Skip to content

Instantly share code, notes, and snippets.

@korteke

korteke/DestroySession.java

Created April 13, 2016 10:46
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save korteke/7855d815f5886ab234cae28855099526 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save korteke/7855d815f5886ab234cae28855099526 to your computer and use it in GitHub Desktop.
Download ZIP
Tiedostopolut: /opt/shibboleth-idp/system/flows/intercept/ Oikea tapa on tehdä system-hakemiston tiedostoista omat versiot /opt/shibboleth-idp/flows/intercept hakemistoon. System-hakemiston alla olevia tiedostoja ei ole tarkoitus muokata! Ekassa bean joka pitää lisätä muiden jatkoksi. Tokassa flow, jossa tärkeimpänä rivit 122-132. Kolmanessa its…
Raw
attribute-release-beans.xml
<bean id="DestroySession" class="fi.csc.shibboleth.mobileauth.impl.authn.DestroySession" scope="prototype"
p:sessionManager-ref="shibboleth.SessionManager" />
Raw
attribute-release-flow.xml
<flow xmlns="http://www.springframework.org/schema/webflow"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
parent="intercept.abstract">
<!-- Rudimentary impediment to direct execution of subflow. -->
<input name="calledAsSubflow" type="boolean" required="true" />
<!-- Attribute consent setup. -->
<on-start>
<evaluate expression="AttributeConsentFlowDescriptorLookupStrategy.apply(opensamlProfileRequestContext)"
result="flowScope.attributeReleaseFlowDescriptor" />
</on-start>
<action-state id="AttributeConsentSetup">
<evaluate expression="InitializeConsentContext" />
<evaluate expression="InitializeAttributeConsentContext" />
<evaluate expression="PopulateAttributeConsentContext" />
<evaluate expression="PopulatePreConsentAuditContext" />
<evaluate expression="SetRPUIInformation" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="TestForRevokeConsent" />
</action-state>
<!-- If consent revocation was requested, skip reading from storage. -->
<decision-state id="TestForRevokeConsent">
<if test="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.consent.context.ConsentManagementContext), true).getRevokeConsent()"
then="RevokeConsent" else="ReadConsentFromStorage" />
</decision-state>
<!-- Revoke consent by deleting consent storage records. -->
<action-state id="RevokeConsent">
<evaluate expression="RevokeConsent" />
<evaluate expression="'ClearAttributeReleaseConsent'" />
</action-state>
<!-- Write 'ClearAttributeReleaseConsent' event to consent audit log. -->
<action-state id="ClearAttributeReleaseConsent">
<evaluate expression="WriteAttributeReleaseConsentAuditLog" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="TestForRevokeGlobalAttributeConsent" />
</action-state>
<decision-state id="TestForRevokeGlobalAttributeConsent">
<if test="attributeReleaseFlowDescriptor.isGlobalConsentAllowed()"
then="RevokeGlobalAttributeConsent" else="PopulateConsentContext" />
</decision-state>
<action-state id="RevokeGlobalAttributeConsent">
<evaluate expression="RevokeGlobalAttributeConsent" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="PopulateConsentContext" />
</action-state>
<!-- Read consent from storage. -->
<action-state id="ReadConsentFromStorage">
<evaluate expression="ReadConsentFromStorage" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="TestForReadGlobalAttributeConsentFromStorage" />
</action-state>
<decision-state id="TestForReadGlobalAttributeConsentFromStorage">
<if test="attributeReleaseFlowDescriptor.globalConsentAllowed"
then="ReadGlobalAttributeConsentFromStorage" else="PopulateConsentContext" />
</decision-state>
<action-state id="ReadGlobalAttributeConsentFromStorage">
<evaluate expression="ReadGlobalAttributeConsentFromStorage" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="TestForGlobalAttributeConsent" />
</action-state>
<!-- If global consent has been given by user, skip the rest of the flow. -->
<decision-state id="TestForGlobalAttributeConsent">
<if test="GlobalAttributeConsentPredicate.apply(opensamlProfileRequestContext)"
then="proceed" else="PopulateConsentContext" />
</decision-state>
<!-- Create consent objects and store in consent context. -->
<action-state id="PopulateConsentContext">
<evaluate expression="PopulateConsentContext" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="IsConsentRequired" />
</action-state>
<!-- If consent is required, display page. Otherwise, release attributes. -->
<decision-state id="IsConsentRequired">
<if test="IsConsentRequiredPredicate.apply(opensamlProfileRequestContext)"
then="DisplayAttributeReleasePage" else="ReleaseAttributes" />
</decision-state>
<!-- Display attribute release page. -->
<view-state id="DisplayAttributeReleasePage" view="#{flowRequestContext.activeFlow.id}">
<on-render>
<evaluate expression="environment" result="viewScope.environment" />
<evaluate expression="T(net.shibboleth.utilities.java.support.codec.HTMLEncoder)" result="viewScope.encoder" />
<evaluate expression="flowRequestContext.getExternalContext().getNativeRequest()" result="viewScope.request" />
<evaluate expression="flowRequestContext.getExternalContext().getNativeResponse()" result="viewScope.response" />
<evaluate expression="opensamlProfileRequestContext" result="viewScope.profileRequestContext" />
<evaluate expression="new net.shibboleth.idp.consent.logic.impl.AttributeDisplayNameFunction(flowRequestContext.getExternalContext().getNativeRequest(), FallbackLanguages)"
result="viewScope.attributeDisplayNameFunction" />
<evaluate expression="new net.shibboleth.idp.consent.logic.impl.AttributeDisplayDescriptionFunction(flowRequestContext.getExternalContext().getNativeRequest(), FallbackLanguages)"
result="viewScope.attributeDisplayDescriptionFunction" />
<evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.consent.context.impl.ConsentContext))" result="viewScope.consentContext" />
<evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.consent.context.impl.AttributeReleaseContext))" result="viewScope.attributeReleaseContext" />
<evaluate expression="SetRPUIInformation.getRPUIContextCreateStrategy().apply(opensamlProfileRequestContext)" result="viewScope.rpUIContext" />
<evaluate expression="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.CustomViewContext') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.CustomViewContext') : null" result="viewScope.custom" />
</on-render>
<!--transition on="RemoveAuthenticationResult" to="RemoveAuthenticationRes"/-->
<transition on="RemoveAuthenticationResult" to="DestroySession"/>
<transition on="proceed" to="TestForGlobalConsent" />
</view-state>
<action-state id="DestroySession">
<evaluate expression="DestroySession" />
<evaluate expression="'proceed'" />
<!--transition on="proceed" to="AttributeReleaseRejected"/-->
<transition on="proceed" to="InvalidProfileContext" />
</action-state>
<!-- If global consent was given by user, create appropriate storage result and end flow. -->
<decision-state id="TestForGlobalConsent">
<if test="requestParameters._shib_idp_consentOptions == '_shib_idp_globalConsent'"
then="GlobalConsent" else="ExtractConsent" />
</decision-state>
<action-state id="GlobalConsent">
<evaluate expression="CreateGlobalConsentResult" />
<evaluate expression="'GlobalAttributeReleaseConsent'" />
</action-state>
<!-- Write 'GlobalAttributeReleaseConsent' event to consent audit log. -->
<action-state id="GlobalAttributeReleaseConsent">
<evaluate expression="WriteAttributeReleaseConsentAuditLog" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="proceed" />
</action-state>
<!-- Extract user input from form and update consent objects in consent context accordingly. -->
<action-state id="ExtractConsent">
<evaluate expression="ExtractConsent" />
<evaluate expression="'AttributeReleaseConsent'" />
</action-state>
<!-- Write 'AttributeReleaseConsent' event to consent audit log. -->
<action-state id="AttributeReleaseConsent">
<evaluate expression="PopulateConsentAuditContext" />
<evaluate expression="WriteAttributeReleaseConsentAuditLog" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="TestForDoNotRememberConsent" />
</action-state>
<!-- Determine whether consent should be stored or not. -->
<decision-state id="TestForDoNotRememberConsent">
<if test="requestParameters._shib_idp_consentOptions == '_shib_idp_doNotRememberConsent'"
then="ReleaseAttributes" else="CreateResult" />
</decision-state>
<!-- Create result to be stored by interceptor flow. -->
<action-state id="CreateResult">
<evaluate expression="CreateResult" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="ReleaseAttributes" />
</action-state>
<!-- Release attributes consented to as well as non-consentable attributes from attribute context. -->
<action-state id="ReleaseAttributes">
<evaluate expression="ReleaseAttributes" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="proceed" />
</action-state>
<end-state id="proceed" />
<bean-import resource="../../../system/flows/intercept/attribute-release-beans.xml" />
</flow>
Raw
DestroySession.java
/*
* The MIT License
* Copyright (c) 2016 CSC - IT Center for Science, http://www.csc.fi
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
* THE SOFTWARE.
*/
package fi.csc.shibboleth.mobileauth.impl.authn;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.google.common.base.Function;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.ActionSupport;
import net.shibboleth.idp.session.SessionException;
import net.shibboleth.idp.session.SessionManager;
import net.shibboleth.idp.session.context.SessionContext;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
@SuppressWarnings("rawtypes")
public class DestroySession extends AbstractProfileAction {
/** Class logger. */
@Nonnull
private final Logger log = LoggerFactory.getLogger(DestroySession.class);
/** SessionManager. */
@Nonnull
private SessionManager sessionManager;
/** Lookup function for SessionContext. */
@Nonnull private Function<ProfileRequestContext,SessionContext> sessionContextLookupStrategy;
/** SessionContext to operate on. */
@Nullable private SessionContext sessionCtx;
public void setSessionManager(@Nonnull final SessionManager manager) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
sessionManager = Constraint.isNotNull(manager, "SessionManager cannot be null");
}
public void setSessionContextLookupStrategy(
@Nonnull final Function<ProfileRequestContext,SessionContext> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
sessionContextLookupStrategy = Constraint.isNotNull(strategy,
"SessionContext lookup strategy cannot be null");
}
/** {@inheritDoc} */
@Override
protected void doInitialize() throws ComponentInitializationException {
super.doInitialize();
if (sessionManager == null) {
throw new ComponentInitializationException("SessionManager cannot be null");
}
}
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
log.debug("Entering DestroyAuthResult doExecute");
sessionCtx = profileRequestContext.getSubcontext(SessionContext.class);
try {
sessionManager.destroySession(sessionCtx.getIdPSession().getId(), true);
} catch (SessionException e) {
log.error("{} Error destroying session {}", getLogPrefix(), sessionCtx.getIdPSession().getId(), e);
ActionSupport.buildEvent(profileRequestContext, EventIds.IO_ERROR);
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment