view release on metacpan or  search on metacpan

lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm  view on Meta::CPAN

    my $id = getAccessTokenSessionId($access_token);
    return unless $id;

    my $session = $self->getOpenIDConnectSession( $id, "access_token" );
    return undef unless $session;

    my $stored_hash = $session->{data}->{sha256_hash};
    if ($stored_hash) {
        my $incoming_hash = $self->createHash( $access_token, 256 );
        if ( $stored_hash eq $incoming_hash ) {
            return $session;
        }
        else {
            $self->logger->error(
                    "Incoming Access token hash $incoming_hash "
                  . "does not match stored hash $stored_hash. "
                  . "The access token might have been tampered with." );
            return undef;
        }
    }
    else {
        return $session;
    }
}

# Create a new Refresh Token
# @param info hashref of session info
# @return new Lemonldap::NG::Common::Session object

sub newRefreshToken {
    my ( $self, $rp, $info, $offline ) = @_;
    my $ttl =
      $offline
      ? (
        $self->rpOptions->{$rp}->{oidcRPMetaDataOptionsOfflineSessionExpiration}
          || $self->conf->{oidcServiceOfflineSessionExpiration} )
      : $self->conf->{timeout};
    $info->{_oidcRtUpdate} = time;

    return $self->getOpenIDConnectSession(
        undef, "refresh_token",
        ttl  => $ttl,
        info => $info
    );
}

# Get existing Refresh Token
# @param id
# @return new Lemonldap::NG::Common::Session object

sub getRefreshToken {
    my ( $self, $id, $raw ) = @_;

    return $self->getOpenIDConnectSession(
        $id, "refresh_token",
        noCache => 1,
        ( $raw ? ( hashStore => 0 ) : () )
    );
}

sub updateRefreshToken {
    my ( $self, $id, $infos ) = @_;
    $infos->{_oidcRtUpdate} = time;
    return $self->updateToken( $id, $infos );
}

sub updateToken {
    my ( $self, $id, $infos ) = @_;

    my $oidcSession = Lemonldap::NG::Common::Session->new( {
            $self->_storeOpts(),
            cacheModule        => $self->conf->{localSessionStorage},
            cacheModuleOptions => $self->conf->{localSessionStorageOptions},
            hashStore          => $self->conf->{hashedSessionStore},
            id                 => $id,
            info               => $infos,
        }
    );

    if ( $oidcSession->error ) {
        $self->userLogger->warn("OpenIDConnect session $id not found");
        return undef;
    }

    return $oidcSession;
}

# Try to recover the OpenID Connect session corresponding to id and return session
# If id is set to undef, return a new session
# @return Lemonldap::NG::Common::Session object
sub getOpenIDConnectSession {
    my $self = shift;
    my $id   = shift;
    my $type = shift;

    my $type_log = $type || "session";

    # Check old method signature ($id, $type, $ttl, $info)
    my %opts =
        ( ( $_[0] and $_[0] =~ /^\d+$/ ) or ( $_[1] and ref $_[1] ) )
      ? ( ttl => $_[0], info => $_[1] )
      : (@_);

    $opts{ttl} ||= $self->conf->{timeout};

    my $oidcSession = Lemonldap::NG::Common::Session->new( {
            $self->_storeOpts(),
            (
                $opts{noCache} ? ()
                : (
                    cacheModule        => $self->conf->{localSessionStorage},
                    cacheModuleOptions =>
                      $self->conf->{localSessionStorageOptions}
                )
            ),
            hashStore => $opts{hashStore} // $self->conf->{hashedSessionStore},
            id        => $id,
            kind      => $self->sessionKind,
            (
                $opts{info}
                ? (
                    info => {
                        _type  => $type,
                        _utime => time + $opts{ttl} - $self->conf->{timeout},
                        %{ $opts{info} }
                    }
                  )