Examples with SessionEvent org.gluu.oxauth.service.external.session.SessionEvent used on opensource projects

Example 1 with SessionEvent

use of org.gluu.oxauth.service.external.session.SessionEvent in project oxAuth by GluuFederation.

the class SessionIdService method generateAuthenticatedSessionId.

public SessionId generateAuthenticatedSessionId(HttpServletRequest httpRequest, String userDn, Map<String, String> sessionIdAttributes) throws InvalidSessionStateException {
    SessionId sessionId = generateSessionId(userDn, new Date(), SessionIdState.AUTHENTICATED, sessionIdAttributes, true);
    reportActiveUser(sessionId);
    if (externalApplicationSessionService.isEnabled()) {
        String userName = sessionId.getSessionAttributes().get(Constants.AUTHENTICATED_USER);
        boolean externalResult = externalApplicationSessionService.executeExternalStartSessionMethods(httpRequest, sessionId);
        log.info("Start session result for '{}': '{}'", userName, "start", externalResult);
        if (!externalResult) {
            reinitLogin(sessionId, true);
            throw new InvalidSessionStateException("Session creation is prohibited by external session script!");
        }
        externalEvent(new SessionEvent(SessionEventType.AUTHENTICATED, sessionId).setHttpRequest(httpRequest));
    }
    return sessionId;
}

Example 2 with SessionEvent

use of org.gluu.oxauth.service.external.session.SessionEvent in project oxAuth by GluuFederation.

the class SessionIdService method reinitLogin.

/**
 * @param session
 * @param force
 * @return returns whether session was updated
 */
public boolean reinitLogin(SessionId session, boolean force) {
    final Map<String, String> sessionAttributes = session.getSessionAttributes();
    final Map<String, String> currentSessionAttributes = getCurrentSessionAttributes(sessionAttributes);
    if (force || shouldReinitSession(sessionAttributes, currentSessionAttributes)) {
        sessionAttributes.putAll(currentSessionAttributes);
        // Reinit login
        sessionAttributes.put("c", "1");
        for (Iterator<Entry<String, String>> it = currentSessionAttributes.entrySet().iterator(); it.hasNext(); ) {
            Entry<String, String> currentSessionAttributesEntry = it.next();
            String name = currentSessionAttributesEntry.getKey();
            if (name.startsWith("auth_step_passed_")) {
                it.remove();
            }
        }
        session.setSessionAttributes(currentSessionAttributes);
        if (force) {
            // Reset state to unauthenticated
            session.setState(SessionIdState.UNAUTHENTICATED);
            externalEvent(new SessionEvent(SessionEventType.UNAUTHENTICATED, session));
        }
        boolean updateResult = updateSessionId(session, true, true, true);
        if (!updateResult) {
            log.debug("Failed to update session entry: '{}'", session.getId());
        }
        return updateResult;
    }
    return false;
}

Example 3 with SessionEvent

use of org.gluu.oxauth.service.external.session.SessionEvent in project oxAuth by GluuFederation.

the class SessionIdService method mergeWithRetry.

private void mergeWithRetry(final SessionId sessionId) {
    final Pair<Date, Integer> expiration = expirationDate(sessionId.getCreationDate(), sessionId.getState());
    sessionId.setExpirationDate(expiration.getFirst());
    sessionId.setTtl(expiration.getSecond());
    EntryPersistenceException lastException = null;
    for (int i = 1; i <= MAX_MERGE_ATTEMPTS; i++) {
        try {
            if (appConfiguration.getSessionIdPersistInCache()) {
                cacheService.put(expiration.getSecond(), sessionId.getDn(), sessionId);
            } else {
                persistenceEntryManager.merge(sessionId);
            }
            localCacheService.put(DEFAULT_LOCAL_CACHE_EXPIRATION, sessionId.getDn(), sessionId);
            externalEvent(new SessionEvent(SessionEventType.UPDATED, sessionId));
            return;
        } catch (EntryPersistenceException ex) {
            lastException = ex;
            if (ex.getCause() instanceof LDAPException) {
                LDAPException parentEx = ((LDAPException) ex.getCause());
                log.debug("LDAP exception resultCode: '{}'", parentEx.getResultCode().intValue());
                if ((parentEx.getResultCode().intValue() == ResultCode.NO_SUCH_ATTRIBUTE_INT_VALUE) || (parentEx.getResultCode().intValue() == ResultCode.ATTRIBUTE_OR_VALUE_EXISTS_INT_VALUE)) {
                    log.warn("Session entry update attempt '{}' was unsuccessfull", i);
                    continue;
                }
            }
            throw ex;
        }
    }
    log.error("Session entry update attempt was unsuccessfull after '{}' attempts", MAX_MERGE_ATTEMPTS);
    throw lastException;
}

Example 4 with SessionEvent

use of org.gluu.oxauth.service.external.session.SessionEvent in project oxAuth by GluuFederation.

the class SessionIdService method remove.

public boolean remove(SessionId sessionId) {
    try {
        if (appConfiguration.getSessionIdPersistInCache()) {
            cacheService.remove(sessionId.getDn());
        } else {
            persistenceEntryManager.remove(sessionId.getDn(), SessionId.class);
        }
        localCacheService.remove(sessionId.getDn());
        externalEvent(new SessionEvent(SessionEventType.GONE, sessionId));
        return true;
    } catch (Exception e) {
        log.error(e.getMessage(), e);
        return false;
    }
}

Example 5 with SessionEvent

use of org.gluu.oxauth.service.external.session.SessionEvent in project oxAuth by GluuFederation.

the class SessionIdService method setSessionIdStateAuthenticated.

public SessionId setSessionIdStateAuthenticated(HttpServletRequest httpRequest, HttpServletResponse httpResponse, SessionId sessionId, String p_userDn) {
    sessionId.setUserDn(p_userDn);
    sessionId.setAuthenticationTime(new Date());
    sessionId.setState(SessionIdState.AUTHENTICATED);
    final User user = getUser(sessionId);
    if (user != null) {
        statService.reportActiveUser(user.getUserId());
    }
    final boolean persisted;
    if (appConfiguration.getChangeSessionIdOnAuthentication() && httpResponse != null) {
        final String oldSessionId = sessionId.getId();
        final String newSessionId = UUID.randomUUID().toString();
        log.debug("Changing session id from {} to {} ...", oldSessionId, newSessionId);
        remove(sessionId);
        sessionId.setId(newSessionId);
        sessionId.setDn(buildDn(newSessionId));
        sessionId.getSessionAttributes().put(SessionId.OLD_SESSION_ID_ATTR_KEY, oldSessionId);
        if (sessionId.getIsJwt()) {
            sessionId.setJwt(generateJwt(sessionId, sessionId.getUserDn()).asString());
        }
        persisted = persistSessionId(sessionId, true);
        cookieService.createSessionIdCookie(sessionId, httpRequest, httpResponse, false);
        log.debug("Session identifier changed from {} to {} .", oldSessionId, newSessionId);
    } else {
        persisted = updateSessionId(sessionId, true, true, true);
    }
    auditLogging(sessionId);
    log.trace("Authenticated session, id = '{}', state = '{}', persisted = '{}'", sessionId.getId(), sessionId.getState(), persisted);
    if (externalApplicationSessionService.isEnabled()) {
        String userName = sessionId.getSessionAttributes().get(Constants.AUTHENTICATED_USER);
        boolean externalResult = externalApplicationSessionService.executeExternalStartSessionMethods(httpRequest, sessionId);
        log.info("Start session result for '{}': '{}'", userName, "start", externalResult);
        if (!externalResult) {
            reinitLogin(sessionId, true);
            throw new InvalidSessionStateException("Session creation is prohibited by external session script!");
        }
        externalEvent(new SessionEvent(SessionEventType.AUTHENTICATED, sessionId).setHttpRequest(httpRequest).setHttpResponse(httpResponse));
    }
    return sessionId;
}