session - How to get all application's online users in Spring Security 3.0.5? -
when make implementation
org.springframework.security.core.userdetails.userdetailsservice
and use statement
sessionregistry.registernewsession(user.getusername(), user);
within after successful authentication,
sessionregistry.getallprincipals();
list not empty (but when log out application session still remain within list) otherwise list empty. how can make session registration (and unregistration during user log out or session expiration) within sessionregistry automatically? spring config below:
<sec:http auto-config="true" use-expressions="true" access-denied-page="/accessdenied.jsf"> <sec:form-login login-page="/login.jsf" /> <sec:session-management session-authentication-strategy-ref="sas" /> </sec:http> <bean id="sessionregistry" class="org.springframework.security.core.session.sessionregistryimpl" /> <bean id="scr" class="org.springframework.security.web.context.httpsessionsecuritycontextrepository" /> <bean id="smf" class="org.springframework.security.web.session.sessionmanagementfilter"> <constructor-arg name="securitycontextrepository" ref="scr" /> <property name="sessionauthenticationstrategy" ref="sas" /> </bean> <bean id="sas" class="org.springframework.security.web.authentication.session.concurrentsessioncontrolstrategy"> <constructor-arg name="sessionregistry" ref="sessionregistry" /> <property name="maximumsessions" value="10" /> </bean>
most have forgotten add httpsessioneventpublisher web.xml.
another possibility principal in question has other sessions still active haven't timed-out or been invalidated. have maximum session value of 10. try setting "1" instead testing.
also, version 3.0.5 out of date. should use latest version , keep date patches avoid vulnerabilities.
Comments
Post a Comment