[cpp-sp] branch main updated: Extend cache SPI with access to agent request.
Scott Cantor
cantor.2 at osu.edu
Thu Jun 5 10:23:30 UTC 2025
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository cpp-sp.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=322ff66c520873a949b6f22b81b27451bd4e0873
The following commit(s) were added to refs/heads/main by this push:
new 322ff66c Extend cache SPI with access to agent request.
322ff66c is described below
commit 322ff66c520873a949b6f22b81b27451bd4e0873
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jun 5 06:22:56 2025 -0400
Extend cache SPI with access to agent request.
---
shibsp/session/AbstractSessionCache.h | 9 +++++++--
shibsp/session/SessionCacheSPI.h | 18 +++++++++++------
shibsp/session/impl/AbstractSessionCache.cpp | 28 ++++++++++++++++----------
shibsp/session/impl/FilesystemSessionCache.cpp | 14 +++++++------
shibsp/session/impl/MemorySessionCache.cpp | 14 +++++++------
5 files changed, 52 insertions(+), 31 deletions(-)
diff --git a/shibsp/session/AbstractSessionCache.h b/shibsp/session/AbstractSessionCache.h
index b2f92b5c..7b91c719 100644
--- a/shibsp/session/AbstractSessionCache.h
+++ b/shibsp/session/AbstractSessionCache.h
@@ -64,7 +64,7 @@ namespace shibsp {
time_t getLastAccess() const;
// Perform validation of a local session based on policy and checks for revocation.
- bool isValid(unsigned int lifetime, unsigned int timeout, const char* client_addr);
+ bool isValid(SPRequest* request, unsigned int lifetime, unsigned int timeout, const char* client_addr);
private:
DDF m_obj;
@@ -119,7 +119,12 @@ namespace shibsp {
void dormant(const std::string& key);
// Wrapper for finding sessions via varied inputs.
std::unique_lock<Session> _find(
- const char* applicationID, const char* key, unsigned int lifetime, unsigned int timeout, const char* client_addr
+ SPRequest* request,
+ const char* applicationID,
+ const char* key,
+ unsigned int lifetime,
+ unsigned int timeout,
+ const char* client_addr
);
Category& m_log;
diff --git a/shibsp/session/SessionCacheSPI.h b/shibsp/session/SessionCacheSPI.h
index d9a7484c..6d446f27 100644
--- a/shibsp/session/SessionCacheSPI.h
+++ b/shibsp/session/SessionCacheSPI.h
@@ -28,6 +28,7 @@
namespace shibsp {
class SHIBSP_API DDF;
+ class SHIBSP_API SPRequest;
/**
* Interface to the "back-end" persistence mechanism to allow sessions to exist
@@ -47,11 +48,12 @@ namespace shibsp {
*
* <p>The caller retains ownership of the input data.</p>
*
+ * @param request agent request, if available
* @param sessionData data to store in record of session
*
* @return session key/ID created, this MUST be URL-safe
*/
- virtual std::string cache_create(DDF& sessionData)=0;
+ virtual std::string cache_create(SPRequest* request, DDF& sessionData)=0;
/**
* Read a session record from the underlying storage medium and return its data.
@@ -67,6 +69,7 @@ namespace shibsp {
*
* <p>The caller owns the resulting data object.</p>
*
+ * @param request agent request, if available
* @param applicationId application ID
* @param key session key/ID
* @param lifetime if positive, the time since its creation the session may be valid
@@ -76,6 +79,7 @@ namespace shibsp {
* @return reconstituted session data or a null object if the session was absent or invalid
*/
virtual DDF cache_read(
+ SPRequest* request,
const char* applicationId,
const char* key,
unsigned int lifetime=0,
@@ -89,19 +93,21 @@ namespace shibsp {
* <p>This method should return false to indicate that a session has been revoked, removed,
* or is no longer valid.</p>
*
- * @param key session key/ID
- * @param timeout timeout to enforce if non-zero
+ * @param request agent request, if available
+ * @param key session key/ID
+ * @param timeout timeout to enforce if non-zero
*
* @return true iff the session remains valid/available
*/
- virtual bool cache_touch(const char* key, unsigned int timeout=0) const=0;
+ virtual bool cache_touch(SPRequest* request, const char* key, unsigned int timeout=0) const=0;
/**
* Delete a session record from the underlying storage medium.
*
- * @param key/ID of session to delete
+ * @param request agent request, if available
+ * @param key key/ID of session to delete
*/
- virtual void cache_remove(const char* key)=0;
+ virtual void cache_remove(SPRequest* request, const char* key)=0;
};
};
diff --git a/shibsp/session/impl/AbstractSessionCache.cpp b/shibsp/session/impl/AbstractSessionCache.cpp
index 6bef624d..efeba049 100644
--- a/shibsp/session/impl/AbstractSessionCache.cpp
+++ b/shibsp/session/impl/AbstractSessionCache.cpp
@@ -168,7 +168,7 @@ string AbstractSessionCache::create(SPRequest& request, DDF& session)
string key;
try {
m_log.debug("writing new session to persistent store");
- key = cache_create(session);
+ key = cache_create(&request, session);
}
catch (const IOException& ex) {
m_log.error("IOException writing new session to persistent store: %s", ex.what());
@@ -231,7 +231,7 @@ unique_lock<Session> AbstractSessionCache::find(SPRequest& request, bool checkTi
client_addr = request.getRemoteAddr().c_str();
}
- unique_lock<Session> session = _find(applicationId, key, lifetime, timeout, client_addr);
+ unique_lock<Session> session = _find(&request, applicationId, key, lifetime, timeout, client_addr);
if (!session) {
// If no session, we need to clear the session cookie to prevent further use.
m_log.debug("clearing cookie for session (%s)", key);
@@ -245,11 +245,16 @@ unique_lock<Session> AbstractSessionCache::find(const char* applicationId, const
{
// This variant does no request-based validation so it returns the session best effort
// using the underlying _find method. It does ensure the applicationId matches if set.
- return _find(applicationId, key, 0, 0, nullptr);
+ return _find(nullptr, applicationId, key, 0, 0, nullptr);
}
unique_lock<Session> AbstractSessionCache::_find(
- const char* applicationId, const char* key, unsigned int lifetime, unsigned int timeout, const char* client_addr
+ SPRequest* request,
+ const char* applicationId,
+ const char* key,
+ unsigned int lifetime,
+ unsigned int timeout,
+ const char* client_addr
)
{
m_log.debug("searching local cache for session (%s)", key);
@@ -274,7 +279,7 @@ unique_lock<Session> AbstractSessionCache::_find(
key, applicationId, session.mutex()->getApplicationID());
session.unlock();
}
- else if (!dynamic_cast<BasicSession*>(session.mutex())->isValid(lifetime, timeout, client_addr)) {
+ else if (!dynamic_cast<BasicSession*>(session.mutex())->isValid(request, lifetime, timeout, client_addr)) {
// Locally invalid on its face, so remove and return nothing.
session.unlock();
m_log.debug("session (%s) invalid, removing it", key);
@@ -292,7 +297,7 @@ unique_lock<Session> AbstractSessionCache::_find(
DDF obj;
try {
// Note this performs the relevant enforcement for us.
- obj = cache_read(applicationId, key, lifetime, timeout, client_addr);
+ obj = cache_read(request, applicationId, key, lifetime, timeout, client_addr);
}
catch (const exception& ex) {
m_log.error("error reading session (%s) from persistent store: %s", key, ex.what());
@@ -349,14 +354,15 @@ void AbstractSessionCache::remove(SPRequest& request)
m_log.debug("no session cookie present, no session bound to request");
return;
}
- remove(key);
+ dormant(string(key));
+ cache_remove(&request, key);
m_cookieManager->unsetCookie(request);
}
void AbstractSessionCache::remove(const char* key)
{
dormant(string(key));
- cache_remove(key);
+ cache_remove(nullptr, key);
}
void AbstractSessionCache::dormant(const string& key)
@@ -507,7 +513,7 @@ const std::map<std::string,DDF>& BasicSession::getAttributes() const
return m_attributes;
}
-bool BasicSession::isValid(unsigned int lifetime, unsigned int timeout, const char* client_addr)
+bool BasicSession::isValid(SPRequest* request, unsigned int lifetime, unsigned int timeout, const char* client_addr)
{
// Check client address.
// TODO: Implement the fuzzy address matching.
@@ -538,7 +544,7 @@ bool BasicSession::isValid(unsigned int lifetime, unsigned int timeout, const ch
if (m_lastAccess - m_lastAccessReported > m_cache.m_storageAccessInterval) {
// It's been X seconds since we last wrote through to storage...
- if (!m_cache.cache_touch(getID(), timeout)) {
+ if (!m_cache.cache_touch(request, getID(), timeout)) {
m_cache.log().warn("session (%) missing or invalid in persistent store, invalidating locally", getID());
return false;
}
@@ -549,7 +555,7 @@ bool BasicSession::isValid(unsigned int lifetime, unsigned int timeout, const ch
else {
// The session is locally invalid due to inactivity, but this isn't "truth" because other agent processes may
// actively be using it.
- if (!m_cache.cache_touch(getID(), timeout)) {
+ if (!m_cache.cache_touch(request, getID(), timeout)) {
m_cache.log().warn("session (%s) timed out due to inactivity", getID());
return false;
}
diff --git a/shibsp/session/impl/FilesystemSessionCache.cpp b/shibsp/session/impl/FilesystemSessionCache.cpp
index 2d71bc0a..e35ed369 100644
--- a/shibsp/session/impl/FilesystemSessionCache.cpp
+++ b/shibsp/session/impl/FilesystemSessionCache.cpp
@@ -42,16 +42,17 @@ namespace {
FilesystemSessionCache(const ptree& pt);
~FilesystemSessionCache();
- string cache_create(DDF& sessionData);
+ string cache_create(SPRequest* request, DDF& sessionData);
DDF cache_read(
+ SPRequest* request,
const char* applicationId,
const char* key,
unsigned int lifetime=0,
unsigned int timeout=0,
const char* client_addr=nullptr
) const;
- bool cache_touch(const char* key, unsigned int timeout=0) const;
- void cache_remove(const char* key);
+ bool cache_touch(SPRequest* request, const char* key, unsigned int timeout=0) const;
+ void cache_remove(SPRequest* request, const char* key);
private:
string m_dir;
@@ -107,12 +108,13 @@ FilesystemSessionCache::~FilesystemSessionCache()
{
}
-string FilesystemSessionCache::cache_create(DDF& sessionData)
+string FilesystemSessionCache::cache_create(SPRequest* request, DDF& sessionData)
{
return string();
}
DDF FilesystemSessionCache::cache_read(
+ SPRequest* request,
const char* applicationId,
const char* key,
unsigned int lifetime,
@@ -123,11 +125,11 @@ DDF FilesystemSessionCache::cache_read(
return DDF();
}
-bool FilesystemSessionCache::cache_touch(const char* key, unsigned int timeout) const
+bool FilesystemSessionCache::cache_touch(SPRequest* request, const char* key, unsigned int timeout) const
{
return false;
}
-void FilesystemSessionCache::cache_remove(const char* key)
+void FilesystemSessionCache::cache_remove(SPRequest* request, const char* key)
{
}
diff --git a/shibsp/session/impl/MemorySessionCache.cpp b/shibsp/session/impl/MemorySessionCache.cpp
index 1098fea7..4306cde8 100644
--- a/shibsp/session/impl/MemorySessionCache.cpp
+++ b/shibsp/session/impl/MemorySessionCache.cpp
@@ -41,16 +41,17 @@ namespace {
MemorySessionCache(const ptree& pt);
~MemorySessionCache();
- string cache_create(DDF& sessionData);
+ string cache_create(SPRequest* request, DDF& sessionData);
DDF cache_read(
+ SPRequest* request,
const char* applicationId,
const char* key,
unsigned int lifetime=0,
unsigned int timeout=0,
const char* client_addr=nullptr
) const;
- bool cache_touch(const char* key, unsigned int timeout=0) const;
- void cache_remove(const char* key);
+ bool cache_touch(SPRequest* request, const char* key, unsigned int timeout=0) const;
+ void cache_remove(SPRequest* request, const char* key);
private:
duthomhas::csprng m_rng;
@@ -71,12 +72,13 @@ MemorySessionCache::~MemorySessionCache()
{
}
-string MemorySessionCache::cache_create(DDF& sessionData)
+string MemorySessionCache::cache_create(SPRequest* request, DDF& sessionData)
{
return hex_encode(m_rng(string(16,0)));
}
DDF MemorySessionCache::cache_read(
+ SPRequest* request,
const char* applicationId,
const char* key,
unsigned int lifetime,
@@ -87,11 +89,11 @@ DDF MemorySessionCache::cache_read(
return DDF();
}
-bool MemorySessionCache::cache_touch(const char* key, unsigned int timeout) const
+bool MemorySessionCache::cache_touch(SPRequest* request, const char* key, unsigned int timeout) const
{
return true;
}
-void MemorySessionCache::cache_remove(const char* key)
+void MemorySessionCache::cache_remove(SPRequest* request, const char* key)
{
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list