@Override public void logout() { HttpSession httpSession = request.getSession(false); if (httpSession != null) { SerializableKeycloakAccount account = (SerializableKeycloakAccount) httpSession.getAttribute(KeycloakAccount.class.getName()); if (account != null) { account.getKeycloakSecurityContext().logout(deployment); } cleanSession(httpSession); } }
@Override public boolean isCached(RequestAuthenticator authenticator) { HttpSession httpSession = request.getSession(false); if (httpSession == null) return false; SerializableKeycloakAccount account = (SerializableKeycloakAccount) httpSession.getAttribute(KeycloakAccount.class.getName()); if (account == null) { return false; } log.fine("remote logged in already. Establish state from session"); RefreshableKeycloakSecurityContext securityContext = account.getKeycloakSecurityContext(); if (!deployment.getRealm().equals(securityContext.getRealm())) { log.fine("Account from cookie is from a different realm than for the request."); cleanSession(httpSession); return false; } if (idMapper != null && !idMapper.hasSession(httpSession.getId())) { log.fine("idMapper does not have session: " + httpSession.getId()); //System.err.println("idMapper does not have session: " + httpSession.getId()); cleanSession(httpSession); return false; } securityContext.setCurrentRequestInfo(deployment, this); request.setAttribute(KeycloakSecurityContext.class.getName(), securityContext); needRequestRestore = restoreRequest(); return true; }
@Override public void checkCurrentToken() { HttpSession httpSession = request.getSession(false); if (httpSession == null) return; SerializableKeycloakAccount account = (SerializableKeycloakAccount)httpSession.getAttribute(KeycloakAccount.class.getName()); if (account == null) { return; } RefreshableKeycloakSecurityContext session = account.getKeycloakSecurityContext(); if (session == null) return; // just in case session got serialized if (session.getDeployment() == null) session.setCurrentRequestInfo(deployment, this); if (session.isActive() && !session.getDeployment().isAlwaysRefreshToken()) return; // FYI: A refresh requires same scope, so same roles will be set. Otherwise, refresh will fail and token will // not be updated boolean success = session.refreshExpiredToken(false); if (success && session.isActive()) return; // Refresh failed, so user is already logged out from keycloak. Cleanup and expire our session //log.fine("Cleanup and expire session " + httpSession.getId() + " after failed refresh"); cleanSession(httpSession); httpSession.invalidate(); }