Package org.apache.juneau.rest.server.auth.oidc.rp

Class InMemorySessionStore

java.lang.Object

org.apache.juneau.rest.server.auth.oidc.rp.InMemorySessionStore

All Implemented Interfaces:

SessionStore

public class InMemorySessionStore
extends Object
implements SessionStore

In-memory SessionStore backed by a bounded-LRU map, indexed by sub and sid so it can satisfy back-channel logout.

This is the simpler single-instance / development option. It is lost on restart and breaks under horizontal scaling without sticky sessions; for production multi-instance deployments use SignedCookieSessionStore (stateless, the documented default) or a caller-supplied distributed store.

Eviction is the conjunction of a size cap (LRU) and per-session TTL (an expired session is treated as a miss and removed on lookup). Because it retains sessions server-side, it supports invalidateBySubject(String) and invalidateBySessionId(String).

Since:

10.0.0

Field Summary

Fields

Modifier and Type	Field	Description
static final int	DEFAULT_MAX_ENTRIES	Default maximum number of live sessions retained.

Constructor Summary

Constructors

Constructor	Description
InMemorySessionStore(int maxEntries, Clock clock)	Constructor.

Method Summary

Modifier and Type	Method	Description
static InMemorySessionStore	create()	Static creator with the default size cap.
static InMemorySessionStore	create(int maxEntries)	Static creator with a custom size cap.
String	createSessionCookieValue(OidcSession session)	Persists the supplied session and returns the opaque value to set as the session cookie.
void	invalidate(String cookieValue)	Invalidates the session identified by the supplied cookie value.
int	invalidateBySessionId(String sid)	Invalidates the session(s) bound to the supplied IdP session id (sid).
int	invalidateBySubject(String subject)	Invalidates every session belonging to the supplied subject (sub).
Optional<OidcSession>	lookup(String cookieValue)	Resolves a session from a cookie value.
int	size()	Returns the current live-session count.
boolean	supportsServerSideRevocation()	Returns whether this store can revoke sessions server-side (a prerequisite for back-channel logout).

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

DEFAULT_MAX_ENTRIES

public static final int DEFAULT_MAX_ENTRIES

Default maximum number of live sessions retained.

See Also:

• Constant Field Values

Constructor Details

InMemorySessionStore

public InMemorySessionStore(int maxEntries,
 Clock clock)

Constructor.

Parameters:

maxEntries - The maximum number of live sessions. Must be positive.

clock - The clock used for TTL comparisons. Must not be null.

Method Details

create

public static InMemorySessionStore create()

Static creator with the default size cap.

Returns:

A new store.

create

public static InMemorySessionStore create(int maxEntries)

Static creator with a custom size cap.

Parameters:

maxEntries - The maximum number of live sessions. Must be positive.

Returns:

A new store.

createSessionCookieValue

public String createSessionCookieValue(OidcSession session)

Description copied from interface: SessionStore

Persists the supplied session and returns the opaque value to set as the session cookie.

For a server-side store this is typically a random session id used as a lookup key; for a stateless cookie store it is the entire signed session payload.

Specified by:

createSessionCookieValue in interface SessionStore

Parameters:

session - The session to persist. Must not be null.

Returns:

The cookie value the client should send back on subsequent requests. Never null.

lookup

public Optional<OidcSession> lookup(String cookieValue)

Description copied from interface: SessionStore

Resolves a session from a cookie value.

Specified by:

lookup in interface SessionStore

Parameters:

cookieValue - The cookie value previously returned by SessionStore.createSessionCookieValue(org.apache.juneau.rest.server.auth.oidc.rp.OidcSession). Must not be null.

Returns:

The resolved session, or Optional.empty() if absent, expired, invalid, or tampered.

invalidate

public void invalidate(String cookieValue)

Description copied from interface: SessionStore

Invalidates the session identified by the supplied cookie value. No-op if absent.

Specified by:

invalidate in interface SessionStore

Parameters:

cookieValue - The cookie value. Must not be null.

supportsServerSideRevocation

public boolean supportsServerSideRevocation()

Description copied from interface: SessionStore

Returns whether this store can revoke sessions server-side (a prerequisite for back-channel logout).

Defaults to false — stateless cookie stores cannot revoke a session the server never retained.

Specified by:

supportsServerSideRevocation in interface SessionStore

Returns:

true if SessionStore.invalidateBySubject(String) / SessionStore.invalidateBySessionId(String) are supported.

invalidateBySubject

public int invalidateBySubject(String subject)

Description copied from interface: SessionStore

Invalidates every session belonging to the supplied subject (sub).

Used by OidcRelyingParty.backChannelLogout(java.lang.String) when the IdP-pushed logout token carries a sub but no sid.

Specified by:

invalidateBySubject in interface SessionStore

Parameters:

subject - The subject identifier. Must not be null or blank.

Returns:

The number of sessions invalidated.

invalidateBySessionId

public int invalidateBySessionId(String sid)

Description copied from interface: SessionStore

Invalidates the session(s) bound to the supplied IdP session id (sid).

Used by OidcRelyingParty.backChannelLogout(java.lang.String) when the IdP-pushed logout token carries a sid.

Specified by:

invalidateBySessionId in interface SessionStore

Parameters:

sid - The IdP session id. Must not be null or blank.

Returns:

The number of sessions invalidated.

size

public int size()

Returns the current live-session count. Primarily for tests and metrics.

Returns:

The session count.