春季安全会议注册表空

我有一个弹簧mvc webapp使用弹簧安全和我想做的每一次用户登录的一件事是登录系统上的并发用户数。春季安全会议注册表空

要做到这一点，我已经给我的会议注册一个别名，然后我自动装配成一个类，并说...

List<Object> principals = sessionRegistry.getAllPrincipals(); 
MDC.put(MDCKeyConstants.CONCURRENT_USER_COUNT, principals.size());

但principals.size即将0。即主体清单是空的。我是否缺少需要配置的其他内容？

对不起，长职位，但我把我的春季安全配置在这里，试图得到一些帮助，这个问题..谢谢了... ...

<http use-expressions="true" auto-config="false" entry-point-ref="loginUrlAuthenticationEntryPoint">  
    <!-- custom filters --> 
    <custom-filter position="FORM_LOGIN_FILTER" ref="twoFactorAuthenticationFilter" />  
    <custom-filter after="SECURITY_CONTEXT_FILTER" ref="securityLoggingFilter"/> 

    <!-- session management -->  
    <session-management 
     invalid-session-url="/sessionExpired.htm" 
     session-authentication-error-url="/alreadyLoggedIn.htm"> 

     <concurrency-control 
      max-sessions="1" 
      expired-url="/sessionExpiredDuplicateLogin.htm" 
      error-if-maximum-exceeded="false" 
      session-registry-alias="sessionRegistry"/> 

    </session-management> 

    <!-- error handlers --> 
    <access-denied-handler error-page="/accessDenied.htm"/>    

    <!-- logout --> 
    <logout logout-success-url="/logout.htm" invalidate-session="false" delete-cookies="JSESSIONID"/> 

    <!-- authorize pages -->  
    <intercept-url pattern="/home.htm" access="isAuthenticated()" /> 
    <intercept-url pattern="/shortsAndOvers.htm" access="isAuthenticated()" /> 
    <intercept-url pattern="/shortsAndOversDaily.htm" access="isAuthenticated()" /> 
    <intercept-url pattern="/birtpage.htm" access="isAuthenticated()" /> 
    <intercept-url pattern="/reports/show.htm" access="isAuthenticated()" />  

</http> 

<!-- =============================== --> 
<!--  AUTHENTICATION BEANS  --> 
<!-- =============================== --> 

<beans:bean id="authenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"> 
    <beans:property name="userDetailsService" ref="userDetailsDao" /> 
    <beans:property name="passwordEncoder" ref="encoder" /> 
</beans:bean> 

<beans:bean id="twoFactorAuthenticationFilter" class="com.mycompany.reporting.security.TwoFactorAuthenticationFilter"> 
    <beans:property name="authenticationManager" ref="authenticationManager" /> 
    <beans:property name="authenticationFailureHandler" ref="failureHandler" /> 
    <beans:property name="authenticationSuccessHandler" ref="successHandler" />   
    <beans:property name="filterProcessesUrl" value="/j_spring_security_check" /> 
    <beans:property name="postOnly" value="true" /> 
</beans:bean> 

<beans:bean id="loginUrlAuthenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"> 
    <beans:property name="loginFormUrl" value="/login.htm" /> 
</beans:bean> 

<beans:bean id="successHandler" class="com.mycompany.reporting.security.CustomSavedRequestAwareAuthenticationSuccessHandler"> 
    <beans:property name="defaultTargetUrl" value="/home.htm" /> 
</beans:bean> 

<beans:bean id="failureHandler" class="com.mycompany.reporting.security.CustomSimpleUrlAuthenticationFailureHandler"> 
    <beans:property name="defaultFailureUrl" value="/loginfailed.htm" /> 
</beans:bean>       

<authentication-manager alias="authenticationManager"> 
    <authentication-provider ref="authenticationProvider"></authentication-provider> 
</authentication-manager>

来源

2014-01-29 Richie

你有没有提到springsecurity的HttpSessionEventPublisher监听器在你的web.xml –

是的，我有。 org.springframework.security.web.session.HttpSessionEventPublisher – Richie

在spring-security.xml中尝试提及 –

试试这个。它为我工作。

在<http></http>，

<session-management session-authentication-strategy-ref="sas" invalid-session-url="/invalid-session" />

并声明如下豆：

<beans:bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl"/>

<beans:bean id="sas" class="org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy"> <beans:constructor-arg name="sessionRegistry" ref="sessionRegistry" /> <beans:property name="maximumSessions" value="1" /> </beans:bean>

而且不要忘了添加org.springframework.security.web。 session.HttpSessionEventPublisher侦听器到您的网站配置。

来源

2015-02-27 20:05:55

感谢哈迪克。实际上，我前一段时间已经找到了这个答案，但是我可以确认您指定的是我解决此问题的确切方式。 – Richie

类名可能已经更改为org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy – Stephane

它不适合我！ – M2E67

春季安全会议注册表空

回答

相关问题