Package org.jivesoftware.openfire.fast

Class FastSessionState

java.lang.Object
org.jivesoftware.openfire.fast.FastSessionState
public final class FastSessionState extends Object
Typed access to the FAST (XEP-0484) state that is held on a session. Most of this state belongs to a single SASL2 authentication attempt and is cleared between attempts, by clearRequest(LocalSession) before a new request is parsed and by clearAuthenticationAttempt(LocalSession) once one has completed. The set of advertised mechanisms is the exception: it belongs to the session and survives for as long as it does.

  • Method Details

    • setRequestedMechanism

      public static void setRequestedMechanism(@Nonnull LocalSession session, @Nonnull String mechanism)
      Records the FAST mechanism for which the client has asked to be issued a token.
      Parameters:
      session - the session that is authenticating (cannot be null)
      mechanism - the requested FAST mechanism name (cannot be null)

    • getRequestedMechanism

      @Nullable public static String getRequestedMechanism(@Nonnull LocalSession session)
      Returns the FAST mechanism for which the client has asked to be issued a token.
      Parameters:
      session - the session that is authenticating (cannot be null)
      Returns:
      the requested FAST mechanism name, or null if no token was requested

    • setInvalidate

      public static void setInvalidate(@Nonnull LocalSession session)
      Records that the client has asked for the token it is authenticating with to be invalidated.
      Parameters:
      session - the session that is authenticating (cannot be null)

    • isInvalidateRequested

      public static boolean isInvalidateRequested(@Nonnull LocalSession session)
      Returns whether the client has asked for the token it is authenticating with to be invalidated.
      Parameters:
      session - the session that is authenticating (cannot be null)
      Returns:
      true if invalidation was requested

    • setReplayCount

      public static void setReplayCount(@Nonnull LocalSession session, long count)
      Records the replay counter that the client supplied with its token.
      Parameters:
      session - the session that is authenticating (cannot be null)
      count - the counter value, which is always positive

    • getReplayCount

      @Nullable public static Long getReplayCount(@Nonnull LocalSession session)
      Returns the replay counter that the client supplied with its token.
      Parameters:
      session - the session that is authenticating (cannot be null)
      Returns:
      the counter value, or null if the client supplied none

    • setExpectedUsername

      public static void setExpectedUsername(@Nonnull LocalSession session, @Nonnull String expectedUsername)
      Records the username that the client claimed in the stream's 'from' attribute. The authcid in a FAST initiator message is checked against this value, so that a token cannot be presented for an account other than the one the stream claims.
      Parameters:
      session - the session that is authenticating (cannot be null)
      expectedUsername - the local username derived from the stream's 'from' attribute (cannot be null)

    • getExpectedUsername

      @Nullable public static String getExpectedUsername(@Nonnull LocalSession session)
      Returns the username that the client claimed in the stream's 'from' attribute.
      Parameters:
      session - the session that is authenticating (cannot be null)
      Returns:
      the expected local username, or null if none was recorded

    • setClientId

      public static void setClientId(@Nonnull LocalSession session, @Nonnull String clientId)
      Records the client identifier that this authentication attempt applies to, taken from the 'id' attribute of the SASL2 user-agent element. FAST tokens are issued and looked up per client.
      Parameters:
      session - the session that is authenticating (cannot be null)
      clientId - the user-agent identifier (cannot be null)

    • getClientId

      @Nullable public static String getClientId(@Nonnull LocalSession session)
      Returns the client identifier that this authentication attempt applies to.
      Parameters:
      session - the session that is authenticating (cannot be null)
      Returns:
      the user-agent identifier, or null if none was recorded

    • setAuthenticatedClientId

      public static void setAuthenticatedClientId(@Nonnull LocalSession session, @Nonnull String clientId)
      Records the client identifier whose token was successfully validated, as established by the SASL mechanism rather than claimed by the client.
      Parameters:
      session - the session that is authenticating (cannot be null)
      clientId - the identifier of the client whose token was used (cannot be null)

    • getAuthenticatedClientId

      @Nullable public static String getAuthenticatedClientId(@Nonnull LocalSession session)
      Returns the client identifier whose token was successfully validated.
      Parameters:
      session - the session that is authenticating (cannot be null)
      Returns:
      the identifier of the client whose token was used, or null if no token was validated

    • setRotatedToken

      public static void setRotatedToken(@Nonnull LocalSession session, @Nonnull FastToken token)
      Records a replacement token that was issued while validating the token the client presented, for inclusion in the SASL2 success response.
      Parameters:
      session - the session that is authenticating (cannot be null)
      token - the newly issued token (cannot be null)

    • getRotatedToken

      @Nullable public static FastToken getRotatedToken(@Nonnull LocalSession session)
      Returns the replacement token that was issued while validating the token the client presented.
      Parameters:
      session - the session that is authenticating (cannot be null)
      Returns:
      the newly issued token, or null if no token was rotated

    • setAdvertisedMechanisms

      public static void setAdvertisedMechanisms(@Nonnull LocalSession session, @Nonnull Set<String> mechanisms)
      Records the FAST mechanisms that were advertised to this session in the XEP-0484 inline feature. A mechanism that a session was not offered cannot be selected or requested by it, so this is what an inbound selection is validated against.
      Parameters:
      session - the session the mechanisms were advertised to (cannot be null)
      mechanisms - the advertised FAST mechanism names, possibly empty (cannot be null)

    • getAdvertisedMechanisms

      @Nonnull public static Optional<Set<String>> getAdvertisedMechanisms(@Nonnull LocalSession session)
      Returns the FAST mechanisms that were advertised to this session in the XEP-0484 inline feature. An empty Optional means that no advertisement has happened yet, which is distinct from an advertisement that offered no FAST mechanisms at all.
      Parameters:
      session - the session the mechanisms were advertised to (cannot be null)
      Returns:
      the advertised FAST mechanism names, or an empty Optional if nothing has been advertised yet

    • clearRequest

      public static void clearRequest(@Nonnull LocalSession session)
      Clears input state before parsing a new authentication request.
      Parameters:
      session - the session that is authenticating (cannot be null)

    • clearAuthenticationAttempt

      public static void clearAuthenticationAttempt(@Nonnull LocalSession session)
      Clears all state after an authentication attempt has completed.
      Parameters:
      session - the session that was authenticating (cannot be null)