Question

我有一个使用spring安全性的spring mvc webapp，每次用户登录时我想做的一件事就是记录系统上的并发用户数。

为了做到这一点，我给会话注册表添了一个别名，然后我自动加入一个类并说...

List<Object> principals = sessionRegistry.getAllPrincipals();
MDC.put(MDCKeyConstants.CONCURRENT_USER_COUNT, principals.size());

但是principals.size将会变为0。即校长名单为空。我错过了我需要配置的其他内容吗？

很抱歉很长的帖子，但是我把我的spring安全配置放在这里试着帮助解决这个问题..提前感谢...

<http use-expressions="true" auto-config="false" entry-point-ref="loginUrlAuthenticationEntryPoint">    
    <!-- custom filters -->
    <custom-filter position="FORM_LOGIN_FILTER" ref="twoFactorAuthenticationFilter" />      
    <custom-filter after="SECURITY_CONTEXT_FILTER" ref="securityLoggingFilter"/>

    <!-- session management -->     
    <session-management 
        invalid-session-url="/sessionExpired.htm" 
        session-authentication-error-url="/alreadyLoggedIn.htm">

        <concurrency-control 
            max-sessions="1" 
            expired-url="/sessionExpiredDuplicateLogin.htm" 
            error-if-maximum-exceeded="false" 
            session-registry-alias="sessionRegistry"/>

    </session-management>   

    <!-- error handlers -->
    <access-denied-handler error-page="/accessDenied.htm"/>             

    <!-- logout --> 
    <logout logout-success-url="/logout.htm" invalidate-session="false" delete-cookies="JSESSIONID"/>   

    <!-- authorize pages -->    
    <intercept-url pattern="/home.htm" access="isAuthenticated()" />
    <intercept-url pattern="/shortsAndOvers.htm" access="isAuthenticated()" />
    <intercept-url pattern="/shortsAndOversDaily.htm" access="isAuthenticated()" />
    <intercept-url pattern="/birtpage.htm" access="isAuthenticated()" />
    <intercept-url pattern="/reports/show.htm" access="isAuthenticated()" />    

</http> 

<!-- =============================== -->
<!--      AUTHENTICATION BEANS       -->
<!-- =============================== -->

<beans:bean id="authenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
  <beans:property name="userDetailsService" ref="userDetailsDao" />
  <beans:property name="passwordEncoder" ref="encoder" />
</beans:bean>

<beans:bean id="twoFactorAuthenticationFilter" class="com.mycompany.reporting.security.TwoFactorAuthenticationFilter">
    <beans:property name="authenticationManager" ref="authenticationManager" />
    <beans:property name="authenticationFailureHandler" ref="failureHandler" />
    <beans:property name="authenticationSuccessHandler" ref="successHandler" />        
    <beans:property name="filterProcessesUrl" value="/j_spring_security_check" />
    <beans:property name="postOnly" value="true" />
</beans:bean>

<beans:bean id="loginUrlAuthenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
    <beans:property name="loginFormUrl" value="/login.htm" />
</beans:bean>

<beans:bean id="successHandler" class="com.mycompany.reporting.security.CustomSavedRequestAwareAuthenticationSuccessHandler">
    <beans:property name="defaultTargetUrl" value="/home.htm" />
</beans:bean>

<beans:bean id="failureHandler" class="com.mycompany.reporting.security.CustomSimpleUrlAuthenticationFailureHandler">
    <beans:property name="defaultFailureUrl" value="/loginfailed.htm" />
</beans:bean>                          

<authentication-manager alias="authenticationManager">
    <authentication-provider ref="authenticationProvider"></authentication-provider>
</authentication-manager>

Answer 1

试试这个。它对我有用。

<{1>}中的

，

<http></http>

并声明bean如下：

<session-management session-authentication-strategy-ref="sas" invalid-session-url="/invalid-session" />

<beans:bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl"/>

不要忘记将org.springframework.security.web.session.HttpSessionEventPublisher侦听器添加到您的Web配置中。

spring安全会话注册表为空

1 个答案: