Package org.apache.juneau.rest.server.auth.oidc.rp

Record Class OidcSession

java.lang.Object
java.lang.Record
org.apache.juneau.rest.server.auth.oidc.rp.OidcSession
Record Components:
id - The opaque server-side session id. For InMemorySessionStore this is the cache key; for SignedCookieSessionStore it is a stable identifier embedded in the signed cookie. Never null.
subject - The ID-token sub claim. Never null or blank.
sid - The ID-token sid (session id) claim, if the IdP issued one. Used for back-channel logout targeting a single session rather than all of a subject's sessions.
principal - The verified ID-token claims as a ClaimsPrincipal. Never null.
roles - The roles extracted from the configured roles claim. Never null; may be empty.
token - The tokens returned from the token endpoint (access / refresh / id), if the store retains them. SignedCookieSessionStore does NOT retain tokens (stateless cookies don't carry them), so this is Optional.empty() for cookie-backed sessions.
createdAt - The instant the session was created. Never null.
expiresAt - The instant the session expires (bounded independently of token lifetime). Never null.
public record OidcSession(String id, String subject, Optional<String> sid, ClaimsPrincipal principal, Set<String> roles, Optional<OAuthToken> token, Instant createdAt, Instant expiresAt) extends Record
Immutable record describing a logged-in OpenID Connect Relying Party session.

Created by OidcRelyingParty.completeLogin(jakarta.servlet.http.HttpServletRequest, jakarta.servlet.http.HttpServletResponse) after a successful login and persisted via a SessionStore. The principal() carries the verified ID-token claims and is what the OidcSessionAuthFilter surfaces to RoleBasedRestGuard / @Auth Principal.

Two fields support server-side (back-channel) revocation: subject() (the sub claim) and sid() (the optional sid session-id claim). A server-side-indexed SessionStore keys on these so an IdP-pushed logout token can invalidate the matching session(s).

Since:
10.0.0

  • Constructor Details

  • Method Details

    • isExpired

      public boolean isExpired(Instant now)
      Returns whether this session is expired relative to the supplied instant.
      Parameters:
      now - The reference instant.
      Returns:
      true if now is at or after expiresAt().

    • toString

      public final String toString()
      Returns a string representation of this record class. The representation contains the name of the class, followed by the name and value of each of the record components.
      Specified by:
      toString in class Record
      Returns:
      a string representation of this object

    • hashCode

      public final int hashCode()
      Returns a hash code value for this object. The value is derived from the hash code of each of the record components.
      Specified by:
      hashCode in class Record
      Returns:
      a hash code value for this object

    • equals

      public final boolean equals(Object o)
      Indicates whether some other object is "equal to" this one. The objects are equal if the other object is of the same class and if all the record components are equal. All components in this record class are compared with Objects::equals(Object,Object).
      Specified by:
      equals in class Record
      Parameters:
      o - the object with which to compare
      Returns:
      true if this object is the same as the o argument; false otherwise.

    • id

      public String id()
      Returns the value of the id record component.
      Returns:
      the value of the id record component

    • subject

      public String subject()
      Returns the value of the subject record component.
      Returns:
      the value of the subject record component

    • sid

      public Optional<String> sid()
      Returns the value of the sid record component.
      Returns:
      the value of the sid record component

    • principal

      public ClaimsPrincipal principal()
      Returns the value of the principal record component.
      Returns:
      the value of the principal record component

    • roles

      public Set<String> roles()
      Returns the value of the roles record component.
      Returns:
      the value of the roles record component

    • token

      public Optional<OAuthToken> token()
      Returns the value of the token record component.
      Returns:
      the value of the token record component

    • createdAt

      public Instant createdAt()
      Returns the value of the createdAt record component.
      Returns:
      the value of the createdAt record component

    • expiresAt

      public Instant expiresAt()
      Returns the value of the expiresAt record component.
      Returns:
      the value of the expiresAt record component