Package org.broadleafcommerce.common.crossapp.service

Interface CrossAppAuthService

public interface CrossAppAuthService

A service responsible for allowing secure authentication for a user between the admin and site applications.

This service generates a single use and time sensitive token for a user from the admin application. This token is sent to the user and he must present it in a timely manner to the site application to associate his session as authenticated from the admin applicaiton.

Author:

Andre Azzolini (apazzolini)

See Also:

• CrossAppAdminAuthService

Field Summary

Fields

Modifier and Type	Field	Description
static final String	AUTH_FROM_ADMIN_SESSION_VAR
static final String	AUTH_FROM_ADMIN_URL_PARAM

Method Summary

Modifier and Type	Method	Description
Long	getCurrentAuthedAdminId()
boolean	hasCsrPermission()
boolean	hasQuotePermission()
boolean	isAuthedFromAdmin()
void	useSiteAuthToken(Long adminUserId, String token, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)	Consumes an authentication token for the given user id and token.

Field Details

AUTH_FROM_ADMIN_URL_PARAM

static final String AUTH_FROM_ADMIN_URL_PARAM

See Also:

• Constant Field Values

AUTH_FROM_ADMIN_SESSION_VAR

static final String AUTH_FROM_ADMIN_SESSION_VAR

See Also:

• Constant Field Values

Method Details

useSiteAuthToken

void useSiteAuthToken(Long adminUserId,
 String token,
 jakarta.servlet.http.HttpServletRequest request,
 jakarta.servlet.http.HttpServletResponse response)
               throws IllegalArgumentException

Consumes an authentication token for the given user id and token. This method will additionally register the current session (acquired from the RedirectAttributes argument) as having an admin authentication for the given adminUserId, to do so it will try to use bean blSecurityContextRepository defined in Site and/or Admin Security configs. If it fails to find such bean, will directly set security context to a session(this is required from blc 7.0.0 spring-boot 3.0)

Parameters:

adminUserId -

token -

request -

response -

Throws:

IllegalArgumentException

isAuthedFromAdmin

boolean isAuthedFromAdmin()

Returns:

whether or not the user is currently authenticated from the admin

getCurrentAuthedAdminId

Long getCurrentAuthedAdminId()

Returns:

the id of the currently authenticated admin user. Returns null if there is no currently authenticated user

hasCsrPermission

boolean hasCsrPermission()

Returns:

whether or not the user is currently authenticated from the admin and also has the CSR role

hasQuotePermission

boolean hasQuotePermission()

Returns:

whether or not the user is currently authenticated from the admin and also has the CSR Quote role