Uses of Interface
com.broadleafcommerce.auth.user.session.OAuth2SessionToken

Packages that use OAuth2SessionToken

Package	Description
com.broadleafcommerce.auth.authorization.security.tokenblacklist.support
com.broadleafcommerce.auth.security.service
com.broadleafcommerce.auth.user.service
com.broadleafcommerce.auth.user.session
com.broadleafcommerce.auth.user.session.token.enhancer
com.broadleafcommerce.auth.user.web.endpoint

Uses of OAuth2SessionToken in com.broadleafcommerce.auth.authorization.security.tokenblacklist.support

Methods in com.broadleafcommerce.auth.authorization.security.tokenblacklist.support with parameters of type OAuth2SessionToken

Modifier and Type	Method	Description
void	SessionTokenBlacklistUtility.blacklistPreviousSessionTokenIfApplicable(TokenBlacklistManager blacklistManager, OAuth2SessionToken newSessionToken, Supplier<jakarta.servlet.http.Cookie> previousCookieSupplier, BiConsumer<TokenBlacklistRequest,TokenBlacklistOperationException> exceptionHandler, String loggablePurpose)	Orchestrates the blacklisting of a previous, existing session token when a new session token is being issued.

Uses of OAuth2SessionToken in com.broadleafcommerce.auth.security.service

Methods in com.broadleafcommerce.auth.security.service with parameters of type OAuth2SessionToken

Modifier and Type	Method	Description
protected void	DefaultUserLoginService.blacklistPreviousSessionTokenIfApplicable(jakarta.servlet.http.HttpServletRequest request, String clientId, OAuth2SessionToken newSessionToken)	If token blacklisting is enabled, and there is already an active, valid session token found in the request, this method will add the previous session token to the blacklist, preventing its reuse in the future.

Uses of OAuth2SessionToken in com.broadleafcommerce.auth.user.service

Methods in com.broadleafcommerce.auth.user.service that return OAuth2SessionToken

Modifier and Type	Method	Description
OAuth2SessionToken	DefaultImpersonationService.getImpersonationSessionToken(ImpersonationRequestToken token, OAuth2UserDetails impersonatedUser)
OAuth2SessionToken	ImpersonationService.getImpersonationSessionToken(ImpersonationRequestToken impersonationRequest, OAuth2UserDetails impersonatedUser)	Creates an OAuth2SessionToken for the validated ImpersonationRequest.

Methods in com.broadleafcommerce.auth.user.service with parameters of type OAuth2SessionToken

Modifier and Type	Method	Description
protected void	DefaultSessionAuthenticationStrategy.blacklistPreviousSessionTokenIfApplicable(jakarta.servlet.http.HttpServletRequest request, String sessionCookieName, OAuth2SessionToken newSessionToken)	If token blacklisting is enabled, and there is already an active, valid session token found in the request, this method will add the previous session token to the blacklist, preventing its reuse in the future.

Uses of OAuth2SessionToken in com.broadleafcommerce.auth.user.session

Classes in com.broadleafcommerce.auth.user.session that implement OAuth2SessionToken

Modifier and Type	Class	Description
class	DefaultOAuth2SessionToken	An OAuth2SessionToken that holds the claims within a HashMap.

Methods in com.broadleafcommerce.auth.user.session that return OAuth2SessionToken

Modifier and Type	Method	Description
OAuth2SessionToken	StatelessUtil.getSessionToken(String clientId, String userId, String subject, Map<String,Object> additionalClaims)	Creates a OAuth2SessionToken for the provided client ID and subject with the set of additional claims.
OAuth2SessionToken	StatelessUtilImpl.getSessionToken(String clientId, String userId, String subject, Map<String,Object> additionalClaims)
OAuth2SessionToken	OAuth2SessionAuthenticationToken.getToken()	The JWT token from the BLSID-[client_id] session cookie.
OAuth2SessionToken	StatelessUtil.refreshSessionToken(OAuth2SessionToken sessionToken)	Returns a OAuth2SessionToken with a refreshed expiration time.
OAuth2SessionToken	StatelessUtilImpl.refreshSessionToken(OAuth2SessionToken sessionToken)

Methods in com.broadleafcommerce.auth.user.session with parameters of type OAuth2SessionToken

Modifier and Type	Method	Description
jakarta.servlet.http.Cookie	StatelessUtil.createSessionCookie(OAuth2SessionToken sessionToken)	Deprecated. in favor of StatelessUtil.getSessionCookie(OAuth2SessionToken)
jakarta.servlet.http.Cookie	StatelessUtilImpl.createSessionCookie(OAuth2SessionToken sessionToken)
protected org.springframework.security.core.Authentication	OAuth2SessionAuthenticationProvider.createSuccessAuthentication(OAuth2UserDetails user, OAuth2SessionToken sessionToken)
protected Collection<org.springframework.security.core.GrantedAuthority>	OAuth2SessionAuthenticationProvider.getAuthorities(OAuth2UserDetails user, OAuth2SessionToken sessionToken)
org.springframework.http.ResponseCookie	StatelessUtil.getSessionCookie(OAuth2SessionToken sessionToken)	Gets a ResponseCookie for the OAuth2SessionToken.
org.springframework.http.ResponseCookie	StatelessUtilImpl.getSessionCookie(OAuth2SessionToken sessionToken)
protected boolean	OAuth2SessionAuthenticationProvider.isSessionTokenFromThirdPartyLogin(OAuth2SessionToken sessionToken)
protected OAuth2UserDetails	OAuth2SessionAuthenticationProvider.loadUser(com.nimbusds.jwt.SignedJWT jwt, OAuth2SessionToken sessionToken, String clientId)	Loads the appropriate user for the request.
OAuth2SessionToken	StatelessUtil.refreshSessionToken(OAuth2SessionToken sessionToken)	Returns a OAuth2SessionToken with a refreshed expiration time.
OAuth2SessionToken	StatelessUtilImpl.refreshSessionToken(OAuth2SessionToken sessionToken)
protected void	OAuth2SessionAuthenticationProvider.validateCredentialsNonExpired(OAuth2UserDetails userDetails, String clientId, OAuth2SessionToken sessionToken)	Validate that for the provided session token, the associated user's credentials are not considered expired.
protected void	OAuth2SessionAuthenticationProvider.validateUserDetails(OAuth2UserDetails userDetails, String clientId, OAuth2SessionToken sessionToken)

Constructors in com.broadleafcommerce.auth.user.session with parameters of type OAuth2SessionToken

Modifier	Constructor	Description
	DefaultOAuth2SessionToken(OAuth2SessionToken sessionToken)	Copy constructor for session token.
	OAuth2SessionAuthenticationToken(OAuth2SessionToken sessionToken, Collection<? extends org.springframework.security.core.GrantedAuthority> authorities)	This constructor should only be used by AuthenticationManager or AuthenticationProvider implementations that are satisfied with producing a trusted (i.e.
	OAuth2SessionAuthenticationToken(OAuth2SessionToken sessionToken, Collection<? extends org.springframework.security.core.GrantedAuthority> authorities, Object principal)	This constructor should only be used by AuthenticationManager or AuthenticationProvider implementations that are satisfied with producing a trusted (i.e.

Uses of OAuth2SessionToken in com.broadleafcommerce.auth.user.session.token.enhancer

Methods in com.broadleafcommerce.auth.user.session.token.enhancer that return types with arguments of type OAuth2SessionToken

Modifier and Type	Method	Description
protected Optional<OAuth2SessionToken>	AbstractUserAccessTokenEnhancer.getSessionToken(org.springframework.security.core.Authentication userPrincipal)	Get the session token from the authentication token.
protected Optional<OAuth2SessionToken>	CurrentUserCacheAccessTokenEnhancer.getSessionToken(org.springframework.security.core.Authentication userPrincipal)	Get the session token from the authentication token.
Optional<OAuth2SessionToken>	TokenEnhancerUtility.getSessionToken(org.springframework.security.core.Authentication userPrincipal)	Get the session token from the authentication token.

Uses of OAuth2SessionToken in com.broadleafcommerce.auth.user.web.endpoint

Methods in com.broadleafcommerce.auth.user.web.endpoint with parameters of type OAuth2SessionToken

Modifier and Type	Method	Description
protected void	ImpersonationEndpoint.blacklistPreviousSessionTokenIfApplicable(jakarta.servlet.http.HttpServletRequest request, String clientId, OAuth2SessionToken newSessionToken)	Intercepts and blacklists any active session token previously stored in the request's cookies before issuing a new impersonation session.