Synchronizing a session state associated with an access token between an identity manager (IDM) and application programming interface (API) gateway
Synchronization of a session state of an access token is provided between elements in a system, such as between an Identity Manager (IDM) and an Application Programming Interface (API) Gateway. The IDM generates an access token that is provided to a client device and stores session state information of the access token at a distributed cache. When the client device logs out from the IDM, the IDM removes the session state information from the distributed storage device. The API Gateway is able to request the session state information from distributed storage device. Based on receiving the session state information, the API Gateway authenticates the access token and grants the client device access to an end service. Before requesting the session state information from the distributed storage device, the API Gateway is able to verify the access token is valid and that the access token has not expired.
1 . A method providing synchronized session state of an access token in a system, comprising:
receiving, from a client device, the access token and a first request for access to an end service;
determining whether the access token meets a first condition;
in response to the access token being determined to meet the first condition, sending, to a distributed cache maintaining a session state of the access token, a second request for the session state associated with the access token;
receiving, from the distributed cache, a session state response indicating a status of the session state associated with the access token;
performing authentication of the access token based on the session state response indicating the status of the session state associated with the access token;
in response to the status of the session state in the session state response indicating the access token being authenticated, forwarding the first request for access to an end server to the end service;
in response to the status of the session state in the session state response indicating the access token not being authenticated, generating an authentication error; and
putting a token state into the distributed cache and, upon logout of the client device, removing the token state from the distributed cache by an identity manager that provided the access token to the client device.
2 . The method of claim 1 further comprising in response to forwarding the first request to the end service, receiving an end service response from the end service and forwarding the end service response from the end service to the client device.
3 . The method of claim 1 further comprising in response to generating the authentication error, sending an error message to the client device.
4 . The method of claim 1 , wherein the receiving, from the client device, the access token includes receiving, from the client device, a JSON (JavaScript Object Notation) Web Token (JWT).
5 . The method of claim 1 , wherein the determining the access token meets the first condition includes determining the access token is valid and not expired.
6 . The method of claim 1 , wherein the determining whether the access token meets the first condition includes determining the access token does not meet the first condition.
7 . The method of claim 1 , wherein the determining the access token does not meet the first condition includes determining the access token is invalid or determining the access token is expired, generating the authentication error based on the determining the access token is invalid or determining the access token is expired, and sending the client device an error message in response to generating the authentication error.
8 . An Application Programming Interface (API) Gateway, comprising:
a memory storing computer-readable instructions; and
a processor connected to the memory, wherein the processor is configured to execute the computer-readable instructions to:
receive, from a client device, an access token and a first request for access to an end service;
determine whether the access token meets a first condition;
in response to the access token being determined to meet the first condition, send a second request for a session state associated with the access token to a distributed cache maintaining the session state of the access token;
receive, from the distributed cache, a session state response indicating a status of the session state associated with the access token;
perform authentication of the access token based on the session state response indicating the status of the session state associated with the access token;
in response to the status of the session state in the session state response indicating the access token being authenticated, forward the first request for access to an end server to the end service;
in response to the status of the session state in the session state response indicating the access token not being authenticated, generate an authentication error; and
putting a token state into the distributed cache and, upon logout of the client device, removing the token state from the distributed cache by an identity manager that provided the access token to the client device.
9 . The API Gateway of claim 8 , wherein the processor is further configured to, in response to forwarding the first request to the end service, receive an end service response from the end service and forwarding the end service response from the end service to the client device.
10 . The API Gateway of claim 8 wherein the processor is further configured to, in response to generating the authentication error, send an error message to the client device.
11 . The API Gateway of claim 8 , wherein the access token includes a JSON (JavaScript Object Notation) Web Token (JWT).
12 . The API Gateway of claim 8 , wherein the processor is further configured to determine the access token meets the first condition by determining the access token is valid and not expired.
13 . The API Gateway of claim 8 , wherein the processor is further configured to determine whether the access token meets the first condition by determining the access token does not meet the first condition.
14 . The API Gateway of claim 8 , wherein the processor is further configured to determine the access token does not meet the first condition by determining the access token is invalid or determining the access token is expired, generating the authentication error based on the determining the access token is invalid or the determining the access token is expired, and sending the client device an error message in response to generating the authentication error.
15 . A non-transitory computer-readable media having computer-readable instructions stored thereon, which when executed by a processor causes the processor to perform operations comprising:
receiving, from a client device, an access token and a first request for access to an end service;
determining whether the access token meets a first condition;
in response to the access token being determined to meet the first condition, sending, to a distributed cache maintaining a session state of the access token, a second request for the session state associated with the access token;
receiving, from the distributed cache, a session state response indicating a status of the session state associated with the access token;
performing authentication of the access token based on the session state response indicating the status of the session state associated with the access token;
in response to the status of the session state in the session state response indicating the access token being authenticated, forwarding the first request for access to an end server to the end service;
in response to the status of the session state in the session state response indicating the access token not being authenticated, generating an authentication error; and
putting a token state into the distributed cache and, upon logout of the client device, removing the token state from the distributed cache by an identity manager that provided the access token to the client device.
16 . The non-transitory computer-readable media of claim 15 further comprising in response to forwarding the first request to the end service, receiving an end service response from the end service and forwarding the end service response from the end service to the client device.
17 . The non-transitory computer-readable media of claim 15 further comprising in response to generating the authentication error, sending an error message to the client device.
18 . The non-transitory computer-readable media of claim 15 , wherein the determining the access token meets the first condition includes determining the access token is valid and not expired, and wherein the receiving, from the client device, the access token includes receiving, from the client device, a JSON (JavaScript Object Notation) Web Token (JWT).
19 . The non-transitory computer-readable media of claim 15 , wherein the determining whether the access token meets the first condition includes determining the access token does not meet the first condition.
20 . The non-transitory computer-readable media of claim 15 , wherein the determining the access token does not meet the first condition includes determining the access token is invalid or determining the access token is expired, generating the authentication error based on the determining the access token is invalid or determining the access token is expired, and sending the client device an error message in response to generating the authentication error.