Examples with Session org.apache.shiro.session.Session used on opensource projects

Example 91 with Session

use of org.apache.shiro.session.Session in project graylog2-server by Graylog2.

the class UserSessionTerminationService method runGlobalSessionTermination.

/**
 * Terminate all user sessions, if the revision is outdated.
 * <p>
 * To make sure that we don't terminate user sessions concurrently, this method should be called on the primary
 * node only.
 */
public void runGlobalSessionTermination() {
    final GlobalTerminationRevisionConfig globalTerminationRevisionConfig = clusterConfigService.getOrDefault(GlobalTerminationRevisionConfig.class, GlobalTerminationRevisionConfig.initial());
    if (!globalTerminationRevisionConfig.isOutdated()) {
        LOG.debug("Global session termination not required");
        return;
    }
    long terminatedSessions = 0;
    for (final Session activeSession : sessionDao.getActiveSessions()) {
        terminateSessionForID(activeSession.getId());
        terminatedSessions++;
    }
    LOG.info("Globally terminated {} session(s)", terminatedSessions);
    clusterConfigService.write(GlobalTerminationRevisionConfig.withCurrentRevision());
}

Example 92 with Session

use of org.apache.shiro.session.Session in project graylog2-server by Graylog2.

the class SessionAuthenticator method doGetAuthenticationInfo.

@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
    SessionIdToken sessionIdToken = (SessionIdToken) token;
    final Subject subject = new Subject.Builder().sessionId(sessionIdToken.getSessionId()).buildSubject();
    final Session session = subject.getSession(false);
    if (session == null) {
        LOG.debug("Invalid session. Either it has expired or did not exist.");
        return null;
    }
    final Object userId = subject.getPrincipal();
    final User user = userService.loadById(String.valueOf(userId));
    if (user == null) {
        LOG.debug("No user with userId {} found for session", userId);
        return null;
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug("Found session for userId {}", userId);
    }
    final String sessionUsername = (String) session.getAttribute(HTTPHeaderAuthenticationRealm.SESSION_AUTH_HEADER);
    if (sessionUsername != null) {
        final HTTPHeaderAuthConfig httpHeaderConfig = loadHTTPHeaderConfig();
        final Optional<String> usernameHeader = ShiroRequestHeadersBinder.getHeaderFromThreadContext(httpHeaderConfig.usernameHeader());
        if (httpHeaderConfig.enabled() && usernameHeader.isPresent() && !usernameHeader.get().equalsIgnoreCase(sessionUsername)) {
            LOG.warn("Terminating session where user <{}> does not match trusted HTTP header <{}>.", sessionUsername, usernameHeader.get());
            session.stop();
            return null;
        }
    }
    final Optional<String> noSessionExtension = ShiroRequestHeadersBinder.getHeaderFromThreadContext(X_GRAYLOG_NO_SESSION_EXTENSION);
    if (noSessionExtension.isPresent() && "true".equalsIgnoreCase(noSessionExtension.get())) {
        LOG.debug("Not extending session because the request indicated not to.");
    } else {
        session.touch();
    }
    ThreadContext.bind(subject);
    return new SimpleAccount(user.getId(), null, "session authenticator");
}

Example 93 with Session

use of org.apache.shiro.session.Session in project nutzboot by nutzam.

the class ShiroEnvStarter method getWebSecurityManager.

@IocBean(name = "shiroWebSecurityManager")
public WebSecurityManager getWebSecurityManager() {
    DefaultWebSecurityManager webSecurityManager = new DefaultWebSecurityManager() {

        protected SubjectContext resolveSession(SubjectContext context) {
            if (context.resolveSession() != null) {
                return context;
            }
            try {
                Session session = resolveContextSession(context);
                if (session != null) {
                    context.setSession(session);
                }
            } catch (InvalidSessionException e) {
            }
            return context;
        }
    };
    // Shiro Session相关
    if (conf.getBoolean(PROP_SESSION_ENABLE, true)) {
        webSecurityManager.setSessionManager(ioc.get(WebSessionManager.class, "shiroWebSessionManager"));
    }
    List<Realm> realms = new ArrayList<>();
    for (String realmName : ioc.getNamesByType(Realm.class)) {
        realms.add(ioc.get(Realm.class, realmName));
    }
    if (realms.size() > 0)
        webSecurityManager.setRealms(realms);
    webSecurityManager.setRememberMeManager(ioc.get(RememberMeManager.class, "shiroRememberMeManager"));
    return webSecurityManager;
}