Skip to content

Commit e0b0c4c

Browse files
maximthomasmaximthomas
authored
Merge commit from fork
* Add auth to addSessionListener * change sso token validation from identity to session type * change sso token validation from identity to session type
1 parent 66caa2a commit e0b0c4c

8 files changed

Lines changed: 59 additions & 17 deletions

File tree

‎openam-core/src/main/java/com/iplanet/dpro/session/Session.java‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
* $Id: Session.java,v 1.25 2009/08/14 17:53:35 weisun2 Exp $
2626
*
2727
* Portions copyright 2010-2016 ForgeRock AS.
28+
* Portions Copyrighted 2017-2026 3A Systems LLC
2829
*/
2930

3031
package com.iplanet.dpro.session;
@@ -33,12 +34,14 @@
3334
import static org.forgerock.openam.utils.Time.*;
3435

3536
import java.net.URL;
37+
import java.security.AccessController;
3638
import java.util.HashSet;
3739
import java.util.Hashtable;
3840
import java.util.Set;
3941
import java.util.concurrent.TimeUnit;
4042
import java.util.concurrent.atomic.AtomicBoolean;
4143

44+
import com.sun.identity.security.AdminTokenAction;
4245
import org.forgerock.guice.core.InjectorHolder;
4346
import org.forgerock.openam.blacklist.BlacklistException;
4447
import org.forgerock.openam.blacklist.Blacklistable;
@@ -825,7 +828,7 @@ protected void setRestriction(TokenRestriction restriction) {
825828
this.restriction = restriction;
826829
}
827830

828-
/**
831+
/**restriction
829832
* populate context object with admin token
830833
* @exception SessionException
831834
* @param appSSOToken application SSO Token to bet set
@@ -862,9 +865,10 @@ public void timeout() {
862865
*/
863866
public void addInternalSessionListener() {
864867
try {
868+
final SSOToken appSSOToken = AccessController.doPrivileged(AdminTokenAction.getInstance());
865869
String url = WebtopNaming.getNotificationURL().toString();
866870
SessionOperations operations = sessionOperationStrategy.getOperation(sessionID);
867-
operations.addSessionListener(this, url);
871+
operations.addSessionListener(appSSOToken, this, url);
868872
} catch (Exception e) {
869873
sessionDebug.warning("error adding internal session listener", e);
870874
}

‎openam-core/src/main/java/com/iplanet/dpro/session/monitoring/MonitoredOperations.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
* information: "Portions copyright [year] [name of copyright owner]".
1313
*
1414
* Copyright 2014-2016 ForgeRock AS.
15-
* Portions Copyrighted 2025 3A Systems, LLC.
15+
* Portions Copyrighted 2025-2026 3A Systems, LLC.
1616
*/
1717
package com.iplanet.dpro.session.monitoring;
1818

@@ -123,8 +123,8 @@ public SessionInfo getSessionInfo(SessionID sid, boolean reset) throws SessionEx
123123
}
124124

125125
@Override
126-
public void addSessionListener(Session session, String url) throws SessionException {
127-
sessionOperations.addSessionListener(session, url); // Not monitored at present
126+
public void addSessionListener(SSOToken clientToken, Session session, String url) throws SessionException {
127+
sessionOperations.addSessionListener(clientToken, session, url); // Not monitored at present
128128
}
129129

130130
@Override

‎openam-core/src/main/java/com/iplanet/dpro/session/operations/SessionOperations.java‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
* the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
1313
* Header, with the fields enclosed by brackets [] replaced by your own identifying
1414
* information: "Portions copyright [year] [name of copyright owner]".
15+
* Portions copyright 2026 3A Systems LLC
1516
*/
1617
package com.iplanet.dpro.session.operations;
1718

@@ -93,11 +94,13 @@ public interface SessionOperations {
9394

9495
/**
9596
* Add a session listener notification url. The url will receive a notification when session change events occur.
96-
* @param session the session to listen to.
97-
* @param url the listener notification url
97+
*
98+
* @param clientToken SSO Token of the client adding session listener (should be admin or agent).
99+
* @param session the session to listen to.
100+
* @param url the listener notification url
98101
* @throws SessionException if the session could not be accessed.
99102
*/
100-
void addSessionListener(Session session, String url) throws SessionException;
103+
void addSessionListener(SSOToken clientToken, Session session, String url) throws SessionException;
101104

102105
/**
103106
* Check whether a session identified by {code sessionId} can be retrieved.

‎openam-core/src/main/java/com/iplanet/dpro/session/operations/strategies/ClientSdkOperations.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
* information: "Portions copyright [year] [name of copyright owner]".
1313
*
1414
* Copyright 2014-2016 ForgeRock AS.
15+
* Portions copyright 2026 3A Systems LLC
1516
*/
1617
package com.iplanet.dpro.session.operations.strategies;
1718

@@ -195,7 +196,7 @@ public SessionInfo getSessionInfo(SessionID sid, boolean reset) {
195196
}
196197

197198
@Override
198-
public void addSessionListener(Session session, String url) throws SessionException {
199+
public void addSessionListener(SSOToken clientToken, Session session, String url) throws SessionException {
199200
SessionRequest sreq = new SessionRequest(
200201
SessionRequest.AddSessionListener,
201202
session.getSessionID().toString(), false);

‎openam-core/src/main/java/com/iplanet/dpro/session/operations/strategies/LocalOperations.java‎

Lines changed: 36 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
* information: "Portions copyright [year] [name of copyright owner]".
1313
*
1414
* Copyright 2014-2016 ForgeRock AS.
15-
* Portions copyright 2025 3A Systems LLC.
15+
* Portions copyright 2025-2026 3A Systems LLC.
1616
*/
1717
package com.iplanet.dpro.session.operations.strategies;
1818

@@ -21,9 +21,14 @@
2121
import static org.forgerock.openam.session.SessionEventType.MAX_TIMEOUT;
2222
import static org.forgerock.openam.utils.Time.currentTimeMillis;
2323

24+
import java.security.AccessController;
2425
import java.text.MessageFormat;
2526
import java.util.Collection;
2627

28+
import com.iplanet.am.util.SystemProperties;
29+
import com.iplanet.dpro.session.service.SessionType;
30+
import com.sun.identity.security.AdminTokenAction;
31+
import com.sun.identity.session.util.SessionUtils;
2732
import jakarta.inject.Inject;
2833
import jakarta.inject.Named;
2934

@@ -201,7 +206,10 @@ public SessionInfo getSessionInfo(SessionID sessionID, boolean reset) throws Ses
201206
}
202207

203208
@Override
204-
public void addSessionListener(Session session, String url) throws SessionException {
209+
public void addSessionListener(SSOToken clientToken, Session session, String url) throws SessionException {
210+
211+
checkAddSessionListenerPermission(clientToken);
212+
205213
SessionID sessionId = session.getSessionID();
206214
InternalSession internalSession = resolveToken(sessionId);
207215
if (internalSession.getState() == INVALID) {
@@ -213,6 +221,32 @@ public void addSessionListener(Session session, String url) throws SessionExcept
213221
internalSession.addSessionEventURL(url, sessionId);
214222
}
215223

224+
static final String ADD_SESSION_LISTENER_SKIP_AUTH_CHECK =
225+
"org.openidentityplatform.session.listener.skip-auth-check";
226+
private void checkAddSessionListenerPermission(SSOToken clientToken) throws SessionException {
227+
228+
boolean clientTokenCheckFailed = false;
229+
try {
230+
if (clientToken == null) {
231+
clientTokenCheckFailed = true;
232+
} else if(!SessionUtils.isAdmin(AccessController.doPrivileged(AdminTokenAction.getInstance()), clientToken)) {
233+
Session session = new Session(new SessionID(clientToken.getTokenID().toString()));
234+
session.refresh(false);
235+
SessionType type = session.getType();
236+
if(session.isTimedOut() || !SessionType.APPLICATION.equals(type)) {
237+
clientTokenCheckFailed = true;
238+
}
239+
}
240+
} catch (Exception e) {
241+
throw new SessionException(e);
242+
}
243+
244+
if(clientTokenCheckFailed
245+
&& !SystemProperties.getAsBoolean(ADD_SESSION_LISTENER_SKIP_AUTH_CHECK, false)) {
246+
throw new IllegalArgumentException("Request should be authenticated");
247+
}
248+
}
249+
216250
@Override
217251
public boolean checkSessionExists(SessionID sessionId) throws SessionException {
218252
// Attempt to load the session. If one is found, the InternalSesion is now local.

‎openam-core/src/main/java/com/iplanet/dpro/session/operations/strategies/StatelessOperations.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ public SessionInfo getSessionInfo(SessionID sid, boolean reset) throws SessionEx
131131
}
132132

133133
@Override
134-
public void addSessionListener(Session session, String url) throws SessionException {
134+
public void addSessionListener(SSOToken clientToken, Session session, String url) throws SessionException {
135135
throw new UnsupportedOperationException();
136136
}
137137

‎openam-core/src/main/java/com/iplanet/dpro/session/service/SessionRequestHandler.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
* $Id: SessionRequestHandler.java,v 1.9 2009/04/02 04:11:44 ericow Exp $
2626
*
2727
* Portions Copyrighted 2011-2016 ForgeRock AS.
28-
* Portions Copyrighted 2025 3A Systems LLC.
28+
* Portions Copyrighted 2025-2026 3A Systems LLC.
2929
*/
3030
package com.iplanet.dpro.session.service;
3131

@@ -352,7 +352,7 @@ private SessionResponse processMethod(SessionRequest req, Session requesterSessi
352352
break;
353353

354354
case SessionRequest.AddSessionListener:
355-
sessionService.addSessionListener(requesterSession, req.getNotificationURL());
355+
sessionService.addSessionListener(this.clientToken, requesterSession, req.getNotificationURL());
356356
break;
357357

358358
case SessionRequest.SetProperty:

‎openam-core/src/main/java/com/iplanet/dpro/session/service/SessionService.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
* $Id: SessionService.java,v 1.37 2010/02/03 03:52:54 bina Exp $
2626
*
2727
* Portions Copyrighted 2010-2016 ForgeRock AS.
28-
* Portions Copyrighted 2023-2025 3A Systems LLC
28+
* Portions Copyrighted 2023-2026 3A Systems LLC
2929
*/
3030
package com.iplanet.dpro.session.service;
3131

@@ -246,8 +246,8 @@ public void logout(final Session session) throws SessionException {
246246
* @param url
247247
* @throws SessionException Session is null OR the Session is invalid
248248
*/
249-
public void addSessionListener(Session session, String url) throws SessionException {
250-
sessionOperationStrategy.getOperation(session.getSessionID()).addSessionListener(session, url);
249+
public void addSessionListener(SSOToken clientToken, Session session, String url) throws SessionException {
250+
sessionOperationStrategy.getOperation(session.getSessionID()).addSessionListener(clientToken, session, url);
251251
}
252252

253253
/**

0 commit comments

Comments
 (0)