active.clojure.openid — de.active-group/active-openid 0.2.1

absolute-redirect-uri clj

(absolute-redirect-uri openid-profile & [uri])

Returns the qualified redirect-uri of an openid-profile.

access-token-expires clj

(access-token-expires rec__3131__auto__)

(access-token-expires data__3132__auto__ v__3133__auto__)

Lens for the expires field from a [[AccessToken]] record. See active.clojure.openid/make-access-token.

access-token-extra-data clj

(access-token-extra-data rec__3131__auto__)

(access-token-extra-data data__3132__auto__ v__3133__auto__)

Lens for the extra-data field from a [[AccessToken]] record. See active.clojure.openid/make-access-token.

access-token-id-token clj

(access-token-id-token rec__3131__auto__)

(access-token-id-token data__3132__auto__ v__3133__auto__)

Lens for the id-token field from a [[AccessToken]] record. See active.clojure.openid/make-access-token.

access-token-lens clj

access-token-projection-lens clj

access-token-refresh-token clj

(access-token-refresh-token rec__3131__auto__)

(access-token-refresh-token data__3132__auto__ v__3133__auto__)

Lens for the refresh-token field from a [[AccessToken]] record. See active.clojure.openid/make-access-token.

access-token-token clj

(access-token-token rec__3131__auto__)

(access-token-token data__3132__auto__ v__3133__auto__)

Lens for the token field from a [[AccessToken]] record. See active.clojure.openid/make-access-token.

access-token-type clj

(access-token-type rec__3131__auto__)

(access-token-type data__3132__auto__ v__3133__auto__)

Lens for the type field from a [[AccessToken]] record. See active.clojure.openid/make-access-token.

access-token? clj

(access-token? thing)

Is object a AccessToken record? See active.clojure.openid/make-access-token.

authenticated clj

(authenticated user-info)

Construct a Authenticated record.

user-info: access via active.clojure.openid/authenticated-user-info

authenticated-request? clj

(authenticated-request? request)

authenticated-user-info clj

(authenticated-user-info rec__3131__auto__)

(authenticated-user-info data__3132__auto__ v__3133__auto__)

Lens for the user-info field from a [[Authenticated]] record. See active.clojure.openid/authenticated.

authenticated? clj

(authenticated? thing)

Is object a Authenticated record? See active.clojure.openid/authenticated.

authentication-started clj

(authentication-started state-profile-map original-uri)

Construct a AuthenticationStarted record.

state-profile-map: access via active.clojure.openid/authentication-started-state-profile-map original-uri: access via active.clojure.openid/authentication-started-original-uri

authentication-started-original-uri clj

(authentication-started-original-uri rec__3131__auto__)

(authentication-started-original-uri data__3132__auto__ v__3133__auto__)

Lens for the original-uri field from a [[AuthenticationStarted]] record. See active.clojure.openid/authentication-started.

authentication-started-request? clj

(authentication-started-request? request)

authentication-started-state-profile-map clj

(authentication-started-state-profile-map rec__3131__auto__)

(authentication-started-state-profile-map data__3132__auto__ v__3133__auto__)

Lens for the state-profile-map field from a [[AuthenticationStarted]] record. See active.clojure.openid/authentication-started.

authentication-started? clj

(authentication-started? thing)

Is object a AuthenticationStarted record? See active.clojure.openid/authentication-started.

authorize-uri clj

(authorize-uri openid-profile state & [redirect-uri])

available-login-name clj

(available-login-name rec__3131__auto__)

(available-login-name data__3132__auto__ v__3133__auto__)

Lens for the name field from a [[AvailableLogin]] record. See active.clojure.openid/make-available-login.

available-login-uri clj

(available-login-uri rec__3131__auto__)

(available-login-uri data__3132__auto__ v__3133__auto__)

Lens for the uri field from a [[AvailableLogin]] record. See active.clojure.openid/make-available-login.

available-login? clj

(available-login? thing)

Is object a AvailableLogin record? See active.clojure.openid/make-available-login.

coerce-to-int clj

(coerce-to-int n)

concat-uris clj

(concat-uris pref post)

decode-jwt clj

(decode-jwt encoded-jwt)

default-error-handler clj

(default-error-handler request error-string original-uri & [exception])

default-http-client-opts clj

default-login-handler clj

(default-login-handler _req availables unavailables)

default-logout-endpoint clj

default-logout-handler clj

(default-logout-handler _request)

fetch-access-token! clj

(fetch-access-token! openid-profile authorization-code & [redirect-uri])

For a openid-profile and based on a request (the response of the idp), fetch the actual (JWT) access token.

Might throw an exception.

fetch-user-info clj

(fetch-user-info openid-profile access-token logout-endpoint)

This decodes user-info from the JWT of the access-token. See configuration setting [[openid-config/openid-client-user-info-from]].

fetch-user-info! clj

(fetch-user-info! openid-profile access-token logout-endpoint)

This fetches user info with another request to user-info endpoint. See configuration setting [[openid-config/openid-client-user-info-from]].

format-access-token clj

(format-access-token
  {:keys [access-token token-type expires-in refresh-token id-token] :as body})

get-authorization-code clj

(get-authorization-code request)

get-openid-provider-config! clj

(get-openid-provider-config! provider-name
                             provider-config-uri
                             http-client-opts-map)

get-session-state clj

(get-session-state request)

join-scopes clj

(join-scopes openid-profile)

logins-availables clj

(logins-availables rec__3131__auto__)

(logins-availables data__3132__auto__ v__3133__auto__)

Lens for the availables field from a [[Logins]] record. See active.clojure.openid/make-logins.

logins-from-config! clj

(logins-from-config! config & [redirect-uri])

logins-state-profile-map clj

(logins-state-profile-map rec__3131__auto__)

(logins-state-profile-map data__3132__auto__ v__3133__auto__)

Lens for the state-profile-map field from a [[Logins]] record. See active.clojure.openid/make-logins.

logins-unavailables clj

(logins-unavailables rec__3131__auto__)

(logins-unavailables data__3132__auto__ v__3133__auto__)

Lens for the unavailables field from a [[Logins]] record. See active.clojure.openid/make-logins.

logins? clj

(logins? thing)

Is object a Logins record? See active.clojure.openid/make-logins.

logout-form-hiccup clj

(logout-form-hiccup text user-info)

Render a logout form from given user-info. You need to POST to the IDP's logout endpoint if the user's id-token is too large to be a parameter in a GET request due to too many claims in the token.

logout-href clj

(logout-href user-logout-info)

Render a logout link from given user-info. You can use this GET request to the IDP's logout endpoint if the user's id-token is small enough to be a parameter in a GET request when it does not include too many claims.

logout-link-hiccup clj

(logout-link-hiccup text user-info)

make-access-token clj

(make-access-token token type refresh-token id-token expires extra-data)

Construct a AccessToken record.

token: access via active.clojure.openid/access-token-token type: access via active.clojure.openid/access-token-type refresh-token: access via active.clojure.openid/access-token-refresh-token id-token: access via active.clojure.openid/access-token-id-token expires: access via active.clojure.openid/access-token-expires extra-data: access via active.clojure.openid/access-token-extra-data

make-available-login clj

(make-available-login uri name)

Construct a AvailableLogin record.

uri: access via active.clojure.openid/available-login-uri name: access via active.clojure.openid/available-login-name

make-logins clj

(make-logins state-profile-map availables unavailables)

Construct a Logins record.

state-profile-map: access via active.clojure.openid/logins-state-profile-map availables: access via active.clojure.openid/logins-availables unavailables: access via active.clojure.openid/logins-unavailables

make-no-access-token clj

(make-no-access-token error-message)

Construct a NoAccessToken record.

error-message: access via active.clojure.openid/no-access-token-error-message

make-no-user-info clj

(make-no-user-info error-message)

Construct a NoUserInfo record.

error-message: access via active.clojure.openid/no-user-info-error-message

make-openid-instance-not-available clj

(make-openid-instance-not-available name tried-endpoint error-msg)

Construct a OpenidInstanceNotAvailable record.

name: access via active.clojure.openid/openid-instance-not-available-name tried-endpoint: access via active.clojure.openid/openid-instance-not-available-tried-instance error-msg: access via active.clojure.openid/openid-instance-not-available-error-msg

make-openid-profile clj

(make-openid-profile name
                     provider-config
                     client-id
                     client-secret
                     scopes
                     base-uri
                     user-info-from
                     http-client-opts-map)

Construct a OpenidProfile (Wraps all necessary information for a openid identity provider profile.) record.

name: access via active.clojure.openid/openid-profile-name provider-config: access via active.clojure.openid/openid-profile-openid-provider-config client-id: access via active.clojure.openid/openid-profile-client-id client-secret: access via active.clojure.openid/openid-profile-client-secret scopes: access via active.clojure.openid/openid-profile-scopes base-uri: access via active.clojure.openid/openid-profile-base-uri user-info-from: access via active.clojure.openid/openid-profile-user-info-from http-client-opts-map: access via active.clojure.openid/openid-profile-http-client-opts-map

make-openid-profile! clj

(make-openid-profile! openid-config)

See make-openid-profiles!

make-openid-profiles! clj

(make-openid-profiles! config)

Takes a [[active.clojure.config/Configuration]] and extracts all configured [[OpenidProfile]]s from the config.

If any openid instance is not available, returns an [[%openid-instance-not-available]]] condition instead of an [[OpenidProfile]] for that instance..

make-openid-provider-config clj

(make-openid-provider-config authorize-endpoint
                             token-endpoint
                             userinfo-endpoint
                             end-session-endpoint
                             check-session-endpoint
                             supports-backchannel-logout?)

Construct a OpenidProviderConfig record.

authorize-endpoint: access via active.clojure.openid/openid-provider-config-authorize-endpoint token-endpoint: access via active.clojure.openid/openid-provider-config-token-endpoint userinfo-endpoint: access via active.clojure.openid/openid-provider-config-userinfo-endpoint end-session-endpoint: access via active.clojure.openid/openid-provider-config-end-session-endpoint check-session-endpoint: access via active.clojure.openid/openid-provider-config-check-session-endpoint supports-backchannel-logout?: access via active.clojure.openid/openid-provider-config-supports-backchannel-logout?

make-unavailable-login clj

(make-unavailable-login name error)

Construct a UnavailableLogin record.

name: access via active.clojure.openid/unavailable-login-name error: access via active.clojure.openid/unavailable-login-error

make-user-info clj

(make-user-info id
                name
                email
                groups
                claims
                openid-profile
                logout-info
                access-token)

Construct a UserInfo record.

id (The user ID the user is known to the IDP.): access via active.clojure.openid/user-info-id name (The display name of the user, at least firstname and lastname.): access via active.clojure.openid/user-info-name email (The email address of the user.): access via active.clojure.openid/user-info-email groups (The groups the user is a member of.): access via active.clojure.openid/user-info-groups claims (The rest of the claims obtained from the IDP.): access via active.clojure.openid/user-info-claims openid-profile (The configured profile of the IDP which that this data got obtained.): access via active.clojure.openid/user-info-openid-profile logout-info (The information needed to logout the user, see [[UserLogoutInfo]].): access via active.clojure.openid/user-info-logout-info access-token (The raw access token from the IDP.): access via active.clojure.openid/user-info-access-token

make-user-logout-info clj

(make-user-logout-info openid-profile id-token-hint logout-endpoint)

no-access-token-error-message clj

(no-access-token-error-message rec__3131__auto__)

(no-access-token-error-message data__3132__auto__ v__3133__auto__)

Lens for the error-message field from a [[NoAccessToken]] record. See active.clojure.openid/make-no-access-token.

no-access-token? clj

(no-access-token? thing)

Is object a NoAccessToken record? See active.clojure.openid/make-no-access-token.

no-user-info-error-message clj

(no-user-info-error-message rec__3131__auto__)

(no-user-info-error-message data__3132__auto__ v__3133__auto__)

Lens for the error-message field from a [[NoUserInfo]] record. See active.clojure.openid/make-no-user-info.

no-user-info? clj

(no-user-info? thing)

Is object a NoUserInfo record? See active.clojure.openid/make-no-user-info.

openid-instance-not-available-error-msg clj

(openid-instance-not-available-error-msg rec__3131__auto__)

(openid-instance-not-available-error-msg data__3132__auto__ v__3133__auto__)

Lens for the error-msg field from a [[OpenidInstanceNotAvailable]] record. See active.clojure.openid/make-openid-instance-not-available.

openid-instance-not-available-name clj

(openid-instance-not-available-name rec__3131__auto__)

(openid-instance-not-available-name data__3132__auto__ v__3133__auto__)

Lens for the name field from a [[OpenidInstanceNotAvailable]] record. See active.clojure.openid/make-openid-instance-not-available.

openid-instance-not-available-tried-instance clj

(openid-instance-not-available-tried-instance rec__3131__auto__)

(openid-instance-not-available-tried-instance data__3132__auto__
                                              v__3133__auto__)

Lens for the tried-endpoint field from a [[OpenidInstanceNotAvailable]] record. See active.clojure.openid/make-openid-instance-not-available.

openid-instance-not-available? clj

(openid-instance-not-available? thing)

Is object a OpenidInstanceNotAvailable record? See active.clojure.openid/make-openid-instance-not-available.

openid-profile-base-uri clj

(openid-profile-base-uri rec__3131__auto__)

(openid-profile-base-uri data__3132__auto__ v__3133__auto__)

Lens for the base-uri field from a [[OpenidProfile]] record. See active.clojure.openid/make-openid-profile.

openid-profile-client-id clj

(openid-profile-client-id rec__3131__auto__)

(openid-profile-client-id data__3132__auto__ v__3133__auto__)

Lens for the client-id field from a [[OpenidProfile]] record. See active.clojure.openid/make-openid-profile.

openid-profile-client-secret clj

(openid-profile-client-secret rec__3131__auto__)

(openid-profile-client-secret data__3132__auto__ v__3133__auto__)

Lens for the client-secret field from a [[OpenidProfile]] record. See active.clojure.openid/make-openid-profile.

openid-profile-http-client-opts-map clj

(openid-profile-http-client-opts-map rec__3131__auto__)

(openid-profile-http-client-opts-map data__3132__auto__ v__3133__auto__)

Lens for the http-client-opts-map field from a [[OpenidProfile]] record. See active.clojure.openid/make-openid-profile.

openid-profile-lens clj

openid-profile-name clj

(openid-profile-name rec__3131__auto__)

(openid-profile-name data__3132__auto__ v__3133__auto__)

Lens for the name field from a [[OpenidProfile]] record. See active.clojure.openid/make-openid-profile.

openid-profile-openid-provider-config clj

(openid-profile-openid-provider-config rec__3131__auto__)

(openid-profile-openid-provider-config data__3132__auto__ v__3133__auto__)

Lens for the provider-config field from a [[OpenidProfile]] record. See active.clojure.openid/make-openid-profile.

openid-profile-projection-lens clj

Wraps all necessary information for a openid identity provider profile.

openid-profile-scopes clj

(openid-profile-scopes rec__3131__auto__)

(openid-profile-scopes data__3132__auto__ v__3133__auto__)

Lens for the scopes field from a [[OpenidProfile]] record. See active.clojure.openid/make-openid-profile.

openid-profile-user-info-from clj

(openid-profile-user-info-from rec__3131__auto__)

(openid-profile-user-info-from data__3132__auto__ v__3133__auto__)

Lens for the user-info-from field from a [[OpenidProfile]] record. See active.clojure.openid/make-openid-profile.

openid-profile? clj

(openid-profile? thing)

Is object a OpenidProfile record? See active.clojure.openid/make-openid-profile.

openid-provider-config-authorize-endpoint clj

(openid-provider-config-authorize-endpoint rec__3131__auto__)

(openid-provider-config-authorize-endpoint data__3132__auto__ v__3133__auto__)

Lens for the authorize-endpoint field from a [[OpenidProviderConfig]] record. See active.clojure.openid/make-openid-provider-config.

openid-provider-config-check-session-endpoint clj

(openid-provider-config-check-session-endpoint rec__3131__auto__)

(openid-provider-config-check-session-endpoint data__3132__auto__
                                               v__3133__auto__)

Lens for the check-session-endpoint field from a [[OpenidProviderConfig]] record. See active.clojure.openid/make-openid-provider-config.

openid-provider-config-end-session-endpoint clj

(openid-provider-config-end-session-endpoint rec__3131__auto__)

(openid-provider-config-end-session-endpoint data__3132__auto__ v__3133__auto__)

Lens for the end-session-endpoint field from a [[OpenidProviderConfig]] record. See active.clojure.openid/make-openid-provider-config.

openid-provider-config-lens clj

openid-provider-config-projection-lens clj

openid-provider-config-supports-backchannel-logout? clj

(openid-provider-config-supports-backchannel-logout? rec__3131__auto__)

(openid-provider-config-supports-backchannel-logout? data__3132__auto__
                                                     v__3133__auto__)

Lens for the supports-backchannel-logout? field from a [[OpenidProviderConfig]] record. See active.clojure.openid/make-openid-provider-config.

openid-provider-config-token-endpoint clj

(openid-provider-config-token-endpoint rec__3131__auto__)

(openid-provider-config-token-endpoint data__3132__auto__ v__3133__auto__)

Lens for the token-endpoint field from a [[OpenidProviderConfig]] record. See active.clojure.openid/make-openid-provider-config.

openid-provider-config-userinfo-endpoint clj

(openid-provider-config-userinfo-endpoint rec__3131__auto__)

(openid-provider-config-userinfo-endpoint data__3132__auto__ v__3133__auto__)

Lens for the userinfo-endpoint field from a [[OpenidProviderConfig]] record. See active.clojure.openid/make-openid-provider-config.

openid-provider-config? clj

(openid-provider-config? thing)

Is object a OpenidProviderConfig record? See active.clojure.openid/make-openid-provider-config.

parse-params clj

(parse-params request)

random-state clj

(random-state)

really-make-user-logout-info clj

(really-make-user-logout-info uri params-map)

Construct a UserLogoutInfo (All the informationen needed to render either a logout link or a logout form.) record.

uri: access via active.clojure.openid/user-logout-info-uri params-map: access via active.clojure.openid/user-logout-info-params-map

render-available-login clj

(render-available-login available-login)

render-unavailable-login clj

(render-unavailable-login unavailable-login)

state clj

unauthenticated clj

(unauthenticated)

Construct a Unauthenticated record.

unauthenticated-request? clj

(unauthenticated-request? request)

unauthenticated? clj

(unauthenticated? thing)

Is object a Unauthenticated record? See active.clojure.openid/unauthenticated.

unavailable-login-error clj

(unavailable-login-error rec__3131__auto__)

(unavailable-login-error data__3132__auto__ v__3133__auto__)

Lens for the error field from a [[UnavailableLogin]] record. See active.clojure.openid/make-unavailable-login.

unavailable-login-name clj

(unavailable-login-name rec__3131__auto__)

(unavailable-login-name data__3132__auto__ v__3133__auto__)

Lens for the name field from a [[UnavailableLogin]] record. See active.clojure.openid/make-unavailable-login.

unavailable-login? clj

(unavailable-login? thing)

Is object a UnavailableLogin record? See active.clojure.openid/make-unavailable-login.

user-info-access-token clj

(user-info-access-token rec__3131__auto__)

(user-info-access-token data__3132__auto__ v__3133__auto__)

Lens for the access-token field (The raw access token from the IDP.) from a [[UserInfo]] record. See active.clojure.openid/make-user-info.

user-info-claims clj

(user-info-claims rec__3131__auto__)

(user-info-claims data__3132__auto__ v__3133__auto__)

Lens for the claims field (The rest of the claims obtained from the IDP.) from a [[UserInfo]] record. See active.clojure.openid/make-user-info.

user-info-email clj

(user-info-email rec__3131__auto__)

(user-info-email data__3132__auto__ v__3133__auto__)

Lens for the email field (The email address of the user.) from a [[UserInfo]] record. See active.clojure.openid/make-user-info.

user-info-from-request clj

(user-info-from-request request)

Retrieve [[UserInfo]] for logged in user from request. Use this function in your handler to obtain information about your user.

user-info-groups clj

(user-info-groups rec__3131__auto__)

(user-info-groups data__3132__auto__ v__3133__auto__)

Lens for the groups field (The groups the user is a member of.) from a [[UserInfo]] record. See active.clojure.openid/make-user-info.

user-info-id clj

(user-info-id rec__3131__auto__)

(user-info-id data__3132__auto__ v__3133__auto__)

Lens for the id field (The user ID the user is known to the IDP.) from a [[UserInfo]] record. See active.clojure.openid/make-user-info.

user-info-lens clj

user-info-logout-info clj

(user-info-logout-info rec__3131__auto__)

(user-info-logout-info data__3132__auto__ v__3133__auto__)

Lens for the logout-info field (The information needed to logout the user, see [[UserLogoutInfo]].) from a [[UserInfo]] record. See active.clojure.openid/make-user-info.

user-info-name clj

(user-info-name rec__3131__auto__)

(user-info-name data__3132__auto__ v__3133__auto__)

Lens for the name field (The display name of the user, at least firstname and lastname.) from a [[UserInfo]] record. See active.clojure.openid/make-user-info.

user-info-openid-profile clj

(user-info-openid-profile rec__3131__auto__)

(user-info-openid-profile data__3132__auto__ v__3133__auto__)

Lens for the openid-profile field (The configured profile of the IDP which that this data got obtained.) from a [[UserInfo]] record. See active.clojure.openid/make-user-info.

user-info-projection-lens clj

user-info? clj

(user-info? thing)

Is object a UserInfo record? See active.clojure.openid/make-user-info.

user-logout-info-lens clj

user-logout-info-params-map clj

(user-logout-info-params-map rec__3131__auto__)

(user-logout-info-params-map data__3132__auto__ v__3133__auto__)

Lens for the params-map field from a [[UserLogoutInfo]] record. See active.clojure.openid/really-make-user-logout-info.

user-logout-info-projection-lens clj

All the informationen needed to render either a logout link or a logout form.

user-logout-info-uri clj

(user-logout-info-uri rec__3131__auto__)

(user-logout-info-uri data__3132__auto__ v__3133__auto__)

Lens for the uri field from a [[UserLogoutInfo]] record. See active.clojure.openid/really-make-user-logout-info.

user-logout-info? clj

(user-logout-info? thing)

Is object a UserLogoutInfo record? See active.clojure.openid/really-make-user-logout-info.

wrap-openid-authentication clj

(wrap-openid-authentication config & {:keys [session-store] :as args})

Convenience middleware stack for OpenID authentication that combines all other middlewares that its implementation depends on.

Currently, this is [[ring-session/wrap-session]]. To avoid having more than one instance of the session-store, you have three options:

• Use optional argument :session-store to pass in your global session store.

• Bind one instance of this middleware to a variable and use the variable if you need this middleware in different places.

• Put your own [[ring-session/wrap-session]] in your middleware stack and use wrap-openid-authentication* instead of this middleware.

See wrap-openid-authentication* for OpenID-specific documentation and options.

wrap-openid-authentication* clj

(wrap-openid-authentication* config
                             &
                             {:keys [login-handler logout-endpoint
                                     error-handler]
                              :or {login-handler default-login-handler
                                   logout-endpoint default-logout-endpoint
                                   error-handler default-error-handler}})

Middleware that shortcuts execution of the handler and redirects the user to the login page.

It also takes care of the openid authentication process states unauthenticated, authentication started, authenticated.

The state authentication started is the most complicated one: There, the middleware tries to obtain tokens and user data from the IDP and needs to validate the data.

• :login-handler: Handler that the middleware calls if currently unauthenticated. The login handler should display links to IDPs to start the authentication process. The login handler gets called with three arguments:

  • request: The current request
  • availables: List of [[Available]] IDPs
  • unavailables: List of [[Unavailable]] IDPs If not :login-handler is given, it defaults to default-login-handler.

• :logout-endpoint: The endpoint for the IDP to redirect to after user-initated logout. This is needed to remove the auth information from the session. Defaults to default-logout-endpoint. This must match the route that wrap-openid-logout uses.

• :error-handler: Handler thet the middleware calls in case of some unexpected error. The error handler gets called with these arguments:

  • request: The current request
  • error-string: A string that describes the error
  • original-uri: The URI of the original request, useful to try request again
  • and optionally an exception Defaults to default-error-handler.

wrap-openid-logout clj

(wrap-openid-logout &
                    {:keys [logout-handler]
                     :or {logout-handler default-logout-handler}})

Wrapper that removes authentication information from the current session. Use together with wrap-openid-authentication. Must be the handler of the route that wrap-openid-authentication uses as its logout-endpoint.

• :logout-handler: The handler that this wrapper calls. It gets called with request. Defaults to default-logout-handler which redirects to /.

wrap-openid-session clj

(wrap-openid-session & [session-store])

Our implementation uses sessions, so we need [[ring-session/wrap-session]] middleware. This is a convenience wrapper around [[ring-session/wrap-session]] that sets some useful defaults and optionally accepts and uses a given session-store.