Class OAuth2AuthenticationModule

java.lang.Object

com.kingsrook.qqq.backend.core.modules.authentication.implementations.OAuth2AuthenticationModule

All Implemented Interfaces:

QAuthenticationModuleInterface

public class OAuth2AuthenticationModule
extends Object
implements QAuthenticationModuleInterface

Implementation of OAuth2 authentication. Sessions are stored in the userSession table (keyed by a uuid, which is what the client holds, in a cookie). If the provider issues a refresh token (e.g., the offline_access scope was granted) and the instance defines the refresh- token table (see UserSessionRefreshTokenMetaDataProducer), the refresh token is stored server-side and used to renew the access token when it expires (or is within refreshTokenSkewSeconds of expiring), so the session survives. Refresh tokens are never sent to clients, put on the QSession, or logged, and are stored encrypted (AES-256-GCM, bound to their session - see RefreshTokenCipher) with a key from refreshTokenEncryptionKey (#1048).

Constructor Summary

Constructors

Constructor	Description
OAuth2AuthenticationModule()

Method Summary

Modifier and Type	Method	Description
static void	clearAccessTokenCache(String sessionUUID)	Forget a cached token after its authoritative session has been removed.
static void	clearOIDCProviderMetadataCache()	Clear cached OIDC provider metadata.
QSession	createAutomatedSessionForUser(QInstance qInstance, Serializable userId)
QSession	createSession(QInstance qInstance, Map<String,String> context)
static void	deleteStoredRefreshTokens(QInstance qInstance, Collection<String> sessionUuids)	Delete stored refresh tokens for the given sessions (no-op if the instance has no refresh-token table).
String	getLoginRedirectUrl(String originalUrl)
boolean	isSessionValid(QInstance instance, QSession session)
void	logout(QInstance qInstance, String sessionUUID)	Logout a session by deleting it from the database and clearing the memoization cache.
boolean	usesSessionIdCookie()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface com.kingsrook.qqq.backend.core.modules.authentication.QAuthenticationModuleInterface

createSession

Constructor Details

OAuth2AuthenticationModule

public OAuth2AuthenticationModule()

Method Details

createSession

public QSession createSession(QInstance qInstance,
 Map<String,String> context)
                       throws QAuthenticationException

Specified by:

createSession in interface QAuthenticationModuleInterface

Throws:

QAuthenticationException

isSessionValid

public boolean isSessionValid(QInstance instance,
 QSession session)

Specified by:

isSessionValid in interface QAuthenticationModuleInterface

getLoginRedirectUrl

public String getLoginRedirectUrl(String originalUrl)
                           throws QAuthenticationException

Specified by:

getLoginRedirectUrl in interface QAuthenticationModuleInterface

Throws:

QAuthenticationException

createAutomatedSessionForUser

public QSession createAutomatedSessionForUser(QInstance qInstance,
 Serializable userId)
                                       throws QAuthenticationException

Specified by:

createAutomatedSessionForUser in interface QAuthenticationModuleInterface

Throws:

QAuthenticationException

usesSessionIdCookie

public boolean usesSessionIdCookie()

Specified by:

usesSessionIdCookie in interface QAuthenticationModuleInterface

logout

public void logout(QInstance qInstance,
 String sessionUUID)

Logout a session by deleting it from the database and clearing the memoization cache.

Specified by:

logout in interface QAuthenticationModuleInterface

Parameters:

qInstance - the QInstance (provided for implementations that need it)

sessionUUID - the session UUID to invalidate

deleteStoredRefreshTokens

public static void deleteStoredRefreshTokens(QInstance qInstance,
 Collection<String> sessionUuids)
                                      throws QException

Delete stored refresh tokens for the given sessions (no-op if the instance has no refresh-token table). Used at logout and by OIDC back-channel logout - in the latter case, the provider has already ended the session, so there is no revocation call. Runs with a system session.

Throws:

QException

clearAccessTokenCache

public static void clearAccessTokenCache(String sessionUUID)

Forget a cached token after its authoritative session has been removed.

clearOIDCProviderMetadataCache

public static void clearOIDCProviderMetadataCache()

Clear cached OIDC provider metadata. Primarily for testing purposes when WireMock servers restart on different ports between tests.