spring security3教程系列--如何踢出用户

spring security3教程系列--如何踢出用户

 本文章摘编、转载需要注明来源 http://write.blog.csdn.net/postedit/8572467

对于spring security我个人是比较喜欢的一个安全框架,我们的系统中一般需要提供强制将用户踢出的功能,这个功能security也有提供,

首先我们要操作需要获取sessionRegistry中认证用户的所有SessionInformation,然后逐个调用SessionInformation里的expireNow()方法,然后ConcurrentSessionFilter

就会执行用户登录注销的功能;对于这个sessionRegistry.removeSessionInformation(sessionInformation
                    .getSessionId());我不知道是不是我的用法不对,调用了也不会强制注销用户的session,因为官方源代码中说调用removeSessionInformation的时候会让session的监听器响应到,但是我是没成功(望使用这个方式成功的朋友留言告诉下我);下面我们就看为什么调用SessionInformation里的expireNow()方法就能注销用户

 /**
      * 把当前用户踢出系统
      */
     public void shotOff() {
         List<SessionInformation> sessionInformations = sessionRegistry
                 .getAllSessions(SpringSecurityManager.getAuthentication()
                         .getPrincipal(), false);
         for (SessionInformation sessionInformation : sessionInformations) {
             sessionInformation.expireNow();

             // sessionRegistry.removeSessionInformation(sessionInformation
                     .getSessionId());

         }
     }

我们来看下SessionInformation的源码

 private Date lastRequest;
    private final Object principal;
    private final String sessionId;
    private boolean expired = false;

    //~ Constructors ===================================================================================================

    public SessionInformation(Object principal, String sessionId, Date lastRequest) {
        Assert.notNull(principal, "Principal required");
        Assert.hasText(sessionId, "SessionId required");
        Assert.notNull(lastRequest, "LastRequest required");
        this.principal = principal;
        this.sessionId = sessionId;
        this.lastRequest = lastRequest;
    }

    //~ Methods ========================================================================================================

    public void expireNow() {
        this.expired = true;
    }

    public Date getLastRequest() {
        return lastRequest;
    }

    public Object getPrincipal() {
        return principal;
    }

    public String getSessionId() {
        return sessionId;
    }

    public boolean isExpired() {
        return expired;
    }

    /**
     * Refreshes the internal lastRequest to the current date and time.
     */
    public void refreshLastRequest() {
        this.lastRequest = new Date();
    }

看到的是调用expireNow方法时候会将属性expired设置为true;

然后我们来看下需要处理的ConcurrentSessionFilter过滤器的源码

 private SessionRegistry sessionRegistry;
 private String expiredUrl;
 private LogoutHandler[] handlers = new LogoutHandler[] {new SecurityContextLogoutHandler()};
 private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

 //~ Methods ========================================================================================================


 /**
  * @deprecated Use constructor which injects the <tt>SessionRegistry</tt>.
  */
 public ConcurrentSessionFilter() {
 }

 public ConcurrentSessionFilter(SessionRegistry sessionRegistry) {
     this(sessionRegistry, null);
 }

 public ConcurrentSessionFilter(SessionRegistry sessionRegistry, String expiredUrl) {
     this.sessionRegistry = sessionRegistry;
     this.expiredUrl = expiredUrl;
 }

 @Override
 public void afterPropertiesSet() {
     Assert.notNull(sessionRegistry, "SessionRegistry required");
     Assert.isTrue(expiredUrl == null || UrlUtils.isValidRedirectUrl(expiredUrl),
             expiredUrl + " isn't a valid redirect URL");
 }

 public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
         throws IOException, ServletException {
     HttpServletRequest request = (HttpServletRequest) req;
     HttpServletResponse response = (HttpServletResponse) res;

     HttpSession session = request.getSession(false);

     if (session != null) {
         SessionInformation info = sessionRegistry.getSessionInformation(session.getId());

         if (info != null) {
             if (info.isExpired()) {
                 // Expired - abort processing
                 doLogout(request, response);

                 String targetUrl = determineExpiredUrl(request, info);

                 if (targetUrl != null) {
                     redirectStrategy.sendRedirect(request, response, targetUrl);

                     return;
                 } else {
                     response.getWriter().print("This session has been expired (possibly due to multiple concurrent " +
                             "logins being attempted as the same user).");
                     response.flushBuffer();
                 }

                 return;
             } else {
                 // Non-expired - update last request date/time
                 sessionRegistry.refreshLastRequest(info.getSessionId());
             }
         }
     }

     chain.doFilter(request, response);
 }

 protected String determineExpiredUrl(HttpServletRequest request, SessionInformation info) {
     return expiredUrl;
 }

 private void doLogout(HttpServletRequest request, HttpServletResponse response) {
     Authentication auth = SecurityContextHolder.getContext().getAuthentication();

     for (LogoutHandler handler : handlers) {
         handler.logout(request, response, auth);
     }
 }

 /**
  * @deprecated use constructor injection instead
  */
 @Deprecated
 public void setExpiredUrl(String expiredUrl) {
     this.expiredUrl = expiredUrl;
 }

 /**
  * @deprecated use constructor injection instead
  */
 @Deprecated
 public void setSessionRegistry(SessionRegistry sessionRegistry) {
     this.sessionRegistry = sessionRegistry;
 }

 public void setLogoutHandlers(LogoutHandler[] handlers) {
     Assert.notNull(handlers);
     this.handlers = handlers;
 }

 public void setRedirectStrategy(RedirectStrategy redirectStrategy) {
     this.redirectStrategy = redirectStrategy;
 }

很明显代码中有遇到if (info.isExpired())逻辑判断,这个时候如果表达式的值为true就会执行里面的doLogout方法,而这个方法里面就会调用我们配置的注销监听器,当前用户在之前认证成功后的状态也会失效了

然后看下xml里怎么配置

 <!-- SESSION管理 -->
     <bean id="sessionRegistry"
         class="org.springframework.security.core.session.SessionRegistryImpl" />

     <bean id="concurrentSessionFilter"
         class="org.springframework.security.web.session.ConcurrentSessionFilter">
         <property name="sessionRegistry" ref="sessionRegistry" />
         <property name="expiredUrl" value="/apply/skip/restimeout.html" />
         <property name="logoutHandlers">
             <list>
                 <ref local="logoutHandler" />
             </list>
         </property>
     </bean>

     <!-- 注销监听器  -->
     <bean id="logoutHandler"
         class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler">
         <property name="InvalidateHttpSession" value="true" />
     </bean>