[KNOX-2777] Implement concurrent session verifier

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.0
• Fix Version/s: 2.0.0
• Component/s: Server
• Assignee: Marton Balázs
• Reporter: Sandor Molnar
• Created: 12/Jul/22 09:13
• Updated: 22/Aug/22 08:29
• Resolved: 22/Aug/22 08:29

Description

The following needs to be implemented in the scope of this JIRA:

• we need 4 new Gateway-level configurations:
  • privileged user list (defaults to an empty collection)
  • non-privileged user list (defaults to an empty collection)
  • session limit for privileged users (defaults to 3)
  • session limit for non-privileged users (defaults to 2)
• if a session limit for any of the groups is set to a negative number, that means the users in that group are allowed to have an unlimited number of sessions
• In addition to the new configs, a verifier has to be implemented that enforces the following business logic: if a user is listed in the above-introduced privileged/non-privileged collection AND is about to pass a configured session limit the verification should fail. The verification should succeed if the given user is declared neither a privileged nor a non-privileged user.

The new verifier implementation may be placed in the gateway-spi-common project for now.

Issue Links

• is depended upon by: KNOX-2778 Enforce concurrent session limit in KnoxSSO
• links to: GitHub Pull Request #608