public class ClusteredSingleSignOn extends org.apache.catalina.authenticator.SingleSignOn implements org.apache.catalina.LifecycleListener, SSOLocalManager
Host
).Realm
that contains the shared user and role information must be configured on the same Container (or a
higher one), and not overridden at the web application level.org.apache.catalina.authenticator
package.Modifier and Type | Field and Description |
---|---|
static int |
DEFAULT_MAX_EMPTY_LIFE
By default we let SSOs without active sessions live for 30 mins
|
static int |
DEFAULT_PROCESS_EXPIRES_INTERVAL
By default we process expired SSOs no more often than once per minute
|
cache, cookieDomain, cookieHttpOnly, info, lifecycle, requireReauthentication, reverse, sm, started
Constructor and Description |
---|
ClusteredSingleSignOn(SSOClusterManager ssoClusterManager) |
Modifier and Type | Method and Description |
---|---|
void |
associate(String ssoId,
org.apache.catalina.Session session)
Associate the specified single sign on identifier with the specified Session.
|
void |
deregister(String ssoId)
Deregister the specified single sign on identifier, and invalidate any associated sessions.
|
protected void |
deregister(String ssoId,
org.apache.catalina.Session session)
Deregister the specified session.
|
long |
getLastProcessExpires()
Gets the timestamp of the start of the last check for overaged SSO's with no active sessions.
|
int |
getMaxEmptyLife()
Gets the max number of seconds an SSO with no active sessions will be usable by a request.
|
int |
getProcessExpiresInterval()
Gets the minimum number of seconds since the start of the last check for overaged SSO's with no active sessions before a
new run is allowed.
|
protected SingleSignOnEntry |
getSingleSignOnEntry(String ssoId)
Look up and return the cached SingleSignOn entry associated with this sso id value, if there is one; otherwise return
null . |
void |
invoke(org.apache.catalina.connector.Request request,
org.apache.catalina.connector.Response response)
Perform single-sign-on support processing for this request.
|
void |
lifecycleEvent(org.apache.catalina.LifecycleEvent event) |
protected void |
logout(String ssoId)
Deregister the given SSO, invalidating any associated sessions, then notify any cluster of the logout.
|
void |
notifySSOEmpty(String ssoId)
Callback from the SSOManager when it detects an SSO without any active sessions across the cluster
|
void |
notifySSONotEmpty(String ssoId)
Callback from the SSOManager when it detects an SSO that has active sessions across the cluster
|
boolean |
reauthenticate(String ssoId,
org.apache.catalina.Realm realm,
org.apache.catalina.connector.Request request)
Attempts reauthentication to the given
Realm using the credentials associated with the single sign-on
session identified by argument ssoId . |
void |
register(String ssoId,
Principal principal,
String authType,
String username,
String password)
Register the specified Principal as being associated with the specified value for the single sign on identifier.
|
void |
remoteUpdate(String ssoId,
SSOCredentials credentials)
Callback from the SSOClusterManager notifying the local manager that the credentials associated with an SSO have been
modified on another node.
|
protected void |
removeSession(String ssoId,
org.apache.catalina.Session session)
Remove a single Session from a SingleSignOn.
|
void |
sessionEvent(org.apache.catalina.SessionEvent event)
Updates the state of a single sign on session to reflect the destruction of a standard HTTP session.
|
void |
setMaxEmptyLife(int maxEmptyLife)
Sets the maximum number of seconds an SSO with no active sessions will be usable by a request.
|
void |
setProcessExpiresInterval(int processExpiresInterval)
Sets the minimum number of seconds since the start of the last check for overaged SSO's with no active sessions before a
new run is allowed.
|
void |
start()
Prepare for the beginning of active use of the public methods of this component.
|
void |
stop()
Gracefully terminate the active use of the public methods of this component.
|
void |
update(String ssoId,
Principal principal,
String authType,
String username,
String password)
Updates any
SingleSignOnEntry found under key ssoId with the given authentication data. |
addLifecycleListener, findLifecycleListeners, getCookieDomain, getInfo, getRequireReauthentication, isCookieHttpOnly, lookup, removeLifecycleListener, setCookieDomain, setCookieHttpOnly, setRequireReauthentication, toString
backgroundProcess, createObjectName, event, getContainer, getContainerName, getController, getDomain, getNext, getObjectName, getParentName, postDeregister, postRegister, preDeregister, preRegister, setContainer, setController, setNext, setObjectName
public static final int DEFAULT_PROCESS_EXPIRES_INTERVAL
public static final int DEFAULT_MAX_EMPTY_LIFE
public ClusteredSingleSignOn(SSOClusterManager ssoClusterManager)
public int getMaxEmptyLife()
*
,
#setMaxEmptyLife()
public void setMaxEmptyLife(int maxEmptyLife)
A positive value for this property allows a user to continue to use an SSO even after all the sessions associated with it
have been expired. It does not keep an SSO alive if a session associated with it has been invalidated due to an
HttpSession.invalidate()
call.
The primary purpose of this property is to avoid the situation where a server on which all of an SSO's sessions lives is shutdown, thus expiring all the sessions and causing the invalidation of the SSO. A positive value for this property would give the user an opportunity to fail over to another server and maintain the SSO.
maxEmptyLife
- a non-negative numberIllegalArgumentException
- if maxEmptyLife < 0
public int getProcessExpiresInterval()
DEFAULT_PROCESS_EXPIRES_INTERVAL
,
#setMaxEmptyLife()
,
setProcessExpiresInterval(int)
public void setProcessExpiresInterval(int processExpiresInterval)
Note that setting this value does not imply that a check will be performed every processExpiresInterval
seconds, only that it will not be performed more often than that.
processExpiresInterval
- a non-negative number. 0
means the overage check can be performed whenever the
container wishes to.IllegalArgumentException
- if processExpiresInterval < 1
setMaxEmptyLife(int)
public long getLastProcessExpires()
setProcessExpiresInterval(int)
public void start() throws org.apache.catalina.LifecycleException
configure()
, and before any of the public methods of the component are utilized.start
in interface org.apache.catalina.Lifecycle
start
in class org.apache.catalina.authenticator.SingleSignOn
org.apache.catalina.LifecycleException
- if this component detects a fatal error that prevents this component from being usedpublic void stop() throws org.apache.catalina.LifecycleException
stop
in interface org.apache.catalina.Lifecycle
stop
in class org.apache.catalina.authenticator.SingleSignOn
org.apache.catalina.LifecycleException
- if this component detects a fatal error that needs to be reportedpublic void sessionEvent(org.apache.catalina.SessionEvent event)
Session destroyed event
, checks whether the session was
destroyed due to timeout or user action (i.e. logout). If due to timeout, disassociates the Session from the single sign
on session. If due to logout, invokes the logout(java.lang.String)
method.sessionEvent
in interface org.apache.catalina.SessionListener
sessionEvent
in class org.apache.catalina.authenticator.SingleSignOn
event
- SessionEvent that has occurredpublic void lifecycleEvent(org.apache.catalina.LifecycleEvent event)
lifecycleEvent
in interface org.apache.catalina.LifecycleListener
public void invoke(org.apache.catalina.connector.Request request, org.apache.catalina.connector.Response response) throws IOException, javax.servlet.ServletException
Principal
object associated with it on this node.invoke
in interface org.apache.catalina.Valve
invoke
in class org.apache.catalina.authenticator.SingleSignOn
request
- The servlet request we are processingresponse
- The servlet response we are creatingIOException
- if an input/output error occursjavax.servlet.ServletException
- if a servlet error occurspublic void associate(String ssoId, org.apache.catalina.Session session)
associate
in class org.apache.catalina.authenticator.SingleSignOn
ssoId
- Single sign on identifiersession
- Session to be associatedprotected void deregister(String ssoId, org.apache.catalina.Session session)
deregister
in class org.apache.catalina.authenticator.SingleSignOn
ssoId
- Single sign on identifiersession
- Session to be deregisteredpublic void deregister(String ssoId)
deregister
in interface SSOLocalManager
deregister
in class org.apache.catalina.authenticator.SingleSignOn
ssoId
- Single sign on identifier to deregisterprotected void logout(String ssoId)
ssoId
- the id of the SSO sessionprotected SingleSignOnEntry getSingleSignOnEntry(String ssoId)
null
.ssoId
- Single sign on identifier to look uppublic boolean reauthenticate(String ssoId, org.apache.catalina.Realm realm, org.apache.catalina.connector.Request request)
Realm
using the credentials associated with the single sign-on
session identified by argument ssoId
.
If reauthentication is successful, the Principal
and authorization type associated with the SSO session will
be bound to the given HttpRequest
object via calls to HttpRequest.setAuthType()
and HttpRequest.setUserPrincipal()
reauthenticate
in class org.apache.catalina.authenticator.SingleSignOn
ssoId
- identifier of SingleSignOn session with which the caller is associatedrealm
- Realm implementation against which the caller is to be authenticatedrequest
- the request that needs to be authenticatedtrue
if reauthentication was successful, false
otherwise.public void register(String ssoId, Principal principal, String authType, String username, String password)
register
in class org.apache.catalina.authenticator.SingleSignOn
ssoId
- Single sign on identifier to registerprincipal
- Associated user principal that is identifiedauthType
- Authentication type used to authenticate this user principalusername
- Username used to authenticate this userpassword
- Password used to authenticate this userprotected void removeSession(String ssoId, org.apache.catalina.Session session)
removeSession
in class org.apache.catalina.authenticator.SingleSignOn
ssoId
- Single sign on identifier from which to remove the session.session
- the session to be removed.public void update(String ssoId, Principal principal, String authType, String username, String password)
SingleSignOnEntry
found under key ssoId
with the given authentication data.
The purpose of this method is to allow an SSO entry that was established without a username/password combination (i.e.
established following DIGEST or CLIENT-CERT authentication) to be updated with a username and password if one becomes
available through a subsequent BASIC or FORM authentication. The SSO entry will then be usable for reauthentication.
NOTE: Only updates the SSO entry if a call to SingleSignOnEntry.getCanReauthenticate()
returns
false
; otherwise, it is assumed that the SSO entry already has sufficient information to allow
reauthentication and that no update is needed.
Differs from the superclass version in that it notifies the cluster of any update.update
in class org.apache.catalina.authenticator.SingleSignOn
ssoId
- identifier of Single sign to be updatedprincipal
- the Principal
returned by the latest call to Realm.authenticate
.authType
- the type of authenticator used (BASIC, CLIENT-CERT, DIGEST or FORM)username
- the username (if any) used for the authenticationpassword
- the password (if any) used for the authenticationpublic void remoteUpdate(String ssoId, SSOCredentials credentials)
SSOLocalManager
remoteUpdate
in interface SSOLocalManager
ssoId
- the id of the SSOcredentials
- the updated credentialspublic void notifySSOEmpty(String ssoId)
notifySSOEmpty
in interface SSOLocalManager
public void notifySSONotEmpty(String ssoId)
notifySSONotEmpty
in interface SSOLocalManager
Copyright © 2013 JBoss, a division of Red Hat, Inc.. All rights reserved.