[cpp-sp] branch main updated: CPPSP-58 - Implement session NotOnOrAfter feature

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository cpp-sp.

View the commit online:
https://codeberg.org/Shibboleth/cpp-sp/commit/08e76bd7d18828316dc126bcdb1b2fc9c8dd1c76

The following commit(s) were added to refs/heads/main by this push:
     new 08e76bd7 CPPSP-58 - Implement session NotOnOrAfter feature
08e76bd7 is described below

commit 08e76bd7d18828316dc126bcdb1b2fc9c8dd1c76
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Mon May 11 09:56:27 2026 -0400

    CPPSP-58 - Implement session NotOnOrAfter feature
    
    https://shibboleth.atlassian.net/browse/CPPSP-58
---
 shibsp/session/impl/AbstractSessionCache.cpp       | 19 ++++++++++++++++++-
 shibsp/session/impl/FilesystemSessionCache.cpp     | 11 +++++++++++
 shibsp/session/impl/MemorySessionCache.cpp         | 11 +++++++++++
 shibsp/session/impl/StorageServiceSessionCache.cpp | 13 ++++++++++++-
 4 files changed, 52 insertions(+), 2 deletions(-)

diff --git a/shibsp/session/impl/AbstractSessionCache.cpp b/shibsp/session/impl/AbstractSessionCache.cpp
index f1cb977b..dd18f266 100644
--- a/shibsp/session/impl/AbstractSessionCache.cpp
+++ b/shibsp/session/impl/AbstractSessionCache.cpp
@@ -864,7 +864,24 @@ bool BasicSession::isValid(SPRequest* request, unsigned int lifetime, unsigned i
     time_t now = time(nullptr);
 
     if (lifetime) {
-        // Enforce session lifetime.
+        // Check for SessionNotOnOrAfter
+        long long notonorafter = m_obj["notonorafter"].longinteger();
+        if (notonorafter > 0 && notonorafter <= now) {
+            if ((request && request->isPriorityEnabled(Priority::SHIB_WARN)) || m_cache.logger().isWarnEnabled()) {
+                string expired(date::format("%FT%TZ", chrono::system_clock::from_time_t(notonorafter)));
+                AbstractSessionCache::log(request, m_cache.logger(), Priority::SHIB_WARN,
+                    "session (%s) has expired per NotOnOrAfter policy (%s)", getID(), expired.c_str());
+            }
+            try {
+                m_cache.cache_remove(request, getID());
+            }
+            catch (const exception&) {
+                // Should be logged by SPI.
+            }
+            return false;
+        }
+
+        // Enforce local session lifetime.
         if (getCreation() + lifetime < now) {
             if ((request && request->isPriorityEnabled(Priority::SHIB_WARN)) || m_cache.logger().isWarnEnabled()) {
                 string created(date::format("%FT%TZ", chrono::system_clock::from_time_t(getCreation())));
diff --git a/shibsp/session/impl/FilesystemSessionCache.cpp b/shibsp/session/impl/FilesystemSessionCache.cpp
index 676732f4..06356393 100644
--- a/shibsp/session/impl/FilesystemSessionCache.cpp
+++ b/shibsp/session/impl/FilesystemSessionCache.cpp
@@ -323,6 +323,17 @@ DDF FilesystemSessionCache::cache_read(
     }
 
     if (lifetime) {
+        time_t notonorafter = obj["notonorafter"].longinteger();
+        if (notonorafter > 0 && notonorafter <= now) {
+            obj.destroy();
+            if ((request && request->isPriorityEnabled(Priority::SHIB_INFO)) || m_spilog.isInfoEnabled()) {
+                string expired(date::format("%FT%TZ", chrono::system_clock::from_time_t(notonorafter)));
+                log(INFO_MARK, "session (%s) has expired per NotOnOrAfter policy (%s)", key, expired.c_str());
+            }
+            cache_remove(request, key);
+            return obj;
+        }
+
         time_t start = obj["ts"].longinteger();
         if (start + lifetime < now) {
             obj.destroy();
diff --git a/shibsp/session/impl/MemorySessionCache.cpp b/shibsp/session/impl/MemorySessionCache.cpp
index 264d16d6..08e73820 100644
--- a/shibsp/session/impl/MemorySessionCache.cpp
+++ b/shibsp/session/impl/MemorySessionCache.cpp
@@ -199,6 +199,17 @@ DDF MemorySessionCache::cache_read(
     }
 
     if (lifetime) {
+        time_t notonorafter = entry->second.first["notonorafter"].longinteger();
+        if (notonorafter > 0 && notonorafter <= now) {
+            if (m_spilog.isInfoEnabled()) {
+                string expired(date::format("%FT%TZ", chrono::system_clock::from_time_t(notonorafter)));
+                log(INFO_MARK, "session (%s) has expired per NotOnOrAfter policy (%s)", key, expired.c_str());
+            }
+            m_lock.unlock();
+            cache_remove(request, key);
+            return DDF();
+        }
+
         time_t start = entry->second.first["ts"].longinteger();
         if (start + lifetime < now) {
             if (m_spilog.isInfoEnabled()) {
diff --git a/shibsp/session/impl/StorageServiceSessionCache.cpp b/shibsp/session/impl/StorageServiceSessionCache.cpp
index fb579b46..584a0d8f 100644
--- a/shibsp/session/impl/StorageServiceSessionCache.cpp
+++ b/shibsp/session/impl/StorageServiceSessionCache.cpp
@@ -186,9 +186,20 @@ DDF StorageServiceSessionCache::cache_read(
 
     if (lifetime) {
         time_t now = time(nullptr);
+
+        time_t notonorafter = sessionData["notonorafter"].longinteger();
+        if (notonorafter > 0 && notonorafter <= now) {
+            if ((request && request->isPriorityEnabled(Priority::SHIB_INFO)) || m_spilog.isInfoEnabled()) {
+                string expired(date::format("%FT%TZ", chrono::system_clock::from_time_t(notonorafter)));
+                log(INFO_MARK, "session (%s) has expired per NotOnOrAfter policy (%s)", key, expired.c_str());
+            }
+            cache_remove(request, key);
+            return DDF();
+        }
+
         time_t start = sessionData["ts"].longinteger();
         if (start + lifetime < now) {
-            if (m_spilog.isInfoEnabled()) {
+            if ((request && request->isPriorityEnabled(Priority::SHIB_INFO)) || m_spilog.isInfoEnabled()) {
                 string created(date::format("%FT%TZ", chrono::system_clock::from_time_t(start)));
                 string expired(date::format("%FT%TZ", chrono::system_clock::from_time_t(start + lifetime)));
                 log(INFO_MARK, "session (%s) has expired, created (%s), expired (%s)", key, created.c_str(), expired.c_str());

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.