public class StorageBackedSessionManager extends net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent implements SessionManager, SessionResolver
SessionManager and SessionResolver interfaces that relies on a
StorageService for persistence and lifecycle management of data.
The storage layout here is to store most data in a context named for the session ID. Within that context, the master
IdPSession record lives under a key called "_session", with an expiration based on the session timeout value
plus a configurable amount of "slop" to prevent premature disappearance in case of logout.
Each AuthenticationResult is stored in a record keyed by the flow ID. The expiration
is set based on the underlying flow's timeout.
Each SPSession is stored in a record keyed by the service ID. The expiration is set based on the SPSession's
own expiration plus the "slop" value.
For cross-referencing, lists of flow and service IDs are tracked within the master "_session" record, so adding either requires an update to the master record plus the creation of a new one. Post-creation, there are no updates to the AuthenticationResult or SPSession records, but the expiration of the result records can be updated to reflect activity updates.
When a SPSession is added, it may expose an optional secondary "key". If set, this is a signal to add a secondary lookup of the SPSession. This is a record containing a list of relevant IdPSession IDs stored under a context/key pair consisting of the Service ID and the exposed secondary key from the object. The expiration of this record is set based on the larger of the current list expiration, if any, and the expiration of the SPSession plus the configured slop value. In other words, the lifetime of the index record is pushed out as far as needed to avoid premature expiration while any of the SPSessions producing it remain around.
The primary purpose of the secondary list is SAML logout, and is an optional feature that can be disabled. In the case of a SAML 2 session, the secondary key is some form of the NameID issued to the service.
| Modifier and Type | Field and Description |
|---|---|
private boolean |
consistentAddress
Indicates whether sessions are bound to client addresses.
|
private net.shibboleth.utilities.java.support.net.CookieManager |
cookieManager
Manages creation of cookies.
|
private String |
cookieName
Name of cookie used to track sessions.
|
protected static String |
DEFAULT_COOKIE_NAME
Default cookie name for session tracking.
|
private Map<String,AuthenticationFlowDescriptor> |
flowDescriptorMap
Flows that could potentially be used to authenticate the user.
|
private HttpServletRequest |
httpRequest
Servlet request to read from.
|
private HttpServletResponse |
httpResponse
Servlet response to write to.
|
private net.shibboleth.utilities.java.support.security.IdentifierGenerationStrategy |
idGenerator
Generator for XML ID attribute values.
|
private Logger |
log
Class logger.
|
private boolean |
maskStorageFailure
Indicates that storage service failures should be masked as much as possible.
|
private boolean |
secondaryServiceIndex
Indicates whether to secondary-index SPSessions.
|
private StorageBackedIdPSessionSerializer |
serializer
Serializer for sessions.
|
static String |
SESSION_MASTER_KEY
Storage key of master session records.
|
private long |
sessionSlop
Amount of time in milliseconds to defer expiration of records for better handling of logout.
|
private long |
sessionTimeout
Inactivity timeout for sessions in milliseconds.
|
private SPSessionSerializerRegistry |
spSessionSerializerRegistry
Mappings between a SPSession type and a serializer implementation.
|
private org.opensaml.storage.StorageService |
storageService
The back-end for managing data.
|
private boolean |
trackSPSessions
Indicates whether to store and track SPSessions.
|
| Constructor and Description |
|---|
StorageBackedSessionManager()
Constructor.
|
| Modifier and Type | Method and Description |
|---|---|
IdPSession |
createSession(String principalName) |
void |
destroySession(String sessionId) |
protected void |
doInitialize() |
AuthenticationFlowDescriptor |
getAuthenticationFlowDescriptor(String flowId)
Get a matching
AuthenticationFlowDescriptor. |
(package private) HttpServletRequest |
getHttpServletRequest()
Get the servlet request to read from.
|
(package private) HttpServletResponse |
getHttpServletResponse()
Get the servlet response to write to.
|
long |
getSessionSlop()
Get the amount of time in milliseconds to defer expiration of records.
|
long |
getSessionTimeout()
Get the session inactivity timeout policy in milliseconds.
|
SPSessionSerializerRegistry |
getSPSessionSerializerRegistry()
Get the attached
spSessionSerializerRegistry. |
org.opensaml.storage.StorageSerializer<StorageBackedIdPSession> |
getStorageSerializer()
Get the serializer for the
IdPSession objects managed by this implementation. |
org.opensaml.storage.StorageService |
getStorageService()
Get the
StorageService back-end to use. |
protected void |
indexBySPSession(IdPSession idpSession,
SPSession spSession,
int attempts)
Insert or update a secondary index record from a SPSession to a parent IdPSession.
|
boolean |
isConsistentAddress()
Get whether sessions are bound to client addresses.
|
boolean |
isMaskStorageFailure()
Get whether to mask StorageService failures where possible.
|
boolean |
isSecondaryServiceIndex()
Get whether to create a secondary index for SPSession lookup.
|
boolean |
isTrackSPSessions()
Get whether to track SPSessions.
|
private IdPSession |
lookupBySessionId(String sessionId)
Performs a lookup and deserializes a record based on session ID.
|
private Iterable<IdPSession> |
lookupBySPSession(SPSessionCriterion criterion)
Performs a lookup and deserializes records potentially matching a SPSession.
|
Iterable<IdPSession> |
resolve(net.shibboleth.utilities.java.support.resolver.CriteriaSet criteria) |
IdPSession |
resolveSingle(net.shibboleth.utilities.java.support.resolver.CriteriaSet criteria) |
void |
setAuthenticationFlowDescriptors(Iterable<AuthenticationFlowDescriptor> flows)
Set the
AuthenticationFlowDescriptor collection active in the system. |
void |
setConsistentAddress(boolean flag)
Set whether sessions are bound to client addresses.
|
void |
setCookieManager(net.shibboleth.utilities.java.support.net.CookieManager manager)
Set the
CookieManager to use. |
void |
setCookieName(String name)
Set the cookie name to use for session tracking.
|
void |
setHttpServletRequest(HttpServletRequest request)
Set the servlet request to read from.
|
void |
setHttpServletResponse(HttpServletResponse response)
Set the servlet response to write to.
|
void |
setIDGenerator(net.shibboleth.utilities.java.support.security.IdentifierGenerationStrategy newIDGenerator)
Set the generator to use when creating XML ID attribute values.
|
void |
setMaskStorageFailure(boolean flag)
Set whether to mask StorageService failures where possible.
|
void |
setSecondaryServiceIndex(boolean flag)
Set whether to create a secondary index for SPSession lookup.
|
void |
setSessionSlop(long slop)
Set the amount of time in milliseconds to defer expiration of records.
|
void |
setSessionTimeout(long timeout)
Set the session inactivity timeout policy in milliseconds, must be greater than zero.
|
void |
setSPSessionSerializerRegistry(SPSessionSerializerRegistry registry)
Set the
SPSessionSerializerRegistry to use. |
void |
setStorageService(org.opensaml.storage.StorageService storage)
Set the
StorageService back-end to use. |
void |
setTrackSPSessions(boolean flag)
Set whether to track SPSessions.
|
setIdgetIddestroy, doDestroy, initialize, isDestroyed, isInitializedclone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, waitgetId@Nonnull @NotEmpty public static final String SESSION_MASTER_KEY
@Nonnull @NotEmpty protected static final String DEFAULT_COOKIE_NAME
@Nullable private HttpServletRequest httpRequest
@Nullable private HttpServletResponse httpResponse
@Duration @Positive private long sessionTimeout
@Duration @NonNegative private long sessionSlop
private boolean maskStorageFailure
private boolean trackSPSessions
private boolean secondaryServiceIndex
private boolean consistentAddress
@NonnullAfterInit private net.shibboleth.utilities.java.support.net.CookieManager cookieManager
@NonnullAfterInit private org.opensaml.storage.StorageService storageService
@NonnullAfterInit private net.shibboleth.utilities.java.support.security.IdentifierGenerationStrategy idGenerator
@Nonnull private final StorageBackedIdPSessionSerializer serializer
@Nonnull @NonnullElements private final Map<String,AuthenticationFlowDescriptor> flowDescriptorMap
@Nullable private SPSessionSerializerRegistry spSessionSerializerRegistry
@Nullable HttpServletRequest getHttpServletRequest()
public void setHttpServletRequest(@Nullable HttpServletRequest request)
request - servlet request@Nullable HttpServletResponse getHttpServletResponse()
public void setHttpServletResponse(@Nullable HttpServletResponse response)
response - servlet response@Positive public long getSessionTimeout()
public void setSessionTimeout(@Duration@Positive
long timeout)
timeout - the policy to set@Positive public long getSessionSlop()
public void setSessionSlop(@Duration@NonNegative
long slop)
slop - the policy to setpublic boolean isMaskStorageFailure()
public void setMaskStorageFailure(boolean flag)
flag - flag to setpublic boolean isTrackSPSessions()
public void setTrackSPSessions(boolean flag)
This feature requires a StorageService that is not client-side because of space limitations.
flag - flag to setpublic boolean isSecondaryServiceIndex()
public void setSecondaryServiceIndex(boolean flag)
This feature requires a StorageService that is not client-side.
flag - flag to setpublic boolean isConsistentAddress()
public void setConsistentAddress(boolean flag)
flag - flag to setpublic void setCookieName(@Nonnull@NotEmpty String name)
name - cookie name to usepublic void setCookieManager(@Nonnull net.shibboleth.utilities.java.support.net.CookieManager manager)
CookieManager to use.manager - the CookieManager to use.@Nonnull public org.opensaml.storage.StorageService getStorageService()
StorageService back-end to use.public void setStorageService(@Nonnull org.opensaml.storage.StorageService storage)
StorageService back-end to use.storage - the back-end to usepublic void setIDGenerator(@Nonnull net.shibboleth.utilities.java.support.security.IdentifierGenerationStrategy newIDGenerator)
newIDGenerator - the new IdentifierGenerator to use@Nonnull public org.opensaml.storage.StorageSerializer<StorageBackedIdPSession> getStorageSerializer()
IdPSession objects managed by this implementation.@Nullable public AuthenticationFlowDescriptor getAuthenticationFlowDescriptor(@Nonnull@NotEmpty String flowId)
AuthenticationFlowDescriptor.flowId - the ID of the flow to returnpublic void setAuthenticationFlowDescriptors(@Nonnull@NonnullElements Iterable<AuthenticationFlowDescriptor> flows)
AuthenticationFlowDescriptor collection active in the system.flows - the flows available for possible use@Nullable public SPSessionSerializerRegistry getSPSessionSerializerRegistry()
spSessionSerializerRegistry.public void setSPSessionSerializerRegistry(@Nullable SPSessionSerializerRegistry registry)
SPSessionSerializerRegistry to use.registry - a registry of SPSession class to serializer mappingsprotected void doInitialize()
throws net.shibboleth.utilities.java.support.component.ComponentInitializationException
doInitialize in class net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponentnet.shibboleth.utilities.java.support.component.ComponentInitializationException@Nonnull public IdPSession createSession(@Nonnull@NotEmpty String principalName) throws SessionException
createSession in interface SessionManagerSessionExceptionpublic void destroySession(@Nonnull@NotEmpty String sessionId) throws SessionException
destroySession in interface SessionManagerSessionException@Nonnull @NonnullElements public Iterable<IdPSession> resolve(@Nullable net.shibboleth.utilities.java.support.resolver.CriteriaSet criteria) throws net.shibboleth.utilities.java.support.resolver.ResolverException
resolve in interface net.shibboleth.utilities.java.support.resolver.Resolver<IdPSession,net.shibboleth.utilities.java.support.resolver.CriteriaSet>net.shibboleth.utilities.java.support.resolver.ResolverException@Nullable public IdPSession resolveSingle(@Nullable net.shibboleth.utilities.java.support.resolver.CriteriaSet criteria) throws net.shibboleth.utilities.java.support.resolver.ResolverException
resolveSingle in interface net.shibboleth.utilities.java.support.resolver.Resolver<IdPSession,net.shibboleth.utilities.java.support.resolver.CriteriaSet>net.shibboleth.utilities.java.support.resolver.ResolverExceptionprotected void indexBySPSession(@Nonnull IdPSession idpSession, @Nonnull SPSession spSession, int attempts) throws SessionException
idpSession - the parent sessionspSession - the SPSession to indexattempts - number of times to retry operation in the event of a synchronization issueSessionException - if a fatal error occurs@Nullable private IdPSession lookupBySessionId(@Nonnull@NotEmpty String sessionId) throws net.shibboleth.utilities.java.support.resolver.ResolverException
sessionId - the session to lookupnet.shibboleth.utilities.java.support.resolver.ResolverException - if an error occurs during lookup@Nonnull @NonnullElements private Iterable<IdPSession> lookupBySPSession(@Nonnull SPSessionCriterion criterion) throws net.shibboleth.utilities.java.support.resolver.ResolverException
criterion - the SPSessionCriterion to applynet.shibboleth.utilities.java.support.resolver.ResolverException - if an error occurs during lookupCopyright © 1999–2014. All rights reserved.