如何通过登录注销用户（不是当前）？

Question

我在我的系统中两个角色：用户和管理

管理员可以通过名字登出任何用户。

我该怎么做？ 我需要的是这样的：

service.logoutUser(anotherUserName)

的配置是这样的：

@Configuration 
@EnableWebSecurity 
public class WebSecurityConfig extends WebSecurityConfigurerAdapter { 
    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http 
      .authorizeRequests() 
       .antMatchers 
       .... 
       .formLogin() 
       .loginProcessingUrl("/api/login") 
       .successHandler(authenticationSuccessHandler) 
       .failureHandler(new SimpleUrlAuthenticationFailureHandler()) 
       .and() 
      .rememberMe() 
       .key("...") 
       .rememberMeCookieName("...") 
       .userDetailsService(userDetailsService) 
       .and() 
      .csrf() 
       .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()) 
       .and() 
      .logout() 
       .deleteCookies("JSESSIONID") 
       .logoutUrl("/logout") 
       .logoutSuccessHandler(new HttpStatusReturningLogoutSuccessHandler()) 
       .permitAll(); 

Answer 1

事情是这样的：

import org.springframework.security.core.userdetails.User; 
... 
... 
Set<SimpleGrantedAuthority> userRoles = new HashSet<>(); 
userRoles.add(new SimpleGrantedAuthority("ROLE_USER")); 
User user = new User(anotherUserName, "", userRoles); 
List<SessionInformation> sessions = sessionRegistry.getAllSessions(u, false); 

for(SessionInformation info : infos) { 
    info.expireNow(); 
}