libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions

sso session idle and max lifespan

Browse source
This commit is contained in:
Bill Burke 2014-05-15 17:25:57 -04:00
parent 27efd3c0a4
commit bc2360e985
15 changed files with 86 additions and 64 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
forms/account-freemarker/src/main/java/org/keycloak/account/freemarker/FreeMarkerAccount.java
View file

@ -121,7 +121,7 @@ public class FreeMarkerAccount implements Account {
attributes.put("log", new LogBean(events));
break;
case SESSIONS:
attributes.put("sessions", new SessionsBean(sessions));
attributes.put("sessions", new SessionsBean(realm, sessions));
break;
}

13
forms/account-freemarker/src/main/java/org/keycloak/account/freemarker/model/SessionsBean.java Normal file → Executable file
View file

@ -1,5 +1,6 @@
package org.keycloak.account.freemarker.model;
import org.keycloak.models.RealmModel;
import org.keycloak.models.UserSessionModel;
import org.keycloak.util.Time;
@ -13,11 +14,12 @@ import java.util.List;
public class SessionsBean {
private List<UserSessionBean> events;
private RealmModel realm;
public SessionsBean(List<UserSessionModel> sessions) {
public SessionsBean(RealmModel realm, List<UserSessionModel> sessions) {
this.events = new LinkedList<UserSessionBean>();
for (UserSessionModel session : sessions) {
this.events.add(new UserSessionBean(session));
this.events.add(new UserSessionBean(realm, session));
}
}
@ -28,8 +30,10 @@ public class SessionsBean {
public static class UserSessionBean {
private UserSessionModel session;
private RealmModel realm;
public UserSessionBean(UserSessionModel session) {
public UserSessionBean(RealmModel realm, UserSessionModel session) {
this.realm = realm;
this.session = session;
}
@ -42,7 +46,8 @@ public class SessionsBean {
}
public Date getExpires() {
return Time.toDate(session.getExpires());
int max = session.getStarted() + realm.getSsoSessionMaxLifespan();
return Time.toDate(max);
}
}

4
model/api/src/main/java/org/keycloak/models/UserSessionModel.java Normal file → Executable file
View file

@ -21,8 +21,8 @@ public interface UserSessionModel {
void setStarted(int started);
int getExpires();
int getLastSessionRefresh();
void setExpires(int expires);
void setLastSessionRefresh(int seconds);
}

8
model/jpa/src/main/java/org/keycloak/models/jpa/RealmAdapter.java
View file

@ -1389,10 +1389,9 @@ public class RealmAdapter implements RealmModel {
entity.setIpAddress(ipAddress);
int currentTime = Time.currentTime();
int expires = currentTime + realm.getSsoSessionIdleTimeout();
entity.setStarted(currentTime);
entity.setExpires(expires);
entity.setLastSessionRefresh(currentTime);
em.persist(entity);
return new UserSessionAdapter(entity);
@ -1429,7 +1428,10 @@ public class RealmAdapter implements RealmModel {
@Override
public void removeExpiredUserSessions() {
em.createNamedQuery("removeUserSessionExpired").setParameter("currentTime", Time.currentTime()).executeUpdate();
em.createNamedQuery("removeUserSessionExpired")
.setParameter("maxTime", Time.currentTime() - getSsoSessionMaxLifespan())
.setParameter("idleTime", Time.currentTime() - getSsoSessionIdleTimeout())
.executeUpdate();
}
}

9
model/jpa/src/main/java/org/keycloak/models/jpa/UserSessionAdapter.java Normal file → Executable file
View file

@ -60,13 +60,12 @@ public class UserSessionAdapter implements UserSessionModel {
}
@Override
public int getExpires() {
return entity.getExpires();
public int getLastSessionRefresh() {
return entity.getLastSessionRefresh();
}
@Override
public void setExpires(int expires) {
entity.setExpires(expires);
public void setLastSessionRefresh(int seconds) {
entity.setLastSessionRefresh(seconds);
}
}

13
model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserSessionEntity.java Normal file → Executable file
View file

@ -17,7 +17,7 @@ import javax.persistence.NamedQuery;
@NamedQueries({
@NamedQuery(name = "getUserSessionByUser", query = "select s from UserSessionEntity s where s.user = :user"),
@NamedQuery(name = "removeUserSessionByUser", query = "delete from UserSessionEntity s where s.user = :user"),
@NamedQuery(name = "removeUserSessionExpired", query = "delete from UserSessionEntity s where s.expires < :currentTime")
@NamedQuery(name = "removeUserSessionExpired", query = "delete from UserSessionEntity s where s.started < :maxTime or s.lastSessionRefresh < :idleTime")
})
public class UserSessionEntity {
@ -33,7 +33,7 @@ public class UserSessionEntity {
int started;
int expires;
int lastSessionRefresh;
public String getId() {
return id;
@ -67,12 +67,11 @@ public class UserSessionEntity {
this.started = started;
}
public int getExpires() {
return expires;
public int getLastSessionRefresh() {
return lastSessionRefresh;
}
public void setExpires(int expires) {
this.expires = expires;
public void setLastSessionRefresh(int lastSessionRefresh) {
this.lastSessionRefresh = lastSessionRefresh;
}
}

11
model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/RealmAdapter.java
View file

@ -1356,10 +1356,9 @@ public class RealmAdapter extends AbstractMongoAdapter<MongoRealmEntity> impleme
entity.setIpAddress(ipAddress);
int currentTime = Time.currentTime();
int expires = currentTime + realm.getSsoSessionIdleTimeout();
entity.setStarted(currentTime);
entity.setExpires(expires);
entity.setLastSessionRefresh(currentTime);
getMongoStore().insertEntity(entity, invocationContext);
return new UserSessionAdapter(entity, this, invocationContext);
@ -1398,8 +1397,14 @@ public class RealmAdapter extends AbstractMongoAdapter<MongoRealmEntity> impleme
@Override
public void removeExpiredUserSessions() {
int currentTime = Time.currentTime();
DBObject query = new QueryBuilder()
.and("expires").lessThan(Time.currentTime())
.and("started").lessThan(currentTime - realm.getSsoSessionMaxLifespan())
.get();
getMongoStore().removeEntities(MongoUserSessionEntity.class, query, invocationContext);
query = new QueryBuilder()
.and("lastSessionRefresh").lessThan(currentTime - realm.getSsoSessionIdleTimeout())
.get();
getMongoStore().removeEntities(MongoUserSessionEntity.class, query, invocationContext);

8
model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/UserSessionAdapter.java Normal file → Executable file
View file

@ -65,13 +65,13 @@ public class UserSessionAdapter implements UserSessionModel {
}
@Override
public int getExpires() {
return entity.getExpires();
public int getLastSessionRefresh() {
return entity.getLastSessionRefresh();
}
@Override
public void setExpires(int expires) {
entity.setExpires(expires);
public void setLastSessionRefresh(int seconds) {
entity.setLastSessionRefresh(seconds);
}
}

10
model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoUserSessionEntity.java Normal file → Executable file
View file

@ -17,7 +17,7 @@ public class MongoUserSessionEntity extends AbstractIdentifiableEntity implement
private int started;
private int expires;
private int lastSessionRefresh;
public String getUser() {
return user;
@ -43,12 +43,12 @@ public class MongoUserSessionEntity extends AbstractIdentifiableEntity implement
this.started = started;
}
public int getExpires() {
return expires;
public int getLastSessionRefresh() {
return lastSessionRefresh;
}
public void setExpires(int expires) {
this.expires = expires;
public void setLastSessionRefresh(int lastSessionRefresh) {
this.lastSessionRefresh = lastSessionRefresh;
}
@Override

14
services/src/main/java/org/keycloak/services/managers/AppAuthManager.java
View file

@ -2,22 +2,13 @@ package org.keycloak.services.managers;
import org.jboss.logging.Logger;
import org.jboss.resteasy.spi.UnauthorizedException;
import org.keycloak.RSATokenVerifier;
import org.keycloak.VerificationException;
import org.keycloak.jose.jws.JWSInput;
import org.keycloak.jose.jws.crypto.RSAProvider;
import org.keycloak.models.ClientModel;
import org.keycloak.models.RealmModel;
import org.keycloak.models.UserModel;
import org.keycloak.provider.ProviderSession;
import org.keycloak.representations.AccessToken;
import org.jboss.resteasy.spi.BadRequestException;
import javax.ws.rs.core.Cookie;
import javax.ws.rs.core.HttpHeaders;
import javax.ws.rs.core.NewCookie;
import javax.ws.rs.core.UriInfo;
import java.net.URI;
/**
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@ -33,6 +24,11 @@ public class AppAuthManager extends AuthenticationManager {
public UserModel authenticateRequest(RealmModel realm, UriInfo uriInfo, HttpHeaders headers) {
AuthResult authResult = authenticateIdentityCookie(realm, uriInfo, headers);
if (authResult != null) {
Cookie remember = headers.getCookies().get(AuthenticationManager.KEYCLOAK_REMEMBER_ME);
boolean rememberMe = remember != null;
// refresh the cookies!
createLoginCookie(realm, authResult.getUser(), authResult.getSession(), uriInfo, rememberMe);
if (rememberMe) createRememberMeCookie(realm, uriInfo);
return authResult.getUser();
} else {
return authenticateBearerToken(realm, uriInfo, headers);

32
services/src/main/java/org/keycloak/services/managers/AuthenticationManager.java
View file

@ -61,6 +61,11 @@ public class AuthenticationManager {
this.protector = protector;
}
public static boolean isSessionValid(RealmModel realm, UserSessionModel session) {
int currentTime = Time.currentTime();
return session == null || session.getLastSessionRefresh() + realm.getSsoSessionIdleTimeout() < currentTime || session.getStarted() + realm.getSsoSessionMaxLifespan() < currentTime;
}
public AccessToken createIdentityToken(RealmModel realm, UserModel user, UserSessionModel session) {
logger.info("createIdentityToken");
AccessToken token = new AccessToken();
@ -77,7 +82,7 @@ public class AuthenticationManager {
return token;
}
public void createLoginCookie(Response.ResponseBuilder builder, RealmModel realm, UserModel user, UserSessionModel session, UriInfo uriInfo, boolean rememberMe) {
public void createLoginCookie(RealmModel realm, UserModel user, UserSessionModel session, UriInfo uriInfo, boolean rememberMe) {
logger.info("createLoginCookie");
String cookiePath = getIdentityCookiePath(realm, uriInfo);
AccessToken identityToken = createIdentityToken(realm, user, session);
@ -97,11 +102,11 @@ public class AuthenticationManager {
sessionCookieValue += "-" + session.getId();
}
// THIS SHOULD NOT BE A HTTPONLY COOKIE! It is used for OpenID Connect Iframe Session support!
builder.cookie(new NewCookie(KEYCLOAK_SESSION_COOKIE, sessionCookieValue, cookiePath, null, null, maxAge, secureOnly));
CookieHelper.addCookie(KEYCLOAK_SESSION_COOKIE, sessionCookieValue, cookiePath, null, null, maxAge, secureOnly, false);
}
public void createRememberMeCookie(HttpResponse response, RealmModel realm, UriInfo uriInfo) {
public void createRememberMeCookie(RealmModel realm, UriInfo uriInfo) {
String path = getIdentityCookiePath(realm, uriInfo);
boolean secureOnly = !realm.isSslNotRequired();
// remember me cookie should be persistent
@ -121,6 +126,7 @@ public class AuthenticationManager {
String path = getIdentityCookiePath(realm, uriInfo);
expireCookie(realm, KEYCLOAK_IDENTITY_COOKIE, path, true);
expireCookie(realm, KEYCLOAK_SESSION_COOKIE, path, false);
expireRememberMeCookie(realm, uriInfo);
}
public void expireRememberMeCookie(RealmModel realm, UriInfo uriInfo) {
logger.debug("Expiring remember me cookie");
@ -146,15 +152,9 @@ public class AuthenticationManager {
public AuthResult authenticateIdentityCookie(RealmModel realm, UriInfo uriInfo, HttpHeaders headers, boolean checkActive) {
logger.info("authenticateIdentityCookie");
String cookieName = KEYCLOAK_IDENTITY_COOKIE;
return authenticateIdentityCookie(realm, uriInfo, headers, cookieName, checkActive);
}
private AuthResult authenticateIdentityCookie(RealmModel realm, UriInfo uriInfo, HttpHeaders headers, String cookieName, boolean checkActive) {
logger.info("authenticateIdentityCookie");
Cookie cookie = headers.getCookies().get(cookieName);
Cookie cookie = headers.getCookies().get(KEYCLOAK_IDENTITY_COOKIE);
if (cookie == null) {
logger.infov("authenticateCookie could not find cookie: {0}", cookieName);
logger.infov("authenticateCookie could not find cookie: {0}", KEYCLOAK_IDENTITY_COOKIE);
return null;
}
@ -162,7 +162,9 @@ public class AuthenticationManager {
AuthResult authResult = verifyIdentityToken(realm, uriInfo, checkActive, tokenString);
if (authResult == null) {
expireIdentityCookie(realm, uriInfo);
return null;
}
authResult.getSession().setLastSessionRefresh(Time.currentTime());
return authResult;
}
@ -174,7 +176,6 @@ public class AuthenticationManager {
logger.info("Checking if identity token is active");
if (!token.isActive() || token.getIssuedAt() < realm.getNotBefore()) {
logger.info("identity cookie expired");
expireIdentityCookie(realm, uriInfo);
return null;
} else {
logger.info("token.isActive() : " + token.isActive());
@ -195,9 +196,12 @@ public class AuthenticationManager {
}
UserSessionModel session = realm.getUserSession(token.getSessionState());
if (session == null || session.getExpires() < Time.currentTime()) {
int currentTime = Time.currentTime();
if (isSessionValid(realm, session)) {
if (session != null) {
realm.removeUserSession(session);
}
logger.info("User session not active");
expireIdentityCookie(realm, uriInfo);
return null;
}

12
services/src/main/java/org/keycloak/services/managers/TokenManager.java
View file

@ -137,7 +137,11 @@ public class TokenManager {
}
UserSessionModel session = realm.getUserSession(refreshToken.getSessionState());
if (session == null || session.getExpires() < Time.currentTime()) {
int currentTime = Time.currentTime();
if (AuthenticationManager.isSessionValid(realm, session)) {
if (session != null) {
realm.removeUserSession(session);
}
throw new OAuthErrorException(OAuthErrorException.INVALID_GRANT, "Session not active", "Session not active");
}
@ -191,6 +195,12 @@ public class TokenManager {
AccessToken accessToken = initToken(realm, client, user, session);
accessToken.setRealmAccess(refreshToken.getRealmAccess());
accessToken.setResourceAccess(refreshToken.getResourceAccess());
// only refresh session if next token refresh will be after idle timeout
if (currentTime + realm.getAccessTokenLifespan() > session.getLastSessionRefresh() + realm.getSsoSessionIdleTimeout()) {
session.setLastSessionRefresh(currentTime);
}
return accessToken;
}

2
services/src/main/java/org/keycloak/services/resources/RequiredActionsService.java
View file

@ -408,7 +408,7 @@ public class RequiredActionsService {
AuthenticationManager authManager = new AuthenticationManager(providerSession);
UserSessionModel session = realm.getUserSession(accessCode.getSessionState());
if (session == null || session.getExpires() < Time.currentTime()) {
if (AuthenticationManager.isSessionValid(realm, session)) {
return Flows.oauth(realm, request, uriInfo, authManager, tokenManager).redirectError(accessCode.getClient(), "access_denied", accessCode.getState(), accessCode.getRedirectUri());
}
audit.session(session);

8
services/src/main/java/org/keycloak/services/resources/TokenService.java
View file

@ -58,7 +58,6 @@ import javax.ws.rs.core.Context;
import javax.ws.rs.core.HttpHeaders;
import javax.ws.rs.core.MediaType;
import javax.ws.rs.core.MultivaluedMap;
import javax.ws.rs.core.NewCookie;
import javax.ws.rs.core.Response;
import javax.ws.rs.core.SecurityContext;
import javax.ws.rs.core.UriBuilder;
@ -374,7 +373,7 @@ public class TokenService {
AuthenticationStatus status = authManager.authenticateForm(clientConnection, realm, formData);
if (remember) {
authManager.createRememberMeCookie(response, realm, uriInfo);
authManager.createRememberMeCookie(realm, uriInfo);
} else {
authManager.expireRememberMeCookie(realm, uriInfo);
}
@ -636,7 +635,7 @@ public class TokenService {
}
UserSessionModel session = realm.getUserSession(accessCode.getSessionState());
if (session == null || session.getExpires() < Time.currentTime()) {
if (AuthenticationManager.isSessionValid(realm, session)) {
Map<String, String> res = new HashMap<String, String>();
res.put(OAuth2Constants.ERROR, "invalid_grant");
res.put(OAuth2Constants.ERROR_DESCRIPTION, "Session not active");
@ -915,7 +914,8 @@ public class TokenService {
}
UserSessionModel session = realm.getUserSession(accessCodeEntry.getSessionState());
if (session == null || session.getExpires() < Time.currentTime()) {
int currentTime = Time.currentTime();
if (AuthenticationManager.isSessionValid(realm, session)) {
audit.error(Errors.INVALID_CODE);
return oauth.forwardToSecurityFailure("Session not active");
}

4
services/src/main/java/org/keycloak/services/resources/flows/OAuthFlows.java
View file

@ -93,7 +93,9 @@ public class OAuthFlows {
Response.ResponseBuilder location = Response.status(302).location(redirectUri.build());
Cookie remember = request.getHttpHeaders().getCookies().get(AuthenticationManager.KEYCLOAK_REMEMBER_ME);
rememberMe = rememberMe || remember != null;
authManager.createLoginCookie(location, realm, accessCode.getUser(), session, uriInfo, rememberMe);
// refresh the cookies!
authManager.createLoginCookie(realm, accessCode.getUser(), session, uriInfo, rememberMe);
if (rememberMe) authManager.createRememberMeCookie(realm, uriInfo);
return location.build();
}
}