view release on metacpan or  search on metacpan

lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm  view on Meta::CPAN

        }
    }

    return $result;
}

sub encryptToken {
    my ( $self, $rp, $token, $alg, $enc ) = @_;
    return $token unless $alg;
    my $keys = $self->rpEncKey->{$rp};
    unless ($keys) {
        $self->logger->error(
            "No key defined for $rp, unable to encrypt tokens");
        return $token;
    }
    my $key = $keys->{$alg};
    unless ($key) {
        $self->logger->error(
            "No compatible key found for $rp with algorithm $alg");
        return $token;
    }
    $self->logger->debug('Encrypt JWT token');
    my $tmp = eval {
        Crypt::JWT::encode_jwt(
            payload => $token,
            alg     => $alg,
            key     => $key,
            enc     => $enc || 'A128CBC-HS256',
        );
    };
    if ($@) {
        $self->logger->error("Unable to encrypt token: $@");
        return undef;
    }
    return $token;
}

# Used to build refresh_token
sub getAttributesForUser {
    my ( $self, $req, $session ) = @_;
    $req->userData( $session->data );
    $req->{error} = $self->p->processRefreshSession($req);

    return 1 unless $req->error > 0;

    # PE_BADCREDENTIAL is returned by UserDB modules when the user was
    # explicitly not found. And not in case of temporary failures
    if ( $req->error == PE_BADCREDENTIALS ) {
        $self->logger->error( "User: "
              . $req->user
              . " no longer exists, removing offline session" );
        $session->remove;
    }
    else {
        $self->logger->error( "Could not resolve user: " . $req->user );
    }
    return 0;
}

# Change the ID of secondary sessions (during upgrade)
sub updateOidcSecondarySessions {
    my ( $self, $req, $old_session_id, $new_session_id ) = @_;

    my $module = "Lemonldap::NG::Common::Apache::Session";

    my %opts    = $self->_storeOpts;
    my $options = $opts{storageModuleOptions};
    $options->{backend} = $opts{storageModule};

    my $oidc_sessions =
      $module->searchOn( $options, "user_session_id", $old_session_id );

    if (
        my @oidc_sessions_keys =
        grep { $oidc_sessions->{$_}->{_session_kind} eq $self->sessionKind }
        keys %$oidc_sessions
      )
    {

        foreach my $oidc_session (@oidc_sessions_keys) {

            # Get session
            $self->logger->debug("Retrieve OIDC session $oidc_session");

            my $oidcSession = $self->getOpenIDConnectSession( $oidc_session, '',
                hashStore => 0 );

            if ($oidcSession) {

                # Delete session
                $oidcSession->update( { user_session_id => $new_session_id } );
            }
        }
    }

    return;
}

1;