Examples with UserSessionManagementService org.wso2.carbon.identity.application.authentication.framework.UserSessionManagementService used on opensource projects

Example 1 with UserSessionManagementService

use of org.wso2.carbon.identity.application.authentication.framework.UserSessionManagementService in project carbon-identity-framework by wso2.

the class SessionManagementService method removeMySession.

/**
 * Terminates the requested session, after validating whether the session belongs to the logged in user.
 * @deprecated Use UserSessionManagementService to terminate the session of the current user
 * {@link org.wso2.carbon.identity.application.authentication.framework.UserSessionManagementService
 * #terminateSessionBySessionId(String, String)}
 * @param sessionId
 * @return
 */
public boolean removeMySession(String sessionId) {
    if (StringUtils.isBlank(sessionId)) {
        return false;
    }
    SessionContext sessionContext = FrameworkUtils.getSessionContextFromCache(sessionId, FrameworkUtils.getLoginTenantDomainFromContext());
    // Check whether the session belongs to the logged in user.
    CarbonContext carbonContext = CarbonContext.getThreadLocalCarbonContext();
    String username = carbonContext.getUsername();
    // Extract the user store domain if there is any or set to 'PRIMARY'.
    String userStoreDomain = "PRIMARY";
    username = UserCoreUtil.removeDomainFromName(username);
    AuthenticatedUser authenticatedUser = (AuthenticatedUser) sessionContext.getProperty(FrameworkConstants.AUTHENTICATED_USER);
    if (username.equals(authenticatedUser.getUserName()) && userStoreDomain.equals(authenticatedUser.getUserStoreDomain()) && carbonContext.getTenantDomain().equals(authenticatedUser.getTenantDomain())) {
        ServerSessionManagementService serverSessionManagementService = FrameworkServiceDataHolder.getInstance().getServerSessionManagementService();
        return serverSessionManagementService.removeSession(sessionId);
    } else {
        // TODO : Handle federated scenario.
        log.warn(String.format("Trying to terminate a session which does not belong to logged in user (%s). " + "This might be an attempt for a security breach", username));
        return false;
    }
}