Package org.wso2.carbon.ui

Class CarbonSSOSessionManager

  • public class CarbonSSOSessionManager
extends Object
    This class is used to maintain a mapping between the session indexes of the SSO Identity Provider end and the relying party end. When a user is authenticated and logged-in using SSO, an entry is added to the validSessionMap where Idp-session-index --> RP-Session-id. When he logs out from either of SSO relying party, a SAML2 LogoutRequest is sent to all the relying party service providers who have established sessions with the Identity Provider at that moment. When a relying party receives a logout request, it should validate the request and extract the IdP session index from the request. Then it should identify the sessionId of the corresponding user which represents the session established at the relying party end. Then it removes that session from the validSessionMap and includes it to the invalidSessionsMap. So when a user tries to do some activity thereafter he should be logged-out from the system. This class maintains two maps to maintain valid sessions and invalid sessions. This class is implemented as a singleton because there should be only one SSOSessionManager per instance.

    • Method Detail

      • getInstance

        public static CarbonSSOSessionManager getInstance()
        Get the CarbonSSOSessionManager instance.
        Returns:
        CarbonSSOSessionManager instance

      • addSessionMapping

        public void addSessionMapping​(String idPSessionIndex,
                              String localSessionId)
        Add a new session mapping : IdpSessionIndex --> localSessionId
        Parameters:
        idPSessionIndex - session index sent along in the SAML Response
        localSessionId - id of the current session established locally.

      • makeSessionInvalid

        public void makeSessionInvalid​(String idPSessionIndex)
        make a session invalid after receiving the single logout request from the identity provider
        Parameters:
        idPSessionIndex - session index established at the identity provider's end

      • isSessionValid

        public boolean isSessionValid​(String localSessionId)
        Check whether a particular session is valid.
        Parameters:
        localSessionId - session id established locally
        Returns:
        true, if the session is valid, false otherwise

      • removeInvalidSession

        public void removeInvalidSession​(String localSessionId)
        Remove invalid session from the invalid session map. This needs to be done before completing the sign out.
        Parameters:
        localSessionId - SessionId established locally

      • skipSSOSessionInvalidation

        public boolean skipSSOSessionInvalidation​(javax.servlet.http.HttpServletRequest request,
                                          CarbonUIAuthenticator uiAuthenticator)
        This method checks whether the request is for a SSO authentication related page or servlet. If it is so, the session invalidation should be skipped.
        Parameters:
        request - Request, HTTPServletRequest
        Returns:
        true, if session invalidation should be skipped.

      • skipAuthentication

        public boolean skipAuthentication​(javax.servlet.http.HttpServletRequest request)
        Skips authentication for given URI's.
        Parameters:
        request - The request to access a page.
        Returns:
        true if request doesnt need to authenticate, else false.

      • getRequestedUrl

        public String getRequestedUrl​(javax.servlet.http.HttpServletRequest request,
                              CarbonUIAuthenticator uiAuthenticator)
        Parameters:
        request -
        Returns: