Package org.wso2.carbon.ui

Class CarbonSSOSessionManager

java.lang.Object
org.wso2.carbon.ui.CarbonSSOSessionManager
@Capability(namespace="osgi.service", attribute={"objectClass=org.wso2.carbon.ui.CarbonSSOSessionManager","service.scope=singleton"}) public class CarbonSSOSessionManager extends Object
This class is used to maintain a mapping between the session indexes of the SSO Identity Provider end and the relying party end. When a user is authenticated and logged-in using SSO, an entry is added to the validSessionMap where Idp-session-index --> RP-Session-id. When he logs out from either of SSO relying party, a SAML2 LogoutRequest is sent to all the relying party service providers who have established sessions with the Identity Provider at that moment. When a relying party receives a logout request, it should validate the request and extract the IdP session index from the request. Then it should identify the sessionId of the corresponding user which represents the session established at the relying party end. Then it removes that session from the validSessionMap and includes it to the invalidSessionsMap. So when a user tries to do some activity thereafter he should be logged-out from the system. This class maintains two maps to maintain valid sessions and invalid sessions. This class is implemented as a singleton because there should be only one SSOSessionManager per instance.

  • Method Details

    • getInstance

      public static CarbonSSOSessionManager getInstance()
      Get the CarbonSSOSessionManager instance.
      Returns:
      CarbonSSOSessionManager instance

    • addSessionMapping

      public void addSessionMapping(String idPSessionIndex, String localSessionId)
      Add a new session mapping : IdpSessionIndex --> localSessionId
      Parameters:
      idPSessionIndex - session index sent along in the SAML Response
      localSessionId - id of the current session established locally.

    • makeSessionInvalid

      public void makeSessionInvalid(String idPSessionIndex)
      make a session invalid after receiving the single logout request from the identity provider
      Parameters:
      idPSessionIndex - session index established at the identity provider's end

    • isSessionValid

      public boolean isSessionValid(String localSessionId)
      Check whether a particular session is valid.
      Parameters:
      localSessionId - session id established locally
      Returns:
      true, if the session is valid, false otherwise

    • removeInvalidSession

      public void removeInvalidSession(String localSessionId)
      Remove invalid session from the invalid session map. This needs to be done before completing the sign out.
      Parameters:
      localSessionId - SessionId established locally

    • skipSSOSessionInvalidation

      public boolean skipSSOSessionInvalidation(javax.servlet.http.HttpServletRequest request, CarbonUIAuthenticator uiAuthenticator)
      This method checks whether the request is for a SSO authentication related page or servlet. If it is so, the session invalidation should be skipped.
      Parameters:
      request - Request, HTTPServletRequest
      Returns:
      true, if session invalidation should be skipped.

    • skipAuthentication

      public boolean skipAuthentication(javax.servlet.http.HttpServletRequest request)
      Skips authentication for given URI's.
      Parameters:
      request - The request to access a page.
      Returns:
      true if request doesnt need to authenticate, else false.

    • getRequestedUrl

      public String getRequestedUrl(javax.servlet.http.HttpServletRequest request, CarbonUIAuthenticator uiAuthenticator)
      Parameters:
      request -
      Returns: