ..Default::default()
+        };
+
+        assert_eq!(
+            s.edge_callback_url(AuthFlowType::Enrollment)
+                .unwrap()
+                .as_str(),
+            "https://edge.example.com/openid/callback"
+        );
+        assert_eq!(
+            s.edge_callback_url(AuthFlowType::Mfa).unwrap().as_str(),
+            "https://edge.example.com/openid/mfa/callback"
+        );
+
+        s.public_proxy_url = "https://edge.example.com:8443/path".into();
+        assert_eq!(
+            s.edge_callback_url(AuthFlowType::Enrollment)
+                .unwrap()
+                .as_str(),
+            "https://edge.example.com:8443/path/openid/callback"
+        );
+        assert_eq!(
+            s.edge_callback_url(AuthFlowType::Mfa).unwrap().as_str(),
+            "https://edge.example.com:8443/path/openid/mfa/callback"
+        );
+    }
 }

crates/defguard_common/src/types/mod.rs

@@ -3,3 +3,9 @@ pub mod proxy;
 pub mod user_info;
 
 pub type UrlParseError = url::ParseError;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum AuthFlowType {
+    Enrollment,
+    Mfa,
+}

crates/defguard_core/src/enterprise/grpc/desktop_client_mfa.rs

@@ -1,6 +1,6 @@
+use defguard_common::{db::models::Settings, types::AuthFlowType};
 use defguard_proto::proxy::{ClientMfaOidcAuthenticateRequest, DeviceInfo, MfaMethod};
 use openidconnect::{AuthorizationCode, Nonce};
-use reqwest::Url;
 use tonic::Status;
 
 use crate::{
@@ -84,10 +84,12 @@ impl ClientMfaServer {
         );
 
         let code = AuthorizationCode::new(request.code.clone());
-        let url = match Url::parse(&request.callback_url).map_err(|err| {
-            error!("Invalid redirect URL provided: {err}");
-            Status::invalid_argument("invalid redirect URL")
-        }) {
+        let url = match Settings::get_current_settings()
+            .edge_callback_url(AuthFlowType::Mfa)
+            .map_err(|err| {
+                error!("Invalid callback URL configuration: {err}");
+                Status::invalid_argument("invalid callback URL")
+            }) {
             Ok(url) => url,
             Err(status) => {
                 self.sessions
@@ -101,7 +103,7 @@ impl ClientMfaServer {
                             location: location.clone(),
                             device: device.clone(),
                             method,
-                            message: "provided invalid redirect URL".to_string(),
+                            message: "provided invalid callback URL".to_string(),
                         },
                     )),
                 })?;