1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18 package edu.internet2.middleware.shibboleth.idp.session.impl;
19
20 import java.security.SecureRandom;
21
22 import org.apache.commons.ssl.util.Hex;
23 import org.opensaml.util.storage.StorageService;
24 import org.opensaml.xml.util.DatatypeHelper;
25 import org.slf4j.Logger;
26 import org.slf4j.LoggerFactory;
27 import org.slf4j.MDC;
28
29 import edu.internet2.middleware.shibboleth.common.session.SessionManager;
30 import edu.internet2.middleware.shibboleth.idp.session.Session;
31
32
33 public class SessionManagerImpl implements SessionManager<Session> {
34
35
36 private final Logger log = LoggerFactory.getLogger(SessionManagerImpl.class);
37
38
39 private final int sessionIDSize = 32;
40
41
42 private final SecureRandom prng = new SecureRandom();
43
44
45 private StorageService<String, SessionManagerEntry> sessionStore;
46
47
48 private String partition;
49
50
51 private long sessionLifetime;
52
53
54
55
56
57
58
59 public SessionManagerImpl(StorageService<String, SessionManagerEntry> storageService, long lifetime) {
60 sessionStore = storageService;
61 partition = "session";
62 sessionLifetime = lifetime;
63 }
64
65
66
67
68
69
70
71
72 public SessionManagerImpl(StorageService<String, SessionManagerEntry> storageService, String storageParition,
73 long lifetime) {
74 sessionStore = storageService;
75 if (!DatatypeHelper.isEmpty(storageParition)) {
76 partition = DatatypeHelper.safeTrim(storageParition);
77 } else {
78 partition = "session";
79 }
80 sessionLifetime = lifetime;
81 }
82
83
84 public Session createSession() {
85
86 byte[] sid = new byte[sessionIDSize];
87 prng.nextBytes(sid);
88 String sessionID = Hex.encode(sid);
89
90 byte[] sessionSecret = new byte[16];
91 prng.nextBytes(sessionSecret);
92
93 Session session = new SessionImpl(sessionID, sessionSecret, sessionLifetime);
94 SessionManagerEntry sessionEntry = new SessionManagerEntry(session, sessionLifetime);
95 sessionStore.put(partition, sessionID, sessionEntry);
96
97 MDC.put("idpSessionId", sessionID);
98 log.trace("Created session {}", sessionID);
99 return session;
100 }
101
102
103 public Session createSession(String principal) {
104
105 byte[] sid = new byte[sessionIDSize];
106 prng.nextBytes(sid);
107 String sessionID = Hex.encode(sid);
108
109 byte[] sessionSecret = new byte[16];
110 prng.nextBytes(sessionSecret);
111
112 Session session = new SessionImpl(sessionID, sessionSecret, sessionLifetime);
113 SessionManagerEntry sessionEntry = new SessionManagerEntry(session, sessionLifetime);
114 sessionStore.put(partition, sessionID, sessionEntry);
115
116 MDC.put("idpSessionId", sessionID);
117 log.trace("Created session {}", sessionID);
118 return session;
119 }
120
121
122 public void destroySession(String sessionID) {
123 if (sessionID == null) {
124 return;
125 }
126
127 SessionManagerEntry sessionEntry = sessionStore.get(partition, sessionID);
128 if (sessionEntry == null) {
129 return;
130 }
131 for(String sessionIndex : sessionEntry.getSessionIndexes()){
132 sessionStore.remove(partition, sessionIndex);
133 }
134 sessionStore.remove(partition, sessionID);
135 }
136
137
138 public Session getSession(String sessionID) {
139 if (sessionID == null) {
140 return null;
141 }
142
143 SessionManagerEntry sessionEntry = sessionStore.get(partition, sessionID);
144 if (sessionEntry == null) {
145 return null;
146 }
147
148 if (sessionEntry.isExpired()) {
149 destroySession(sessionEntry.getSessionId());
150 return null;
151 } else {
152 return sessionEntry.getSession();
153 }
154 }
155
156
157 public boolean indexSession(Session session, String index) {
158 if (sessionStore.contains(partition, index)) {
159 return false;
160 }
161
162 SessionManagerEntry sessionEntry = sessionStore.get(partition, session.getSessionID());
163 if (sessionEntry == null) {
164 return false;
165 }
166
167 if (sessionEntry.getSessionIndexes().contains(index)) {
168 return true;
169 }
170
171 sessionEntry.getSessionIndexes().add(index);
172 sessionStore.put(partition, index, sessionEntry);
173 log.trace("Added index {} to session {}", index, session.getSessionID());
174 return true;
175 }
176
177
178 public void removeSessionIndex(String index) {
179 SessionManagerEntry sessionEntry = sessionStore.remove(partition, index);
180 if (sessionEntry != null) {
181 log.trace("Removing index {} for session {}", index, sessionEntry.getSessionId());
182 sessionEntry.getSessionIndexes().remove(index);
183 }
184 }
185 }