diff --git a/jetty-ee10/jetty-ee10-openid/src/test/java/org/eclipse/jetty/ee10/security/openid/OpenIdAuthenticationTest.java b/jetty-ee10/jetty-ee10-openid/src/test/java/org/eclipse/jetty/ee10/security/openid/OpenIdAuthenticationTest.java index d1911717271..6085df5b052 100644 --- a/jetty-ee10/jetty-ee10-openid/src/test/java/org/eclipse/jetty/ee10/security/openid/OpenIdAuthenticationTest.java +++ b/jetty-ee10/jetty-ee10-openid/src/test/java/org/eclipse/jetty/ee10/security/openid/OpenIdAuthenticationTest.java @@ -13,6 +13,7 @@ package org.eclipse.jetty.ee10.security.openid; +import java.io.File; import java.io.IOException; import java.security.Principal; import java.util.Map; @@ -29,6 +30,9 @@ import org.eclipse.jetty.ee10.servlet.security.ConstraintSecurityHandler; import org.eclipse.jetty.http.HttpStatus; import org.eclipse.jetty.server.Server; import org.eclipse.jetty.server.ServerConnector; +import org.eclipse.jetty.session.FileSessionDataStoreFactory; +import org.eclipse.jetty.toolchain.test.MavenTestingUtils; +import org.eclipse.jetty.util.IO; import org.eclipse.jetty.util.security.Constraint; import org.junit.jupiter.api.AfterEach; import org.junit.jupiter.api.BeforeEach; @@ -107,6 +111,12 @@ public class OpenIdAuthenticationTest securityHandler.setInitParameter(OpenIdAuthenticator.LOGOUT_REDIRECT_PATH, "/"); context.setSecurityHandler(securityHandler); + File datastoreDir = MavenTestingUtils.getTargetTestingDir("datastore"); + IO.delete(datastoreDir); + FileSessionDataStoreFactory fileSessionDataStoreFactory = new FileSessionDataStoreFactory(); + fileSessionDataStoreFactory.setStoreDir(datastoreDir); + server.addBean(fileSessionDataStoreFactory); + server.start(); String redirectUri = "http://localhost:" + connector.getLocalPort() + "/redirect_path"; openIdProvider.addRedirectUri(redirectUri); @@ -153,6 +163,19 @@ public class OpenIdAuthenticationTest response = client.GET(appUriString + "/admin"); assertThat(response.getStatus(), is(HttpStatus.FORBIDDEN_403)); + // We can restart the server and still be logged in as we have persistent session datastore. + server.stop(); + server.start(); + appUriString = "http://localhost:" + connector.getLocalPort(); + + // After restarting server the authentication is saved as a session authentication. + response = client.GET(appUriString + "/"); + assertThat(response.getStatus(), is(HttpStatus.OK_200)); + content = response.getContentAsString(); + assertThat(content, containsString("userId: 123456789")); + assertThat(content, containsString("name: Alice")); + assertThat(content, containsString("email: Alice@example.com")); + // We are no longer authenticated after logging out response = client.GET(appUriString + "/logout"); assertThat(response.getStatus(), is(HttpStatus.OK_200)); diff --git a/jetty-ee10/jetty-ee10-servlet/src/main/java/org/eclipse/jetty/ee10/servlet/security/authentication/SessionAuthentication.java b/jetty-ee10/jetty-ee10-servlet/src/main/java/org/eclipse/jetty/ee10/servlet/security/authentication/SessionAuthentication.java index aa14c88334d..338496b3a82 100644 --- a/jetty-ee10/jetty-ee10-servlet/src/main/java/org/eclipse/jetty/ee10/servlet/security/authentication/SessionAuthentication.java +++ b/jetty-ee10/jetty-ee10-servlet/src/main/java/org/eclipse/jetty/ee10/servlet/security/authentication/SessionAuthentication.java @@ -22,11 +22,10 @@ import jakarta.servlet.http.HttpSessionActivationListener; import jakarta.servlet.http.HttpSessionBindingListener; import jakarta.servlet.http.HttpSessionEvent; import org.eclipse.jetty.ee10.servlet.security.AbstractUserAuthentication; -import org.eclipse.jetty.ee10.servlet.security.Authentication; +import org.eclipse.jetty.ee10.servlet.security.Authenticator; import org.eclipse.jetty.ee10.servlet.security.LoginService; import org.eclipse.jetty.ee10.servlet.security.SecurityHandler; import org.eclipse.jetty.ee10.servlet.security.UserIdentity; -import org.eclipse.jetty.server.Request; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -78,7 +77,13 @@ public class SessionAuthentication extends AbstractUserAuthentication return; } - LoginService loginService = security.getLoginService(); + LoginService loginService; + Authenticator authenticator = security.getAuthenticator(); + if (authenticator instanceof LoginAuthenticator) + loginService = ((LoginAuthenticator)authenticator).getLoginService(); + else + loginService = security.getLoginService(); + if (loginService == null) { if (LOG.isDebugEnabled())