Package org.apache.juneau.rest.server.auth.oidc.rp

Interface SessionStore

All Known Implementing Classes:

InMemorySessionStore, SignedCookieSessionStore

public interface SessionStore

SPI for persisting OidcSession instances and resolving them back from a session-cookie value.

Two implementations are bundled:

• SignedCookieSessionStore — the documented default. Stateless: the session is HMAC-signed and stored entirely in the cookie value. Scales horizontally and survives restarts with no shared store, but cannot be server-revoked (so it does not support back-channel logout — see supportsServerSideRevocation()).
• InMemorySessionStore — the simpler single-instance / dev option. Server-side indexed by sub and sid, so it does support back-channel logout. Lost on restart; breaks under horizontal scaling without sticky sessions.

Distributed stores (Redis / JDBC) are caller-supplied via this SPI. A distributed store that wants to participate in back-channel logout must implement invalidateBySubject(String) / invalidateBySessionId(String) and report supportsServerSideRevocation() as true.

Implementations must be thread-safe.

See Also:

• OidcSession
• InMemorySessionStore
• SignedCookieSessionStore
• OIDC Relying Party Login (juneau-rest-server-auth-oidc-rp)

Since:

10.0.0

Method Summary

Modifier and Type	Method	Description
String	createSessionCookieValue(OidcSession session)	Persists the supplied session and returns the opaque value to set as the session cookie.
void	invalidate(String cookieValue)	Invalidates the session identified by the supplied cookie value.
default int	invalidateBySessionId(String sid)	Invalidates the session(s) bound to the supplied IdP session id (sid).
default int	invalidateBySubject(String subject)	Invalidates every session belonging to the supplied subject (sub).
Optional<OidcSession>	lookup(String cookieValue)	Resolves a session from a cookie value.
default boolean	supportsServerSideRevocation()	Returns whether this store can revoke sessions server-side (a prerequisite for back-channel logout).

Method Details

createSessionCookieValue

String createSessionCookieValue(OidcSession session)

Persists the supplied session and returns the opaque value to set as the session cookie.

For a server-side store this is typically a random session id used as a lookup key; for a stateless cookie store it is the entire signed session payload.

Parameters:

session - The session to persist. Must not be null.

Returns:

The cookie value the client should send back on subsequent requests. Never null.

lookup

Optional<OidcSession> lookup(String cookieValue)

Resolves a session from a cookie value.

Parameters:

cookieValue - The cookie value previously returned by createSessionCookieValue(org.apache.juneau.rest.server.auth.oidc.rp.OidcSession). Must not be null.

Returns:

The resolved session, or Optional.empty() if absent, expired, invalid, or tampered.

invalidate

void invalidate(String cookieValue)

Invalidates the session identified by the supplied cookie value. No-op if absent.

Parameters:

cookieValue - The cookie value. Must not be null.

supportsServerSideRevocation

default boolean supportsServerSideRevocation()

Returns whether this store can revoke sessions server-side (a prerequisite for back-channel logout).

Defaults to false — stateless cookie stores cannot revoke a session the server never retained.

Returns:

true if invalidateBySubject(String) / invalidateBySessionId(String) are supported.

invalidateBySubject

default int invalidateBySubject(String subject)

Invalidates every session belonging to the supplied subject (sub).

Used by OidcRelyingParty.backChannelLogout(java.lang.String) when the IdP-pushed logout token carries a sub but no sid.

Parameters:

subject - The subject identifier. Must not be null or blank.

Returns:

The number of sessions invalidated.

Throws:

UnsupportedOperationException - If this store does not support server-side revocation.

invalidateBySessionId

default int invalidateBySessionId(String sid)

Invalidates the session(s) bound to the supplied IdP session id (sid).

Used by OidcRelyingParty.backChannelLogout(java.lang.String) when the IdP-pushed logout token carries a sid.

Parameters:

sid - The IdP session id. Must not be null or blank.

Returns:

The number of sessions invalidated.

Throws:

UnsupportedOperationException - If this store does not support server-side revocation.