com.github.dbadia.sqrl.server

Class SqrlServerOperations

java.lang.Object

com.github.dbadia.sqrl.server.SqrlServerOperations

public class SqrlServerOperations
extends Object

The core SQRL class which processes all SQRL requests and generates the appropriates responses. Registers itself for servlet context destroy events so background tasks can be stopped

Author:

Dave Badia

Constructor Summary

Constructors

Constructor and Description
SqrlServerOperations(SqrlConfig config) Initializes the operations class with the given config, defaulting to the built in JPA persisentce provider.

Method Summary

Modifier and Type	Method and Description
void	cleanSqrlAuthData(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Clears SQRL auth one time use data from the browser and database
void	deleteSqrlAuthCookies(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Called by the web app once authentication is complete to cleanup any cookies set by the SQRL library
void	deleteSqrlCorrelator(SqrlCorrelator sqrlCorrelator)
long	determineNutExpiry(javax.servlet.http.HttpServletRequest request) Looks for the SQRL first nut cookie and extracts the time at which it expires
String	extractSqrlCorrelatorStringFromRequestCookie(javax.servlet.http.HttpServletRequest request) Checks the request and trys to extract the correlator string from the cookie.
SqrlCorrelator	fetchSqrlCorrelator(javax.servlet.http.HttpServletRequest request)
SqrlCorrelator	fetchSqrlCorrelator(String correlatorString)
Map<String,SqrlCorrelator>	fetchSqrlCorrelatorsDetached(Set<String> correlatorStringSet)
Map<String,SqrlAuthenticationStatus>	fetchSqrlCorrelatorStatusUpdates(Map<String,SqrlAuthenticationStatus> correlatorToCurrentStatusTable)
SqrlIdentity	fetchSqrlIdentityByUserXref(String webAppUserCrossReference) Invoked to see if a web app user has a corresponding SQRL identity registered
void	handleSqrlClientRequest(javax.servlet.http.HttpServletRequest servletRequest, javax.servlet.http.HttpServletResponse servletResponse) The backchannel servlet which is accepting requests from SQRL clients should call this method to process the request
SqrlAuthPageData	prepareSqrlAuthPageData(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, InetAddress userInetAddress, int qrCodeSizeInPixels) Called to generate the data the server needs to display to allow a user to authenticate via SQRL
protected boolean	processClientCommand(SqrlClientRequest request, SqrlNutToken nutToken, SqrlTif.TifBuilder tifBuilder, String correlator)
static void	setExecutor(SqrlServiceExecutor sqrlServiceExecutor) Poor mans dependency injection.
void	updateNativeUserXref(SqrlIdentity sqrlIdentity, String nativeUserCrossReference)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SqrlServerOperations

public SqrlServerOperations(SqrlConfig config)

Initializes the operations class with the given config, defaulting to the built in JPA persisentce provider.

Parameters:

sqrlPersistence - the persistence to be used for storing and retreiving SQRL data

config - the SQRL settings to be used

Throws:

SqrlException

Method Detail

setExecutor

public static void setExecutor(SqrlServiceExecutor sqrlServiceExecutor)

Poor mans dependency injection. Can't use CDI since we want to support lightweight JEE servers like tomcat

Parameters:

sqrlServiceExecutor -

prepareSqrlAuthPageData

public SqrlAuthPageData prepareSqrlAuthPageData(javax.servlet.http.HttpServletRequest request,
                                                javax.servlet.http.HttpServletResponse response,
                                                InetAddress userInetAddress,
                                                int qrCodeSizeInPixels)
                                         throws SqrlException

Called to generate the data the server needs to display to allow a user to authenticate via SQRL

Parameters:

request - the servlet request

response -

userInetAddress - the IP address of the users browser

qrCodeSizeInPixels - the size (in pixels) that the generated QR code will be

Returns:

the data the server needs to display to allow a user to authenticate via SQRL

Throws:

SqrlException - if an error occurs

handleSqrlClientRequest

public void handleSqrlClientRequest(javax.servlet.http.HttpServletRequest servletRequest,
                                    javax.servlet.http.HttpServletResponse servletResponse)
                             throws IOException

The backchannel servlet which is accepting requests from SQRL clients should call this method to process the request

Parameters:

servletRequest - the servlet request

servletResponse - the servlet response which will be populated accordingly

Throws:

IOException - if an IO error occurs

processClientCommand

protected boolean processClientCommand(SqrlClientRequest request,
                                       SqrlNutToken nutToken,
                                       SqrlTif.TifBuilder tifBuilder,
                                       String correlator)
                                throws SqrlException

Throws:

SqrlException

deleteSqrlAuthCookies

public void deleteSqrlAuthCookies(javax.servlet.http.HttpServletRequest request,
                                  javax.servlet.http.HttpServletResponse response)

Called by the web app once authentication is complete to cleanup any cookies set by the SQRL library

Parameters:

request - the HTTP request

response - the HTTP response

determineNutExpiry

public long determineNutExpiry(javax.servlet.http.HttpServletRequest request)
                        throws SqrlException

Looks for the SQRL first nut cookie and extracts the time at which it expires

Parameters:

request - the HTTP request

Returns:

the timestamp when the nut token expires

Throws:

SqrlException - if an error occurs

updateNativeUserXref

public void updateNativeUserXref(SqrlIdentity sqrlIdentity,
                                 String nativeUserCrossReference)

extractSqrlCorrelatorStringFromRequestCookie

public String extractSqrlCorrelatorStringFromRequestCookie(javax.servlet.http.HttpServletRequest request)

Checks the request and trys to extract the correlator string from the cookie. Useful for error logging/reporting when a persistence call is unnecessary

Returns:

the value or null if the cookie was not present

fetchSqrlCorrelator

public SqrlCorrelator fetchSqrlCorrelator(javax.servlet.http.HttpServletRequest request)

fetchSqrlCorrelator

public SqrlCorrelator fetchSqrlCorrelator(String correlatorString)

fetchSqrlIdentityByUserXref

public SqrlIdentity fetchSqrlIdentityByUserXref(String webAppUserCrossReference)

Invoked to see if a web app user has a corresponding SQRL identity registered

Parameters:

webAppUserCrossReference - the username, customer id, or whatever mechanism is used to uniquely identify users in the web app

Returns:

the SQRL identity or null if none exists for this web app user

fetchSqrlCorrelatorsDetached

public Map<String,SqrlCorrelator> fetchSqrlCorrelatorsDetached(Set<String> correlatorStringSet)

fetchSqrlCorrelatorStatusUpdates

public Map<String,SqrlAuthenticationStatus> fetchSqrlCorrelatorStatusUpdates(Map<String,SqrlAuthenticationStatus> correlatorToCurrentStatusTable)

deleteSqrlCorrelator

public void deleteSqrlCorrelator(SqrlCorrelator sqrlCorrelator)

cleanSqrlAuthData

public void cleanSqrlAuthData(javax.servlet.http.HttpServletRequest request,
                              javax.servlet.http.HttpServletResponse response)

Clears SQRL auth one time use data from the browser and database