Package com.broadleafcommerce.auth.user.web.logout

Class AuthenticationLogoutHandler

java.lang.Object

com.broadleafcommerce.auth.user.web.logout.AuthenticationLogoutHandler

All Implemented Interfaces:

org.springframework.security.web.authentication.logout.LogoutHandler

public class AuthenticationLogoutHandler
extends Object
implements org.springframework.security.web.authentication.logout.LogoutHandler

Constructor Summary

Constructors

Constructor	Description
AuthenticationLogoutHandler(StatelessUtil sessionUtil)

Method Summary

Modifier and Type	Method	Description
protected AuthorizedClient	findClient(String clientId)
protected AuthorizationServer	findServer(AuthorizedClient client)
protected AuthorizationServerService<AuthorizationServer>	getAuthorizationServerService()
protected AuthorizedClientService<AuthorizedClient>	getAuthorizedClientService()
protected OAuth2AuthorizedClientEntityService<OAuth2AuthorizedClientEntity>	getOAuth2AuthorizedClientEntityService()
protected RememberMeLogoutHandlerDelegate	getRememberMeLogoutHandlerDelegate()
protected StatelessUtil	getSessionUtil()
protected String	getStringClaim(String claimName, Map<String,Object> claims)
void	logout(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.Authentication authentication)
protected void	revokeOAuth2AuthorizedClientIfApplicable(Map<String,Object> existingSessionCookieClaims, AuthorizedClient authorizedClient, AuthorizationServer authorizationServer)	Revokes any 3rd Party IDP Login state, if applicable.
void	setAuthorizationServerService(AuthorizationServerService<AuthorizationServer> authorizationServerService)
void	setAuthorizedClientService(AuthorizedClientService<AuthorizedClient> authorizedClientService)
void	setOAuth2AuthorizedClientEntityService(OAuth2AuthorizedClientEntityService<OAuth2AuthorizedClientEntity> oAuth2AuthorizedClientEntityService)
void	setRememberMeLogoutHandlerDelegate(RememberMeLogoutHandlerDelegate rememberMeLogoutHandlerDelegate)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

AuthenticationLogoutHandler

public AuthenticationLogoutHandler(StatelessUtil sessionUtil)

Method Details

logout

public void logout(jakarta.servlet.http.HttpServletRequest request,
 jakarta.servlet.http.HttpServletResponse response,
 org.springframework.security.core.Authentication authentication)

Specified by:

logout in interface org.springframework.security.web.authentication.logout.LogoutHandler

revokeOAuth2AuthorizedClientIfApplicable

protected void revokeOAuth2AuthorizedClientIfApplicable(Map<String,Object> existingSessionCookieClaims,
 AuthorizedClient authorizedClient,
 AuthorizationServer authorizationServer)

Revokes any 3rd Party IDP Login state, if applicable.

We cannot use OAuth2AuthorizedClientRepository.removeAuthorizedClient(String, Authentication, HttpServletRequest, HttpServletResponse), because it typically expects something like OAuth2LoginAuthenticationToken as the authentication argument. However, in this logout handler, the Authentication we get will be null since the logout filter does not have any security on it.

Thus, we invoke OAuth2AuthorizedClientEntityService directly with parameters we harvest from other sources.

Parameters:

existingSessionCookieClaims - a map of claims harvested from the existing Broadleaf session cookie

authorizedClient - the AuthorizedClient that this logout is being initiated for

authorizationServer - the AuthorizationServer under which the authorizedClient exists

getStringClaim

@Nullable
protected String getStringClaim(String claimName,
 Map<String,Object> claims)

findClient

protected AuthorizedClient findClient(String clientId)

findServer

protected AuthorizationServer findServer(AuthorizedClient client)

getSessionUtil

protected StatelessUtil getSessionUtil()

setOAuth2AuthorizedClientEntityService

@Autowired
public void setOAuth2AuthorizedClientEntityService(OAuth2AuthorizedClientEntityService<OAuth2AuthorizedClientEntity> oAuth2AuthorizedClientEntityService)

getOAuth2AuthorizedClientEntityService

protected OAuth2AuthorizedClientEntityService<OAuth2AuthorizedClientEntity> getOAuth2AuthorizedClientEntityService()

setAuthorizedClientService

@Autowired
public void setAuthorizedClientService(AuthorizedClientService<AuthorizedClient> authorizedClientService)

getAuthorizedClientService

protected AuthorizedClientService<AuthorizedClient> getAuthorizedClientService()

setAuthorizationServerService

@Autowired
public void setAuthorizationServerService(AuthorizationServerService<AuthorizationServer> authorizationServerService)

getAuthorizationServerService

protected AuthorizationServerService<AuthorizationServer> getAuthorizationServerService()

setRememberMeLogoutHandlerDelegate

@Autowired(required=false)
public void setRememberMeLogoutHandlerDelegate(RememberMeLogoutHandlerDelegate rememberMeLogoutHandlerDelegate)

getRememberMeLogoutHandlerDelegate

@Nullable
protected RememberMeLogoutHandlerDelegate getRememberMeLogoutHandlerDelegate()