diff options
Diffstat (limited to 'id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/AbstractAuthProtocolModulController.java')
| -rw-r--r-- | id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/AbstractAuthProtocolModulController.java | 51 |
1 files changed, 29 insertions, 22 deletions
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/AbstractAuthProtocolModulController.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/AbstractAuthProtocolModulController.java index 79afba412..95a7660d1 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/AbstractAuthProtocolModulController.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/AbstractAuthProtocolModulController.java @@ -37,7 +37,7 @@ import at.gv.egovernment.moa.id.auth.exception.AuthenticationException; import at.gv.egovernment.moa.id.auth.servlet.AbstractController; import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters; import at.gv.egovernment.moa.id.commons.api.IRequest; -import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException; +import at.gv.egovernment.moa.id.commons.api.data.IAuthenticationSession; import at.gv.egovernment.moa.id.data.IAuthData; import at.gv.egovernment.moa.id.data.SLOInformationInterface; import at.gv.egovernment.moa.id.moduls.AuthenticationManager; @@ -86,10 +86,10 @@ public abstract class AbstractAuthProtocolModulController extends AbstractContro } - AuthenticationSession moaSession = authmanager.doAuthentication(req, resp, pendingReq); - if (moaSession != null) { + AuthenticationSession ssoMoaSession = authmanager.doAuthentication(req, resp, pendingReq); + if (ssoMoaSession != null) { //authenticated MOASession already exists --> protocol-specific postProcessing can start directly - finalizeAuthenticationProcess(req, resp, pendingReq, moaSession); + finalizeAuthenticationProcess(req, resp, pendingReq, ssoMoaSession); //transaction is finished, log transaction finished event revisionsLogger.logEvent(MOAIDEventConstants.TRANSACTION_DESTROYED, pendingReq.getUniqueTransactionIdentifier()); @@ -111,7 +111,7 @@ public abstract class AbstractAuthProtocolModulController extends AbstractContro protected String createNewSSOSessionCookie(HttpServletRequest req, HttpServletResponse resp, - IRequest pendingReq, AuthenticationSession moaSession) { + IRequest pendingReq, IAuthenticationSession moaSession) { Logger.debug("Add SSO information to MOASession."); //Store SSO information into database @@ -140,7 +140,7 @@ public abstract class AbstractAuthProtocolModulController extends AbstractContro * @throws Exception */ protected void finalizeAuthenticationProcess(HttpServletRequest req, HttpServletResponse resp, - IRequest pendingReq, AuthenticationSession moaSession) throws Exception { + IRequest pendingReq, IAuthenticationSession moaSession) throws Exception { String newSSOSessionId = null; @@ -161,9 +161,27 @@ public abstract class AbstractAuthProtocolModulController extends AbstractContro //Store OA specific SSO session information if an SSO cookie is set if (isSSOCookieSetted) { - try { - authenticatedSessionStorage.addSSOInformation(moaSession.getSessionID(), - newSSOSessionId, sloInformation, pendingReq); + try { + AuthenticationSession internalDBSSOSession = null; + + //create new SSO session, if actually no SSO session exists + if (MiscUtil.isEmpty(pendingReq.getInternalSSOSessionIdentifier())) { + internalDBSSOSession = authenticatedSessionStorage.createInternalSSOSession(pendingReq); + authenticatedSessionStorage.addSSOInformation(internalDBSSOSession.getSessionID(), + newSSOSessionId, sloInformation, pendingReq); + + //MOA SSO-session already exists only update is required + } else if (MiscUtil.isNotEmpty(pendingReq.getInternalSSOSessionIdentifier()) && + moaSession instanceof AuthenticationSession) { + authenticatedSessionStorage.addSSOInformation(moaSession.getSessionID(), + newSSOSessionId, sloInformation, pendingReq); + + } else { + Logger.fatal("MOA-Session data object has a suspect or unsupported type:" + moaSession.getClass().getName() + + " pendingReq_internalSsoId:" + pendingReq.getInternalSSOSessionIdentifier()); + throw new AuthenticationException("1299", null); + + } } catch (AuthenticationException e) { Logger.warn("SSO Session information can not be stored -> SSO is not enabled!"); @@ -218,19 +236,8 @@ public abstract class AbstractAuthProtocolModulController extends AbstractContro protected void removeUserSession(IRequest pendingReq, HttpServletRequest req, HttpServletResponse resp) { - try { - AuthenticationSession moaSession = authenticatedSessionStorage.getSession( - pendingReq.getMOASessionIdentifier()); - - if (moaSession != null) - authmanager.performOnlyIDPLogOut(req, resp, moaSession.getSessionID()); - - } catch (MOADatabaseException e) { - Logger.error("Remove user-session FAILED." , e); - - } - - + authmanager.performOnlyIDPLogOut(req, resp, pendingReq.getInternalSSOSessionIdentifier()); + } protected void buildProtocolSpecificErrorResponse(Throwable throwable, HttpServletRequest req, |