How do I get the Spring Security SessionRegistry?

Question

I can't seem to find how to get a reference to the Spring Security (V3) SessionRegistry inside of a Struts action.

I've configured the listener inside of my web.xml file:

<listener>
    <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
</listener>

And I've tried to use the @Autowired annotation to bring it into an action:

@Autowired
private SessionRegistry sessionRegistry;

@Override
public String execute() throws Exception {
    numberOfUsersLoggedin= sessionRegistry.getAllPrincipals().size();
    return SUCCESS;       
}

public SessionRegistry getSessionRegistry() {
    return sessionRegistry;
}

public void setSessionRegistry(SessionRegistry sessionRegistry) {
    this.sessionRegistry = sessionRegistry;
}

The http configuration looks like this:

    <session-management invalid-session-url="/public/login.do?login_error=expired"
        session-authentication-error-url="/public/login.do" 
        session-fixation-protection="newSession">
        <concurrency-control max-sessions="1" error-if-maximum-exceeded="true"/>
    </session-management>    

Generally I am more comfortable wiring the Spring bean myself, but not sure how this is exposed using the namespace. Each time the action executes, the session registry is null.

Can anyone point out what I am doing wrong here, or show me the way to an example?

Thanks in advance for any/all replies!

Solution 1

Not sure if you have referred to Session Management section in Spring Security reference documentation. It has a snippet combining namespace and custom beans.

Solution 2

If you are configuring Spring Security by namespace, the following attributes of concurrency-control tag can be useful for accessing SystemRegistry:

1. session-registry-alias.
2. session-registry-ref.

Description of each of attributes from official documentation:

session-registry-alias. It can also be useful to have a reference to the internal session registry for use in your own beans or an admin interface. You can expose the internal bean using the session-registry-alias attribute, giving it a name that you can use elsewhere in your configuration.

session-registry-ref. The user can supply their own SessionRegistry implementation using the session-registry-ref attribute. The other concurrent session control beans will be wired up to use it.

Comments

[Griff]

thanks for the link. I added the sessionRegistry bean to my Spring configuration, and it's no longer null in the Struts action. However, when I try to get the # of logged in users (while logged in) the value of sessionRegistry.getAllPrincipals().size(); is always 0. Am I reading the docs right? It seems like if I am using a custom login form (which I am -- authenticating against LDAP) I cannot use the namespace/auto config session management I have specified above. It seems like I have to manually configure all the session-management and concurrency-control manually?

[Griff]

Looking at the on-line docs, I can't seem to figure out what the name of my authentication provider is for the myAuthFilter. I am using the namespace <authentication-manager> which doesn't provide a bean id... <authentication-manager> <authentication-provider ref='ldapProvider' /> </authentication-manager>

[ardatosun]

Kind of necro'ing the topic but getAllPrincipals().size()always return zero for me. How did you manage to get it working? Did you have your own implementation class of SessionRegistry?