Examples with SessionException com.iplanet.dpro.session.SessionException used on opensource projects

Example 31 with SessionException

use of com.iplanet.dpro.session.SessionException in project OpenAM by OpenRock.

the class AuthUtils method getAuthContext.

/**
     * Returns the authentication context for a request.
     *
     * @param request HTTP Servlet Request.
     * @param response HTTP Servlet Response.
     * @param sid SessionID for this request.
     * @param isSessionUpgrade <code>true</code> if session upgrade.
     * @param isBackPost <code>true</code> if back posting.
     * @param isLogout <code>true</code> for logout.
     * @return authentication context.
     */
public static AuthContextLocal getAuthContext(HttpServletRequest request, HttpServletResponse response, SessionID sid, boolean isSessionUpgrade, boolean isBackPost, boolean isLogout) throws AuthException {
    utilDebug.message("In AuthUtils:getAuthContext");
    Hashtable dataHash;
    AuthContextLocal authContext = null;
    LoginState loginState = null;
    // initialize auth service.
    AuthD ad = AuthD.getAuth();
    try {
        dataHash = parseRequestParameters(request);
        authContext = retrieveAuthContext(request, sid);
        if (utilDebug.messageEnabled()) {
            utilDebug.message("AuthUtil:getAuthContext:sid is.. .: " + sid);
            utilDebug.message("AuthUtil:getAuthContext:authContext is..: " + authContext);
        }
        if (!sid.isNull() && authContext == null && !isSessionUpgrade) {
            String authCookieValue = getAuthCookieValue(request);
            if ((authCookieValue != null) && (!authCookieValue.isEmpty()) && (!authCookieValue.equalsIgnoreCase("LOGOUT"))) {
                String cookieURL = null;
                try {
                    SessionID sessionID = new SessionID(authCookieValue);
                    URL sessionServerURL = SESSION_SERVICE_URL_SERVICE.getSessionServiceURL(sessionID);
                    cookieURL = sessionServerURL.getProtocol() + "://" + sessionServerURL.getHost() + ":" + Integer.toString(sessionServerURL.getPort()) + serviceURI;
                } catch (SessionException e) {
                    if (utilDebug.messageEnabled()) {
                        utilDebug.message("AuthUtils:getAuthContext():" + e.toString());
                    }
                }
                if (utilDebug.messageEnabled()) {
                    utilDebug.message("AuthUtils:getAuthContext():" + "cookieURL : " + cookieURL);
                }
                if ((cookieURL != null) && (!cookieURL.isEmpty()) && (isLocalServer(cookieURL, true))) {
                    utilDebug.error("AuthUtils:getAuthContext(): " + "Invalid Session Timed out");
                    clearAllCookies(request, response);
                    throw new AuthException(AMAuthErrorCode.AUTH_TIMEOUT, null);
                }
            }
        }
        if (utilDebug.messageEnabled()) {
            utilDebug.message("isSessionUpgrade  :" + isSessionUpgrade);
            utilDebug.message("BACK with Request method POST : " + isBackPost);
        }
        if ((authContext == null) && (isLogout)) {
            return null;
        }
        if ((authContext == null) || (isSessionUpgrade) || (isBackPost)) {
            try {
                loginState = new LoginState();
                InternalSession oldSession = null;
                if (sid != null) {
                    oldSession = AuthD.getSession(sid);
                    loginState.setOldSession(oldSession);
                }
                if (isSessionUpgrade) {
                    loginState.setOldSession(oldSession);
                    loginState.setSessionUpgrade(isSessionUpgrade);
                } else if (isBackPost) {
                    loginState.setOldSession(oldSession);
                }
                authContext = loginState.createAuthContext(request, response, sid, dataHash);
                loginState.setForceAuth(Boolean.parseBoolean(request.getParameter(FORCE_AUTH)));
                authContext.setLoginState(loginState);
                String queryOrg = getQueryOrgName(request, getOrgParam(dataHash));
                if (utilDebug.messageEnabled()) {
                    utilDebug.message("query org is .. : " + queryOrg);
                }
                loginState.setQueryOrg(queryOrg);
            } catch (AuthException ae) {
                utilDebug.message("Error creating AuthContextLocal : ");
                if (utilDebug.messageEnabled()) {
                    utilDebug.message("Exception ", ae);
                }
                throw new AuthException(ae);
            }
        } else {
            utilDebug.message("getAuthContext: found existing request.");
            authContext = processAuthContext(authContext, request, response, dataHash, sid);
            loginState = getLoginState(authContext);
            loginState.setNewRequest(false);
        }
    } catch (Exception ee) {
        if (utilDebug.messageEnabled()) {
            utilDebug.message("Error creating AuthContextLocal : " + ee.getMessage());
        }
        throw new AuthException(ee);
    }
    return authContext;
}

Example 32 with SessionException

use of com.iplanet.dpro.session.SessionException in project OpenAM by OpenRock.

the class StatelessSessionActivator method activateSession.

@Override
public boolean activateSession(final LoginState loginState, final SessionService sessionService, final InternalSession authSession, final Subject subject, final Object loginContext) throws AuthException {
    if (loginState.getForceFlag()) {
        if (DEBUG.messageEnabled()) {
            DEBUG.message("Cannot force auth stateless sessions.");
        }
        throw new AuthException(AMAuthErrorCode.STATELESS_FORCE_FAILED, null);
    }
    if (loginState.isSessionUpgrade()) {
        //set our old session -- necessary as if the currently owned token is stateless this won't be set
        SessionID sid = new SessionID(loginState.getHttpServletRequest());
        try {
            SessionInfo info = getStatelessSessionFactory().getSessionInfo(sid);
            oldSession = getStatelessSessionFactory().generate(info);
            loginState.setOldStatelessSession(oldSession);
        } catch (SessionException e) {
            throw new AuthException(AMAuthErrorCode.SESSION_UPGRADE_FAILED, null);
        }
    }
    //create our new session - the loginState needs this session as it's the one we'll be passing back to the user
    final InternalSession session = createSession(sessionService, loginState);
    loginState.setSession(session);
    return updateSessions(session, loginState, session, authSession, sessionService, subject, loginContext);
}

Example 33 with SessionException

use of com.iplanet.dpro.session.SessionException in project OpenAM by OpenRock.

the class RemoteSessionQuery method getSessionResponse.

/**
     * Performs the Session Request and waits for the response.
     *
     * @param svcurl URL Non null to perform the request against.
     *
     * @param sreq Non null Session Request.
     *
     * @return A SessionResponse containing the response from the remote server.
     *
     * @throws SessionException
     */
private SessionResponse getSessionResponse(URL svcurl, SessionRequest sreq) throws SessionException {
    try {
        Object context = RestrictedTokenContext.getCurrent();
        if (context != null) {
            sreq.setRequester(RestrictedTokenContext.marshal(context));
        }
        SessionResponse sres = sessionPllSender.sendPLLRequest(svcurl, sreq);
        if (sres.getException() != null) {
            throw new SessionException(sres.getException());
        }
        return sres;
    } catch (SessionException se) {
        throw se;
    } catch (Exception e) {
        throw new SessionException(e);
    }
}

Example 34 with SessionException

use of com.iplanet.dpro.session.SessionException in project OpenAM by OpenRock.

the class RemoteSessionQuery method getAllSessions.

/**
     * Generates a SessionRequest and uses this to query the remote server.
     *
     * @return  Non null but possibly empty collection of Sessions. If the server is down, then this will
     *          also return no sessions.
     */
public Collection<SessionInfo> getAllSessions() {
    List<SessionInfo> sessions = new LinkedList<SessionInfo>();
    try {
        URL svcurl = sessionServiceUrlService.getSessionServiceURL(serverId);
        SSOToken adminToken = getAdminToken();
        String sid = adminToken.getTokenID().toString();
        SessionRequest sreq = new SessionRequest(SessionRequest.GetValidSessions, sid, false);
        SessionResponse sres = getSessionResponse(svcurl, sreq);
        List<SessionInfo> infoList = sres.getSessionInfo();
        if (debug.messageEnabled()) {
            debug.message(MessageFormat.format("Query returned {0} SessionInfos.", infoList.size()));
        }
        sessions.addAll(infoList);
    } catch (SessionException e) {
        debug.warning("Failed to fetch sessions from " + serverId, e);
    }
    return sessions;
}

Example 35 with SessionException

use of com.iplanet.dpro.session.SessionException in project OpenAM by OpenRock.

the class SessionUtils method checkPermissionToSetProperty.

/**
     * Helper method to check if client has taken permission to
     * set value to it. If
     * @param clientToken Token of the client setting protected property.
     * @param key Property key
     * @param value Property value.
     * @throws SessionException if the key is protected property.
     */
public static void checkPermissionToSetProperty(SSOToken clientToken, String key, String value) throws SessionException {
    Debug sessionDebug = InjectorHolder.getInstance(Key.get(Debug.class, Names.named(SESSION_DEBUG)));
    if (InternalSession.isProtectedProperty(key)) {
        if (clientToken == null) {
            // Throw Ex. Client should identify itself.
            if (sessionDebug.warningEnabled()) {
                sessionDebug.warning("SessionUtils.checkPermissionToSetProperty(): " + "Attempt to set protected property without client " + "token [" + key + "=" + value + "]");
            }
            throw new SessionException(SessionBundle.getString("protectedPropertyNoClientToken") + " " + key);
        }
        SSOTokenManager ssoTokenManager = null;
        try {
            ssoTokenManager = SSOTokenManager.getInstance();
        } catch (SSOException ssoEx) {
            // Throw Ex. Not able to get SSOTokenManager instance.
            sessionDebug.error("SessionUtils.checkPermissionToSetProperty(): " + "Cannot get instance of SSOTokenManager.");
            throw new SessionException(SessionBundle.getString("protectedPropertyNoSSOTokenMgrInstance") + " " + key);
        }
        if (!ssoTokenManager.isValidToken(clientToken)) {
            // Throw Ex. Client should identify itself.
            if (sessionDebug.warningEnabled()) {
                sessionDebug.warning("SessionUtils.checkPermissionToSetProperty(): " + "Attempt to set protected property with invalid client" + " token [" + key + "=" + value + "]");
            }
            throw new SessionException(SessionBundle.getString("protectedPropertyInvalidClientToken") + " " + key);
        }
        SSOToken admToken = null;
        try {
            admToken = SessionUtils.getAdminToken();
        } catch (SSOException ssoEx) {
            // Throw Ex. Server not able to get Admin Token.
            sessionDebug.error("SessionUtils.checkPermissionToSetProperty(): " + "Cannot get Admin Token for validation to set protected " + "property [" + key + "=" + value + "]");
            throw new SessionException(SessionBundle.getString("protectedPropertyNoAdminToken") + " " + key);
        }
        if (!SessionUtils.isAdmin(admToken, clientToken)) {
            // Throw Ex. Client not authorized to set this property.
            sessionDebug.error("SessionUtils.checkPermissionToSetProperty(): " + "Client does not have permission to set protected " + "property" + key + "=" + value + "]");
            throw new SessionException(SessionBundle.getString("protectedPropertyNoPermission") + " " + key);
        }
    }
}