Examples with SessionStore org.pac4j.core.context.session.SessionStore used on opensource projects

Example 6 with SessionStore

use of org.pac4j.core.context.session.SessionStore in project cas by apereo.

the class SamlIdPUtils method retrieveSamlRequest.

/**
 * Retrieve authn request authn request.
 *
 * @param context            the context
 * @param sessionStore       the session store
 * @param openSamlConfigBean the open saml config bean
 * @param clazz              the clazz
 * @return the request
 */
public static Optional<Pair<? extends RequestAbstractType, MessageContext>> retrieveSamlRequest(final WebContext context, final SessionStore sessionStore, final OpenSamlConfigBean openSamlConfigBean, final Class<? extends RequestAbstractType> clazz) {
    LOGGER.trace("Retrieving authentication request from scope");
    val authnContext = sessionStore.get(context, SamlProtocolConstants.PARAMETER_SAML_REQUEST).map(String.class::cast).map(value -> retrieveSamlRequest(openSamlConfigBean, clazz, value)).flatMap(authnRequest -> sessionStore.get(context, MessageContext.class.getName()).map(String.class::cast).map(result -> SamlIdPAuthenticationContext.decode(result).toMessageContext(authnRequest)));
    return authnContext.map(ctx -> Pair.of((AuthnRequest) ctx.getMessage(), ctx));
}

Example 7 with SessionStore

use of org.pac4j.core.context.session.SessionStore in project pac4j by pac4j.

the class DefaultAuthorizationCheckerTests method testCsrfCheckPostTokenParameter.

@Test
public void testCsrfCheckPostTokenParameter() {
    final var context = MockWebContext.create().setRequestMethod(HttpConstants.HTTP_METHOD.POST.name());
    final var generator = new DefaultCsrfTokenGenerator();
    final SessionStore sessionStore = new MockSessionStore();
    final var token = generator.get(context, sessionStore);
    context.addRequestParameter(Pac4jConstants.CSRF_TOKEN, token);
    sessionStore.set(context, Pac4jConstants.CSRF_TOKEN, token);
    sessionStore.set(context, Pac4jConstants.CSRF_TOKEN_EXPIRATION_DATE, new Date().getTime() + 1000 * generator.getTtlInSeconds());
    assertTrue(checker.isAuthorized(context, sessionStore, profiles, DefaultAuthorizers.CSRF_CHECK, new HashMap<>(), new ArrayList<>()));
}

Example 8 with SessionStore

use of org.pac4j.core.context.session.SessionStore in project pac4j by pac4j.

the class CsrfAuthorizerTests method testParameterExpiredDate.

@Test
public void testParameterExpiredDate() {
    final var expiredDate = new Date().getTime() - 1000;
    final WebContext context = MockWebContext.create().addRequestParameter(Pac4jConstants.CSRF_TOKEN, VALUE);
    final SessionStore sessionStore = new MockSessionStore();
    sessionStore.set(context, Pac4jConstants.CSRF_TOKEN, VALUE);
    sessionStore.set(context, Pac4jConstants.CSRF_TOKEN_EXPIRATION_DATE, expiredDate);
    Assert.assertFalse(authorizer.isAuthorized(context, sessionStore, null));
}

Example 9 with SessionStore

use of org.pac4j.core.context.session.SessionStore in project pac4j by pac4j.

the class CsrfAuthorizerTests method testHeaderOkNewName.

@Test
public void testHeaderOkNewName() {
    final WebContext context = MockWebContext.create().addRequestHeader(NAME, VALUE);
    final SessionStore sessionStore = new MockSessionStore();
    sessionStore.set(context, Pac4jConstants.CSRF_TOKEN, VALUE);
    sessionStore.set(context, Pac4jConstants.CSRF_TOKEN_EXPIRATION_DATE, expirationDate);
    authorizer.setHeaderName(NAME);
    Assert.assertTrue(authorizer.isAuthorized(context, sessionStore, null));
}

Example 10 with SessionStore

use of org.pac4j.core.context.session.SessionStore in project pac4j by pac4j.

the class CsrfAuthorizerTests method internalTestNoTokenRequest.

private void internalTestNoTokenRequest(final HttpConstants.HTTP_METHOD method) {
    final var context = MockWebContext.create();
    final SessionStore sessionStore = new MockSessionStore();
    sessionStore.set(context, Pac4jConstants.CSRF_TOKEN, VALUE);
    sessionStore.set(context, Pac4jConstants.CSRF_TOKEN_EXPIRATION_DATE, expirationDate);
    context.setRequestMethod(method.name());
    Assert.assertFalse(authorizer.isAuthorized(context, sessionStore, null));
}