AuthenticationService

java.lang.Object
- services.gui.AuthenticationService

```
@Singleton
public class AuthenticationService
extends java.lang.Object
```
Service class around authentication, session cookie and session cache handling. It works together with the Authentication controller and the @Authenticated annotation defined in AuthenticationAction. If a user is authenticated (same password as stored in the database) a user session ID is generated and stored in Play's session cookie and in the the cache. With each subsequent request this session is checked in the AuthenticationAction.

Field Summary

Fields
Modifier and Type	Field and Description
`static java.lang.String`	`LOGGED_IN_USER` Key name used in RequestScope to store the logged-in User
`static java.lang.String`	`SESSION_ID` Parameter name in Play's session cookie: It contains the username of the logged in user
`static java.lang.String`	`SESSION_LAST_ACTIVITY_TIME` Parameter name in Play's session cookie: It contains a timestamp of the time of the last HTTP request done by the browser with this cookie
`static java.lang.String`	`SESSION_LOGIN_TIME` Parameter name in Play's session cookie: It contains the timestamp of the login time
`static java.lang.String`	`SESSION_USERNAME` Parameter name in Play's session cookie: It contains the username of the logged in user

Method Summary

All Methods Instance Methods Concrete Methods
Modifier and Type	Method and Description
`boolean`	`authenticate(User user, java.lang.String password)` Authenticates the user with the given password.
`void`	`clearSessionCookie(play.mvc.Http.Session session)` Deletes the session cookie.
`void`	`clearSessionCookieAndSessionCache(play.mvc.Http.Session session, java.lang.String normalizedUsername, java.lang.String remoteAddress)` Deletes the session cookie and removes the cache entry.
`com.google.api.client.googleapis.auth.oauth2.GoogleIdToken`	`fetchOAuthGoogleIdToken(java.lang.String idTokenString)` Verifies and fetches an ID token from Google OAuth by sending an HTTP POST to Google.
`User`	`getLoggedInUser()` Gets the logged-in user from the RequestScope.
`User`	`getLoggedInUserBySessionCookie(play.mvc.Http.Session session)` Retrieves the logged-in user from Play's session.
`boolean`	`isInactivityTimeout(play.mvc.Http.Session session)` Returns true if the session inactivity time as saved in Play's session cookie is older than allowed.
`boolean`	`isRepeatedLoginAttempt(java.lang.String normalizedUsername)` Checks the user session cache whether this user tries to login repeatedly
`boolean`	`isSessionTimeout(play.mvc.Http.Session session)` Returns true if the session login time as saved in Play's session cookie is older than allowed.
`boolean`	`isValidSessionId(play.mvc.Http.Session session, java.lang.String normalizedUsername, java.lang.String remoteAddress)` Checks the session ID stored in Play's session cookie whether it is the same as stored in the cache during the last login.
`void`	`refreshSessionCookie(play.mvc.Http.Session session)` Refreshes the last activity timestamp in Play's session cookie.
`void`	`setLastSeen(java.lang.String normalizedUsername)` Sets the time of the last activity of the given user
`void`	`writeSessionCookieAndSessionCache(play.mvc.Http.Session session, java.lang.String normalizedUsername, java.lang.String remoteAddress)` Prepares Play's session cookie and the user session cache for the user with the given username to be logged-in.

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- Field Detail
  - SESSION_ID
```
public static final java.lang.String SESSION_ID
```
    Parameter name in Play's session cookie: It contains the username of the logged in user
    
    See Also:
    
    Constant Field Values
  - SESSION_USERNAME
```
public static final java.lang.String SESSION_USERNAME
```
    Parameter name in Play's session cookie: It contains the username of the logged in user
    
    See Also:
    
    Constant Field Values
  - SESSION_LOGIN_TIME
```
public static final java.lang.String SESSION_LOGIN_TIME
```
    Parameter name in Play's session cookie: It contains the timestamp of the login time
    
    See Also:
    
    Constant Field Values
  - SESSION_LAST_ACTIVITY_TIME
```
public static final java.lang.String SESSION_LAST_ACTIVITY_TIME
```
    Parameter name in Play's session cookie: It contains a timestamp of the time of the last HTTP request done by the browser with this cookie
    
    See Also:
    
    Constant Field Values
  - LOGGED_IN_USER
```
public static final java.lang.String LOGGED_IN_USER
```
    Key name used in RequestScope to store the logged-in User
    
    See Also:
    
    Constant Field Values
- Method Detail
  - authenticate
```
public boolean authenticate(User user,
                            java.lang.String password)
                     throws javax.naming.NamingException
```
    Authenticates the user with the given password.
    
    Throws:
    
    javax.naming.NamingException
  - fetchOAuthGoogleIdToken
```
public com.google.api.client.googleapis.auth.oauth2.GoogleIdToken fetchOAuthGoogleIdToken(java.lang.String idTokenString)
                                                                                   throws java.security.GeneralSecurityException,
                                                                                          java.io.IOException
```
    Verifies and fetches an ID token from Google OAuth by sending an HTTP POST to Google. The actual authentication happens in the frontend with Google's gapi library.
    
    Throws:
    
    java.security.GeneralSecurityException
    
    java.io.IOException
  - isRepeatedLoginAttempt
```
public boolean isRepeatedLoginAttempt(java.lang.String normalizedUsername)
```
    Checks the user session cache whether this user tries to login repeatedly
  - getLoggedInUserBySessionCookie
```
public User getLoggedInUserBySessionCookie(play.mvc.Http.Session session)
```
    Retrieves the logged-in user from Play's session. If a user is logged-in their username is stored in Play's session cookie. With the username a user can be retrieved from the database. Returns null if the session doesn't contains an username or if the user doesn't exists in the database.
    In most cases getLoggedInUser() is faster since it doesn't has to query the database.
  - getLoggedInUser
```
public User getLoggedInUser()
```
    Gets the logged-in user from the RequestScope. It was put into the RequestScope by the AuthenticationAction. Therefore this method works only if you use the @Authenticated annotation at your action.
  - writeSessionCookieAndSessionCache
```
public void writeSessionCookieAndSessionCache(play.mvc.Http.Session session,
                                              java.lang.String normalizedUsername,
                                              java.lang.String remoteAddress)
```
    Prepares Play's session cookie and the user session cache for the user with the given username to be logged-in. Does not authenticate the user (use authenticate() for this).
  - refreshSessionCookie
```
public void refreshSessionCookie(play.mvc.Http.Session session)
```
    Refreshes the last activity timestamp in Play's session cookie. This is usually done with each HTTP call of the user.
  - clearSessionCookie
```
public void clearSessionCookie(play.mvc.Http.Session session)
```
    Deletes the session cookie. This is usual done during a user logout.
  - clearSessionCookieAndSessionCache
```
public void clearSessionCookieAndSessionCache(play.mvc.Http.Session session,
                                              java.lang.String normalizedUsername,
                                              java.lang.String remoteAddress)
```
    Deletes the session cookie and removes the cache entry. This is usual done during a user logout.
  - isValidSessionId
```
public boolean isValidSessionId(play.mvc.Http.Session session,
                                java.lang.String normalizedUsername,
                                java.lang.String remoteAddress)
```
    Checks the session ID stored in Play's session cookie whether it is the same as stored in the cache during the last login.
  - isSessionTimeout
```
public boolean isSessionTimeout(play.mvc.Http.Session session)
```
    Returns true if the session login time as saved in Play's session cookie is older than allowed.
  - isInactivityTimeout
```
public boolean isInactivityTimeout(play.mvc.Http.Session session)
```
    Returns true if the session inactivity time as saved in Play's session cookie is older than allowed.
  - setLastSeen
```
public void setLastSeen(java.lang.String normalizedUsername)
```
    Sets the time of the last activity of the given user

Class AuthenticationService

Field Summary

Method Summary

Methods inherited from class java.lang.Object

Field Detail

SESSION_ID

SESSION_USERNAME

SESSION_LOGIN_TIME

SESSION_LAST_ACTIVITY_TIME

LOGGED_IN_USER

Method Detail

authenticate

fetchOAuthGoogleIdToken

isRepeatedLoginAttempt

getLoggedInUserBySessionCookie

getLoggedInUser

writeSessionCookieAndSessionCache

refreshSessionCookie

clearSessionCookie

clearSessionCookieAndSessionCache

isValidSessionId

isSessionTimeout

isInactivityTimeout

setLastSeen