Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add Session Management feature #2288

Merged
merged 32 commits into from
Jul 23, 2019
Merged

Add Session Management feature #2288

merged 32 commits into from
Jul 23, 2019

Conversation

pamodaaw
Copy link
Contributor

Description

This PR contains the session management functionality.
New functions were added to

  • view all the active sessions of a given user id
  • delete all the active sessions of a given user id
  • delete a session of given session id

Approach

Two tables to store the user's application information.

  • IDN_AUTH_APP_SESSION_STORE
  • IDN_AUTH_SESSION_META_DATA
CREATE TABLE IF NOT EXISTS IDN_AUTH_APP_SESSION_STORE (
            SESSION_ID VARCHAR (100) NOT NULL,
            SUBJECT VARCHAR (100) NOT NULL,
            APP_ID VARCHAR (10) NOT NULL,
            APP_TENANT_ID VARCHAR(10) NOT NULL,
            INBOUND_AUTH_TYPE VARCHAR (255) NOT NULL,
            PRIMARY KEY (SESSION_ID, SUBJECT, APP_ID, APP_TENANT_ID, INBOUND_AUTH_TYPE) );

 CREATE TABLE IF NOT EXISTS IDN_AUTH_SESSION_META_DATA (
            SESSION_ID VARCHAR (100) NOT NULL,
            PROPERTY_TYPE VARCHAR (100) NOT NULL,
            VALUE VARCHAR (255) NOT NULL,
            PRIMARY KEY (SESSION_ID, PROPERTY_TYPE, VALUE));

These tables get populated during the authentication flow.

Related Issues

#1832
wso2/product-is#5769

Checklist (for reviewing)

General

  • Is this PR explained thoroughly? All code changes must be accounted for in the PR description.
  • Is the PR labeled correctly?

Functionality

  • Are all requirements met? Compare implemented functionality with the requirements specification.
  • Does the UI work as expected? There should be no Javascript errors in the console; all resources should load. There should be no unexpected errors. Deliberately try to break the feature to find out if there are corner cases that are not handled.

Code

  • Do you fully understand the introduced changes to the code? If not ask for clarification, it might uncover ways to solve a problem in a more elegant and efficient way.
  • Does the PR introduce any inefficient database requests? Use the debug server to check for duplicate requests.
  • Are all necessary strings marked for translation? All strings that are exposed to users via the UI must be marked for translation.

Tests

  • Are there sufficient test cases? Ensure that all components are tested individually; models, forms, and serializers should be tested in isolation even if a test for a view covers these components.
  • If this is a bug fix, are tests for the issue in place? There must be a test case for the bug to ensure the issue won’t regress. Make sure that the tests break without the new code to fix the issue.
  • If this is a new feature or a significant change to an existing feature? has the manual testing spreadsheet been updated with instructions for manual testing?

Security

  • Confirm this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.
  • Are all UI and API inputs run through forms or serializers?
  • Are all external inputs validated and sanitized appropriately?
  • Does all branching logic have a default case?
  • Does this solution handle outliers and edge cases gracefully?
  • Are all external communications secured and restricted to SSL?

Documentation

  • Are changes to the UI documented in the platform docs? If this PR introduces new platform site functionality or changes existing ones, the changes should be documented.
  • Are changes to the API documented in the API docs? If this PR introduces new API functionality or changes existing ones, the changes must be documented.
  • Are reusable components documented? If this PR introduces components that are relevant to other developers (for instance a mixin for a view or a generic form) they should be documented in the Wiki.

Abilashini and others added 18 commits December 3, 2018 20:53
@Abilashini
Session termination during user password reset and user delete
8c29d4e
@malithie
Merge remote-tracking branch 'origin/master' into pr-2000
3a2c7f5
@malithie
Refactor session termination service.
41ec2af
@malithie
Merge pull request wso2#2020 from malithie/pr-2000
8a4be93 
Session termination service
Storing session related information
e252e04
Storing session related information
6dfa4bd
Storing session related information
131b488
Storing session related information
8f531be
Refactor
1d9b8ec
Refactor
d66279f
@pamodaaw
Merge branch 'master' of https://github.com/wso2/carbon-identity-fram…
4282ee9 
…ework into session-mgt-feature-updated
@pamodaaw
Add user session management implementation
359f265
@pamodaaw
Merge branch 'master' of https://github.com/wso2/carbon-identity-fram…
3065647 
…ework into session-mgt-feature-updated
@pamodaaw
Add session termination functions
5673737
@pamodaaw
Merge branch 'master' of https://github.com/wso2/carbon-identity-fram…
806c4fe 
…ework into session-mgt-feature-updated
@pamodaaw
Remove session information when terminated
fe191b8
@pamodaaw
Merge branch 'master' of https://github.com/wso2/carbon-identity-fram…
5578233 
…ework into session-mgt-feature-updated
@pamodaaw
Refactor code of session Mgt
9e0a64f
ruwanta
ruwanta suggested changes Jul 15, 2019
View reviewed changes
Copy link
Contributor

@ruwanta ruwanta left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Few changes

janakamarasena
janakamarasena reviewed Jul 15, 2019
View reviewed changes
...g/wso2/carbon/identity/application/authentication/framework/dao/impl/UserSessionDAOImpl.java
import org.wso2.carbon.database.utils.jdbc.exceptions.DataAccessException;
import org.wso2.carbon.identity.application.authentication.framework.dao.UserSessionDAO;
import org.wso2.carbon.identity.application.authentication.framework.exception.session.mgt
.SessionManagementServerException;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think a single line would have better readability.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Then it will exceed the max length of that line. Is it okay break that rule for readability?

ashensw
ashensw requested changes Jul 17, 2019
View reviewed changes
...ation/authentication/framework/handler/request/impl/DefaultAuthenticationRequestHandler.java Outdated
@@ -543,6 +568,35 @@ private void storeSessionData(AuthenticationContext context, String sessionConte
"user store domain: " + userStoreDomain + " in tenant domain: " + tenantDomain , e);
}
}

try {
if (appId != -1 && !UserSessionStore.getInstance().isExistingAppSession(sessionContextKey, subject,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Better to move this -1 to a constant with a descriptive name.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated

IsuraD
IsuraD reviewed Jul 23, 2019
View reviewed changes
...g/wso2/carbon/identity/application/authentication/framework/dao/impl/UserSessionDAOImpl.java
case SessionMgtConstants.LOGIN_TIME:
userSession.setLoginTime(value);
default:
break;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why do we need to break by default?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removed the default break

IsuraD
IsuraD reviewed Jul 23, 2019
View reviewed changes
...y/application/authentication/framework/exception/session/mgt/SessionManagementException.java Outdated
this.description = description;
}

// The constructor is made private to avoid generating exceptions without error code and description.
Copy link
Contributor

@IsuraD IsuraD Jul 23, 2019 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

use /** for the method level comments. Also the constructor is not private.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

IsuraD
IsuraD reviewed Jul 23, 2019
View reviewed changes
...ication/authentication/framework/exception/session/mgt/SessionManagementServerException.java Outdated
super(error, description, cause);
}

// The constructor is made private to avoid generating exceptions without error code and description.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

use /** for the method level comments.

@pamodaaw pamodaaw force-pushed the session-mgt-feature-updated branch from 410f73a to 216fc57 Compare July 23, 2019 13:15
IsuraD
IsuraD reviewed Jul 23, 2019
View reviewed changes
...g/wso2/carbon/identity/application/authentication/framework/store/SessionCleanUpService.java Outdated
@@ -20,6 +20,8 @@

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.wso2.carbon.identity.application.authentication.framework.util.FrameworkConstants;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

unused imports

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

@IsuraD IsuraD merged commit e9c30b8 into wso2:master Jul 23, 2019
@pamodaaw pamodaaw mentioned this pull request Jul 25, 2019
Merged
@pamodaaw
Copy link
Contributor Author

For this feature to execute, we need to add the following configuration in identity.xml under SessionDataPersist tag

<UserSessionMapping>
     <Enable>true</Enable>
</UserSessionMapping>

This was referenced Jul 26, 2019
Closed
Closed
Closed
@pamodaaw pamodaaw mentioned this pull request Aug 6, 2019
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sachiniWettasinghe sachiniWettasinghe sachiniWettasinghe left review comments

@janakamarasena janakamarasena janakamarasena left review comments

@IsuraD IsuraD IsuraD left review comments

@ashensw ashensw ashensw approved these changes

@ruwanta ruwanta ruwanta approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
8 participants
@pamodaaw @ruwanta @IsuraD @janakamarasena @ashensw @sachiniWettasinghe @Abilashini @malithie