'Access denied' when logging in from user/login

I think the setting that you're referring to only applies to the first login by a CAS user.

Anyway, I should probably elaborate a little- we are using Open Atrium, and what is happening is that anonymous users visit <front>, get redirected to user/login?destination=, log in via CAS, and expect to end up back at <front>, but instead land on user/login?destination= again.

However, if instead of visiting the front page, anonymous users visit somepage, they get directed to somepage/user/login?destination=somepage, log in via CAS, and land at somepage as expected.

FYI, I opened an issue with OA as well in case the problem's on their end: https://community.openatrium.com/issues/node/2349

Sorry, I guess I left out a step - when I say they "log in via CAS" I mean that they click "Log in" on user/login?destination=, get sent to the CAS server to log in, and then get returned to user/login?destination=. The expected behavior would be to get returned to <front>, since the destination parameter is empty and user/login is not a valid destination for a logged-in user in any circumstance.

The problem is that in most cases, the destination is set as the HTTP_REFERER (sic) that led people to the CAS login path. However, there's no guaruntee that the HTTP_REFERER is a valid path for an authenticated user.

I propose the following patch (if you want me to roll this as an actual patch let me know). Insert it in function cas_login_page right before drupal_goto($destination). It checks the $destination (usually the HTTP_REFERER) to make sure that it's a valid path and the current user has permission to access it. If either of those conditions aren't met, the user is instead directed to <front>.

$destination_info = parse_url($destination);
if (!menu_valid_path(array('link_path' => $destination_info['path']))) {
  $destination = variable_get('site_frontpage', 'node');
}

Yargh- apparently menu_valid_path is buggy - it returns TRUE for the path 'user/login' even though all users (including admin) are denied access. So maybe it's better just to use this:

$destination_path = parse_url($destination, PHP_URL_PATH);
if ($destination_path == '/user/login') {                                
  $destination = variable_get('site_frontpage', 'node');
}

The original error persists in 2.3. The code I posted in #7 fixes it, the code as committed does not.

Thanks for the tip, I look forward to trying the new release.

Here's the patch corresponding to #7, against 6.x-2.3... I'll let you decide how you'd like to reconcile it.

Seems reasonable, although I somewhat dislike putting anything in hook_init() unless absolutely necessary. I can try it out and let you know how it works.

Yep, #20 works great on 6.x-2.3.