我有以下问题:我有默认的用户和角色域,我使用spring安全插件。有一个特殊要求,即如果管理员删除具有USER_ROLE的用户,并且此用户此时已经过身份验证,那么此用户应立即退出应用程序。如果我们有这个用户的对象实例,是否可以以编程方式为用户注销? Somethig喜欢
def(User user) {
someSpringService.forceLogout(user)
}
谢谢!
答案 0 :(得分:1)
我是grails的新手。最近我有权强制用户通过管理员更改他的权限。 所以,经过一些研究,这是我的解决方案。我正在跟踪用户会话,一旦他的会话被更改,我就会使他的活动会话到期。
在web.xml文件中,添加此侦听器
<listener>
<listener-class>
org.springframework.security.web.session.HttpSessionEventPublisher
</listener-class>
</listener>
在resources.groovy
import org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy
import org.springframework.security.web.session.ConcurrentSessionFilter
import org.springframework.security.core.session.SessionRegistryImpl
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy
beans = {
// bind session registry
sessionRegistry(SessionRegistryImpl)
sessionAuthenticationStrategy(ConcurrentSessionControlStrategy,sessionRegistry){
maximumSessions = -1 }
concurrentSessionFilter(ConcurrentSessionFilter){
sessionRegistry = sessionRegistry
expiredUrl = '/login/auth?f=true'
}
}
在控制器中
def expireSession(User user) {
log.info("Process to expire session begins")
def orginalUser = springSecurityService?.principal.username
log.info("session infos for all principals: ${sessionRegistry.getAllPrincipals()}")
sessionRegistry.getAllPrincipals()?.each { princ ->
def allSessions = sessionRegistry.getAllSessions(princ, true);
log.info("all sessions: ${allSessions}")
log.info("principal: $princ; email: ${user?.email}; username: ${princ?.username}")
if(princ?.username?.equals(user?.email)) { //killing sessions only for user (test@app.com)
sessionRegistry.getAllSessions(princ, true)?.each { sess ->
log.info("session: ${sess}; expiring it")
if(sess.expireNow())
log.info("----session expired----")
springSecurityService?.reauthenticate(user?.email)
springSecurityService?.reauthenticate(orginalUser)
}
}
}
}
在RequestFilters.groovy中,我们会在每个请求中测试会话是有效还是已过期
class RequestFilters {
def springSecurityService
def sessionRegistry
def filters = {
all(controller:'*', action:'*') {
before = {
log.info(controllerName + '/' + actionName + " : " + params)
log.info("request ${request}; session: ${request?.session}")
def sessInfo = sessionRegistry.getSessionInformation(request?.session?.id)
log.info("sessionRegistry: ${sessionRegistry}")
log.info("Session Id: ${request?.session?.id}")
log.info("session info: ${sessInfo}; is expired: ${sessInfo?.expired}")
if(sessInfo?.expired==true)
response.sendRedirect(grailsApplication.config.grails.serverURL+"/j_spring_security_logout");
}
after = { Map model ->
}
afterView = { Exception e ->
}
}
}