Implementing a custom acces-denied page with flow-through login

Just a shot in the dark before I really start digging into this, but have you looked in the $_SERVER[] superglobal?

OK, this can be done in the code, but I don't know how pretty it is.

the function drupal_access_denied() changes the node request that is returned by get_destination(), etc.

My response is to set a global variable with the information *you* want just before that change, so you can reference it later.

Around line 226 of common.inc add

  global $destbefore403;
  $destbefore403 = drupal_get_destination();

then, in your custom 403 page, use this for the target of your form:

global $destbefore403;
url('user/login', $destbefore403);

Let's see where that gets us...

I was able to determine the original requested URL on my custom 403 page by accessing Server Variables.

<?php
function PageURI() {
 $pageURI = "http";
 if ($_SERVER["HTTPS"] == "on") {$pageURI .= "s";}
$pageURI .= "://".$_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"];
 return $pageURI;
}
$pageurl = urlencode(PageURI()."?cachebuster=".rand());
?>

You can then add $pageurl to the destination parameter in the querystring to provide links for round-trip login that returns to the original request. I've also used this URI to build a simple request access form for users that are authenticated but not in the correct role/organic group to access the URI.

e.g.

<?php global $user; ?>
<?php if ($user->uid) { ?> 
  <p>Sorry <?php print $user->name; ?>, you don't have permission to view the page you've just tried to access.</p>
 <p>If this doesn't sound right, we're very sorry.  Please provide any details that will assist the us in determining who you are and why you should have access to this page.</p>
  <form action="requestaccess?destination=<?php print $pageurl; ?>" method="post" id="requestform">
        <div>
            <fieldset><legend>Request Access</legend>
                <div>
                    <label for="mailFromDisplay">Your Username</label>
                    <input id="mailFromDisplay" name="mailFromDisplay" readonly="readonly" type="text" value="<?php print $user->name; ?>" /> 
                </div>
                <div>
                    <label for="returnUrl">Page Requested</label>
                    <input id="returnUrl" name="returnUrl" readonly="readonly" type="text" value="<?php print urldecode($pageurl); ?>" /> 
                </div>
                <div>
                    <label for="mailBody">Message</label><br/>
                    <textarea class="ifwis-textarea" cols="40" id="mailBody" multiline="true" name="mailBody" rows="2">
</textarea>                
                    <br/><input type="submit" value="Request Access" />
                </div>
            </fieldset>
        </div>
    </form>
<?php } else { ?>
    <p>Only registered users in specific groups may access the page you requested.</p>   
    <h3>Logging in may make this all go away.</h3>
    <ul>
        <li><a title="Log In" href="user/login?destination=<?php print $pageurl; ?>">Login</a> 
	to see if you can access this page once authenticated.</li> 
        <li><a title="Create an Account" href="user/register?destination=<?php print $pageurl; ?>">Register</a> if you don't yet have an account.</li> 
	</ul>
    </div>
<?php } ?>

I'm not certain if this works in all configurations, but it's working well for me on a production site.