Package org.operaton.bpm.webapp.neo.impl.security.auth

Class AuthenticationUtil

java.lang.Object

org.operaton.bpm.webapp.neo.impl.security.auth.AuthenticationUtil

public final class AuthenticationUtil
extends Object

Field Summary

Fields

Modifier and Type	Field	Description
static final String	APP_WELCOME
static final String[]	APPS	The application ids a login may be granted for.
protected static final String	CAM_AUTH_SESSION_KEY
protected static final WebappLogger	LOGGER

Method Summary

Modifier and Type	Method	Description
static UserAuthentication	createAuthentication(String engineName, String username)
static UserAuthentication	createAuthentication(String engineName, String username, List<String> groupIds, List<String> tenantIds)
static UserAuthentication	createAuthentication(ProcessEngine processEngine, String username)
static UserAuthentication	createAuthentication(ProcessEngine processEngine, String username, List<String> groupIds, List<String> tenantIds)	Creates and returns a UserAuthentication with the following information: userId processEngineName groupIds tenantIds authorizedApps
static Authentications	getAuthsFromSession(jakarta.servlet.http.HttpSession session)	Allows obtaining an Authentications object from the HttpSession.
static List<String>	getGroupsOfUser(ProcessEngine engine, String userId)
protected static Object	getSessionMutex(jakarta.servlet.http.HttpSession session)	Returns the session mutex to synchronize on.
static List<String>	getTenantsOfUser(ProcessEngine engine, String userId)
protected static boolean	isAuthorizedForApp(AuthorizationService authorizationService, String username, List<String> groupIds, String application)
static void	revalidateSession(jakarta.servlet.http.HttpServletRequest request, UserAuthentication authentication)	Invalidates the old HttpSession of the current request and creates a new one.
static void	updateCache(Authentications authentications, jakarta.servlet.http.HttpSession session, long cacheTimeToLive)	Update/remove authentications when cache validation time (= x + TTL) is due.
static void	updateSession(jakarta.servlet.http.HttpSession session, Authentications authentications)	Store authentications in current session.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

LOGGER

protected static final WebappLogger LOGGER

CAM_AUTH_SESSION_KEY

protected static final String CAM_AUTH_SESSION_KEY

See Also:

• Constant Field Values

APPS

public static final String[] APPS

The application ids a login may be granted for. "neo" is the single-page app this module serves; without it doLogin rejects every neo login with 403, because it checks the requested app against the set this array produces. Admin users already hold an APPLICATION/* grant, so they gain access automatically, and operators can grant APPLICATION ACCESS "neo" to anyone else.

APP_WELCOME

public static final String APP_WELCOME

See Also:

• Constant Field Values

Method Details

createAuthentication

public static UserAuthentication createAuthentication(String engineName,
 String username)

createAuthentication

public static UserAuthentication createAuthentication(ProcessEngine processEngine,
 String username)

createAuthentication

public static UserAuthentication createAuthentication(String engineName,
 String username,
 List<String> groupIds,
 List<String> tenantIds)

createAuthentication

public static UserAuthentication createAuthentication(ProcessEngine processEngine,
 String username,
 List<String> groupIds,
 List<String> tenantIds)

Creates and returns a UserAuthentication with the following information:

• userId
• processEngineName
• groupIds
• tenantIds
• authorizedApps

getTenantsOfUser

public static List<String> getTenantsOfUser(ProcessEngine engine,
 String userId)

getGroupsOfUser

public static List<String> getGroupsOfUser(ProcessEngine engine,
 String userId)

isAuthorizedForApp

protected static boolean isAuthorizedForApp(AuthorizationService authorizationService,
 String username,
 List<String> groupIds,
 String application)

getAuthsFromSession

public static Authentications getAuthsFromSession(jakarta.servlet.http.HttpSession session)

Allows obtaining an Authentications object from the HttpSession. If no such object exists in the session, a new instance is created and returned.

Parameters:

session - the HttpSession instance from which to retrieve the Authentications.

revalidateSession

public static void revalidateSession(jakarta.servlet.http.HttpServletRequest request,
 UserAuthentication authentication)

Invalidates the old HttpSession of the current request and creates a new one. Additionally, transfers the existing authentications to the new session and adds a new one.

Parameters:

request - the HttpServletRequest instance from which the session is obtained and a new HttpSession created.

authentication - the new Authentication instance that is created through user login. It is added to the existing authentications.

updateSession

public static void updateSession(jakarta.servlet.http.HttpSession session,
 Authentications authentications)

Store authentications in current session.

updateCache

public static void updateCache(Authentications authentications,
 jakarta.servlet.http.HttpSession session,
 long cacheTimeToLive)

Update/remove authentications when cache validation time (= x + TTL) is due.

The following information is updated:

• groupIds
• tenantIds
• authorizedApps

  An authorization is only removed if the user doesn't exist anymore (user was deleted).

getSessionMutex

protected static Object getSessionMutex(jakarta.servlet.http.HttpSession session)

Returns the session mutex to synchronize on.

Avoids updating the auth cache by multiple HTTP requests in parallel.