Worklight adapter end session

Question

I'm using adapter-based authentication. The client obtains some credentials, the adapter validates those again an enterprise service, the result is I'm now in my enterpriseRealm.

Later, my HTTP adapters, protected by that realm go fetch some data from other enterprise services, providing some credentials obtained when the original authentication occurred.

One possible outcome is that the enterprise service may now detect that the user's session is no longer valid - one possible scenario is that the user has had their privileges revoked - and hence my HTTP adapter now "knows" that the user no longer should be treated as authenticated in the enterpriseRealm, future calls to the HTTP adapters should require reauthentication.

I was looking for some way on the server side to "logout" or otherwise notify Worklight that the session is invalid. Best I can see so far is to send an particular error response back to the client and have client code call WL.Client.logout(). I'm slightly uneasy about this as it requires that all clients of my HTTP adapter methods correctly handle this error condition. Is there any better alternative?

Answer 1

Similarly to the way you set active user after successful authentication you can use WL.Server.setActiveUser("your-realm", null) API. This will destroy stored userIdentity stored on WL server. Once you do that - next incoming requests will get an authentication challenge.

Answer 2

Speculating my own partial answer to this question:

If using adapter-based authentication then the client will have a Challenge Handler installed. All adapter responses are offered to installed Challenge Handlers and hence if the HTTP adapter returns a response matching the pattern that the Challenge Handler is expecting we have the opportunity to terminate the session.

This makes the Challenge Handler a single point of control, no need for the various client code making the adapter calls to make this check.

I assume then that the Challenge Handler can at this point call logout();