fix: forcer session save et retry automatique pour SSO invalid state

Sauvegarde explicite de la session avant la redirection OAuth pour
garantir la persistance du state parameter. Retry automatique du
flow SSO en cas d'InvalidStateAuthenticationException.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/Controller/EtlController.php

@@ -1077,7 +1077,7 @@ class EtlController extends AbstractController
     }
 
     #[Route('/etl/connect/keycloak', name: 'connect_keycloak_etl_start')]
-    public function connectKeycloakEtlStart(ClientRegistry $clientRegistry): Response
+    public function connectKeycloakEtlStart(ClientRegistry $clientRegistry, Request $request): Response
     {
         $response = $clientRegistry
             ->getClient('keycloak_etl')
@@ -1085,6 +1085,8 @@ class EtlController extends AbstractController
         $response->headers->set('Cache-Control', 'no-store, no-cache, must-revalidate');
         $response->headers->set('Pragma', 'no-cache');
 
+        $request->getSession()->save();
+
         return $response;
     }
 

src/Controller/HomeController.php

@@ -26,7 +26,7 @@ class HomeController extends AbstractController
 {
 
     #[Route('/intranet/connect/keycloak', name: 'connect_keycloak_start')]
-    public function connect(ClientRegistry $clientRegistry): Response
+    public function connect(ClientRegistry $clientRegistry, Request $request): Response
     {
         $response = $clientRegistry
             ->getClient('keycloak')
@@ -34,6 +34,8 @@ class HomeController extends AbstractController
         $response->headers->set('Cache-Control', 'no-store, no-cache, must-revalidate');
         $response->headers->set('Pragma', 'no-cache');
 
+        $request->getSession()->save();
+
         return $response;
     }
 

src/Security/EtlKeycloakAuthenticator.php

@@ -17,6 +17,7 @@ use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
 use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;
 use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface;
 use Symfony\Component\Uid\Uuid;
+use KnpU\OAuth2ClientBundle\Security\Exception\InvalidStateAuthenticationException;
 
 class EtlKeycloakAuthenticator extends OAuth2Authenticator implements AuthenticationEntryPointInterface
 {
@@ -89,6 +90,10 @@ class EtlKeycloakAuthenticator extends OAuth2Authenticator implements Authentica
 
     public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response
     {
+        if ($exception instanceof InvalidStateAuthenticationException) {
+            return new RedirectResponse($this->router->generate('connect_keycloak_etl_start'));
+        }
+
         $message = strtr($exception->getMessageKey(), $exception->getMessageData());
         return new Response($message, Response::HTTP_FORBIDDEN);
     }

src/Security/KeycloakAuthenticator.php

@@ -18,6 +18,7 @@ use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
 use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;
 use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface;
 use Symfony\Component\Uid\Uuid;
+use KnpU\OAuth2ClientBundle\Security\Exception\InvalidStateAuthenticationException;
 
 class KeycloakAuthenticator extends OAuth2Authenticator implements AuthenticationEntryPointInterface
 {
@@ -91,6 +92,10 @@ class KeycloakAuthenticator extends OAuth2Authenticator implements Authenticatio
 
     public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response
     {
+        if ($exception instanceof InvalidStateAuthenticationException) {
+            return new RedirectResponse($this->router->generate('connect_keycloak_start'));
+        }
+
         $message = strtr($exception->getMessageKey(), $exception->getMessageData());
         return new Response($message, Response::HTTP_FORBIDDEN);
     }