001/*
002 * Licensed to the Apache Software Foundation (ASF) under one or more
003 * contributor license agreements.  See the NOTICE file distributed with
004 * this work for additional information regarding copyright ownership.
005 * The ASF licenses this file to You under the Apache License, Version 2.0
006 * (the "License"); you may not use this file except in compliance with
007 * the License.  You may obtain a copy of the License at
008 *
009 *      http://www.apache.org/licenses/LICENSE-2.0
010 *
011 * Unless required by applicable law or agreed to in writing, software
012 * distributed under the License is distributed on an "AS IS" BASIS,
013 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
014 * See the License for the specific language governing permissions and
015 * limitations under the License.
016 */
017package org.apache.juneau.rest.server.auth.saml;
018
019/**
020 * SPI for the registry of outstanding SAML authentication request IDs.
021 *
022 * <p>
023 * {@link SamlAssertionValidator#rememberAuthnRequest(String)} records the ID of each request this SP sends, and a
024 * response whose confirmation carries a matching {@code InResponseTo} consumes it.  Each ID is accepted once.
025 * Multi-node deployments should supply an implementation backed by a store shared across every node, since the
026 * response may arrive at a different node than the one that sent the request.
027 *
028 * <p>
029 * Implementations must be thread-safe.
030 *
031 * @see InMemoryAuthnRequestStore
032 * @since 10.0.0
033 */
034public interface AuthnRequestStore {
035
036   /**
037    * Records an outstanding request ID.
038    *
039    * @param id The {@code ID} attribute of the outgoing request.  Never <jk>null</jk> or blank.
040    * @param expiresAtMs The epoch-millisecond instant after which the ID is no longer accepted.
041    * @param nowMs The current epoch-millisecond instant according to the validator's clock.
042    * @throws IllegalStateException If the store cannot accept more outstanding requests.
043    */
044   void remember(String id, long expiresAtMs, long nowMs);
045
046   /**
047    * Atomically removes a request ID and reports whether it was outstanding.
048    *
049    * @param id The {@code InResponseTo} value from the response.  Never <jk>null</jk> or blank.
050    * @param nowMs The current epoch-millisecond instant according to the validator's clock.
051    * @return <jk>true</jk> if the ID was registered, unexpired and not yet consumed.
052    */
053   boolean consume(String id, long nowMs);
054}