Search code examples
sessionsingle-sign-onsession-cookiesonelogin

OneLogin programmatic session cookie validation - No browser

I have the following scenario that I am curious if it is possible to implement. I need to use SSO and more specifically OneLogin to authenticate the user via custom UI from my Java standalone application. I know this can be done via Create Session Login Token and then Create session via token One Login API calls. With some parsing I can get the session cookie out of the last call and store it.

Now I need to programmatically hit the API server, which is to be build still and this server somehow needs to validate the session cookie that I am going to send along with request. The key word "Programatically" as in there will be no browser

OneLogin doesn't provide SDK to validate existing session cookie => it would be nice if I could, based on session cookie find out if it is still valid and what is the user name used for this session. If session is invalid API server would return unauthorized.

Is this even possible? Or is it possible in some other way?

  1. Basically One Login is already used in our ecosystem and I have to continue using it
  2. The app that will log user in and get the session cookie may not be the one calling the API server. This could be another java application that would receive the session

I guess what I am looking for is Validate Session equivalent from Open ID Connect API in general API

Solution

  • The session_token that is returned via that API has a short expiry is only intended to be used for making the Create Session request which returns session cookies.

    It sounds like OpenId Connect might be the best option for this use case. If you have user credentials then you could use the Resource Owner Password Grant flow to authenticate the user and obtain an id_token.

    The id_token is a JWT containing user details can then be verified for authenticity by checking its signature, audience and expiry claims. It can also hold other custom information about the user that may be used by your backend application.