Package com.broadleafcommerce.auth.user.service

Class DefaultSessionAuthenticationStrategy

java.lang.Object

com.broadleafcommerce.auth.user.service.DefaultSessionAuthenticationStrategy

All Implemented Interfaces:

org.springframework.security.web.authentication.session.SessionAuthenticationStrategy

public class DefaultSessionAuthenticationStrategy
extends Object
implements org.springframework.security.web.authentication.session.SessionAuthenticationStrategy

This is used to set the session cookie after successful authentication. It is intended to be used for all authentication types. Each authentication flow should register its own AuthenticationStrategyDelegate to facilitate loading an OAuth2UserDetails from an Authentication.

Constructor Summary

Constructors

Constructor	Description
DefaultSessionAuthenticationStrategy(StatelessUtil statelessUtil, List<AuthenticationStrategyDelegate> authenticationStrategyDelegates, AuthorizedClientService<AuthorizedClient> clientService)

Method Summary

Modifier and Type	Method	Description
protected void	blacklistPreviousSessionTokenIfApplicable(jakarta.servlet.http.HttpServletRequest request, String sessionCookieName, OAuth2SessionToken newSessionToken)	If token blacklisting is enabled, and there is already an active, valid session token found in the request, this method will add the previous session token to the blacklist, preventing its reuse in the future.
protected List<AuthenticationStrategyDelegate>	getAuthenticationStrategyDelegates()
protected AuthorizedClient	getClient(org.springframework.security.core.Authentication authentication)
protected AuthorizedClientService<AuthorizedClient>	getClientService()
protected OAuth2UserDetails	getOAuth2UserDetails(@NonNull AuthenticationStrategyDelegate delegate, @NonNull org.springframework.security.core.Authentication authentication, AuthorizedClient client)
protected jakarta.servlet.http.Cookie	getPreviousSessionCookie(jakarta.servlet.http.HttpServletRequest request, String sessionCookieName)
protected SessionTokenBlacklistUtility	getSessionTokenBlacklistUtility()
protected StatelessUtil	getStatelessUtil()
protected AuthenticationStrategyDelegate	getSupportingAuthenticationStrategyDelegate(@NonNull org.springframework.security.core.Authentication authentication, AuthorizedClient authorizedClient)
protected TokenBlacklistManager	getTokenBlacklistManager()
protected void	handleUnexpectedTokenBlacklistOperationException(TokenBlacklistRequest request, TokenBlacklistOperationException exception)
void	onAuthentication(@NonNull org.springframework.security.core.Authentication authentication, @NonNull jakarta.servlet.http.HttpServletRequest request, @NonNull jakarta.servlet.http.HttpServletResponse response)
protected void	populateRememberMeLoginClaimsIfApplicable(@NonNull org.springframework.security.core.Authentication authentication, Map<String,Object> destinationClaimsMap)	If this is a session token issued after successful remember-me auto-login, set additional claims on the session token.
protected void	populateThirdPartyLoginClaimsIfApplicable(@NonNull AuthenticationStrategyDelegate delegate, @NonNull org.springframework.security.core.Authentication authentication, AuthorizedClient authorizedClient, @NonNull OAuth2UserDetails oAuth2UserDetails, Map<String,Object> destinationClaimsMap)	If this is a session token issued after successful third party login, set additional claims on the session token.
protected void	setSessionCookie(@NonNull jakarta.servlet.http.HttpServletRequest request, @NonNull jakarta.servlet.http.HttpServletResponse response, @NonNull AuthenticationStrategyDelegate delegate, @NonNull org.springframework.security.core.Authentication authentication, AuthorizedClient authorizedClient, @NonNull OAuth2UserDetails oAuth2UserDetails)
void	setSessionTokenBlacklistUtility(SessionTokenBlacklistUtility sessionTokenBlacklistUtility)
void	setTokenBlacklistManager(TokenBlacklistManager tokenBlacklistManager)
protected boolean	shouldSetCookie(@NonNull org.springframework.security.core.Authentication authentication, @NonNull jakarta.servlet.http.HttpServletRequest request, @NonNull jakarta.servlet.http.HttpServletResponse response)	Determine if the session cookie should be set on the response.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

DefaultSessionAuthenticationStrategy

public DefaultSessionAuthenticationStrategy(StatelessUtil statelessUtil,
 List<AuthenticationStrategyDelegate> authenticationStrategyDelegates,
 AuthorizedClientService<AuthorizedClient> clientService)

Method Details

onAuthentication

public void onAuthentication(@NonNull
 @NonNull org.springframework.security.core.Authentication authentication,
 @NonNull
 @NonNull jakarta.servlet.http.HttpServletRequest request,
 @NonNull
 @NonNull jakarta.servlet.http.HttpServletResponse response)
                      throws org.springframework.security.web.authentication.session.SessionAuthenticationException

Specified by:

onAuthentication in interface org.springframework.security.web.authentication.session.SessionAuthenticationStrategy

Throws:

org.springframework.security.web.authentication.session.SessionAuthenticationException

shouldSetCookie

protected boolean shouldSetCookie(@NonNull
 @NonNull org.springframework.security.core.Authentication authentication,
 @NonNull
 @NonNull jakarta.servlet.http.HttpServletRequest request,
 @NonNull
 @NonNull jakarta.servlet.http.HttpServletResponse response)

Determine if the session cookie should be set on the response.

Parameters:

authentication - The successful session authentication.

request - The web request

response - The web response

Returns:

True if the session cookie should be added to the response, false otherwise.

getSupportingAuthenticationStrategyDelegate

protected AuthenticationStrategyDelegate getSupportingAuthenticationStrategyDelegate(@NonNull
 @NonNull org.springframework.security.core.Authentication authentication,
 @Nullable
 AuthorizedClient authorizedClient)

getOAuth2UserDetails

protected OAuth2UserDetails getOAuth2UserDetails(@NonNull
 @NonNull AuthenticationStrategyDelegate delegate,
 @NonNull
 @NonNull org.springframework.security.core.Authentication authentication,
 @Nullable
 AuthorizedClient client)

getClient

@Nullable
protected AuthorizedClient getClient(org.springframework.security.core.Authentication authentication)

setSessionCookie

protected void setSessionCookie(@NonNull
 @NonNull jakarta.servlet.http.HttpServletRequest request,
 @NonNull
 @NonNull jakarta.servlet.http.HttpServletResponse response,
 @NonNull
 @NonNull AuthenticationStrategyDelegate delegate,
 @NonNull
 @NonNull org.springframework.security.core.Authentication authentication,
 @Nullable
 AuthorizedClient authorizedClient,
 @NonNull
 @NonNull OAuth2UserDetails oAuth2UserDetails)

blacklistPreviousSessionTokenIfApplicable

protected void blacklistPreviousSessionTokenIfApplicable(jakarta.servlet.http.HttpServletRequest request,
 String sessionCookieName,
 OAuth2SessionToken newSessionToken)

If token blacklisting is enabled, and there is already an active, valid session token found in the request, this method will add the previous session token to the blacklist, preventing its reuse in the future. This ensures only the newly refreshed value is valid, and the old token is not.

Parameters:

request - the HTTP request on which to check for a session cookie

sessionCookieName - the name of the session cookie to check for (matches the session cookie we are about to set)

newSessionToken - the new session token we are about to set

Since:

AuthenticationServices 3.0.0, Release Train 3.0.0

getPreviousSessionCookie

@Nullable
protected jakarta.servlet.http.Cookie getPreviousSessionCookie(jakarta.servlet.http.HttpServletRequest request,
 String sessionCookieName)

handleUnexpectedTokenBlacklistOperationException

protected void handleUnexpectedTokenBlacklistOperationException(TokenBlacklistRequest request,
 TokenBlacklistOperationException exception)

populateThirdPartyLoginClaimsIfApplicable

protected void populateThirdPartyLoginClaimsIfApplicable(@NonNull
 @NonNull AuthenticationStrategyDelegate delegate,
 @NonNull
 @NonNull org.springframework.security.core.Authentication authentication,
 @Nullable
 AuthorizedClient authorizedClient,
 @NonNull
 @NonNull OAuth2UserDetails oAuth2UserDetails,
 Map<String,Object> destinationClaimsMap)

If this is a session token issued after successful third party login, set additional claims on the session token.

Parameters:

delegate - the AuthenticationStrategyDelegate that was determined to support this authentication

authentication - the Authentication that was just successfully authenticated. For third-party login, this is usually OAuth2AuthenticationToken

authorizedClient - (optional) the Broadleaf AuthorizedClient this authentication was for

oAuth2UserDetails - the user details that were built for the current authentication by delegate

destinationClaimsMap - the map of claims this method will populate. These will go on the final session token.

populateRememberMeLoginClaimsIfApplicable

protected void populateRememberMeLoginClaimsIfApplicable(@NonNull
 @NonNull org.springframework.security.core.Authentication authentication,
 Map<String,Object> destinationClaimsMap)

If this is a session token issued after successful remember-me auto-login, set additional claims on the session token.

Parameters:

authentication - the Authentication that was just successfully authenticated. If auto-login was performed, this is usually RememberMeAuthenticationToken

destinationClaimsMap - the map of claims this method will populate. These will go on the final session token.

getStatelessUtil

protected StatelessUtil getStatelessUtil()

getAuthenticationStrategyDelegates

protected List<AuthenticationStrategyDelegate> getAuthenticationStrategyDelegates()

getClientService

protected AuthorizedClientService<AuthorizedClient> getClientService()

setTokenBlacklistManager

@Autowired(required=false)
public void setTokenBlacklistManager(TokenBlacklistManager tokenBlacklistManager)

getTokenBlacklistManager

@Nullable
protected TokenBlacklistManager getTokenBlacklistManager()

setSessionTokenBlacklistUtility

@Autowired
public void setSessionTokenBlacklistUtility(SessionTokenBlacklistUtility sessionTokenBlacklistUtility)

getSessionTokenBlacklistUtility

protected SessionTokenBlacklistUtility getSessionTokenBlacklistUtility()