I am doing a basic spring security setup. i have configured spring-security.xml as below,
<http auto-config='false' entry-point-ref="authenticationEntryPoint">
<custom-filter position="FORM_LOGIN_FILTER" ref="authenticationFilter" />
<logout delete-cookies="JSESSIONID" logout-success-url="/" />
<!-- <session-management > <concurrency-control max-sessions="1" error-if-maximum-exceeded="true"
expired-url="/"/> </session-management> -->
<session-management session-authentication-strategy-ref="sas"/>
</http>
<beans:bean id="authenticationFilter" class="com.diners.security.AuthenticationFilter">
<beans:property name="authenticationManager" ref="authenticationManager" />
</beans:bean>
<beans:bean id="authenticationEntryPoint"
class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
<beans:property name="loginFormUrl" value="/index.jsp" />
</beans:bean>
<beans:bean id="concurrencyFilter"
class="org.springframework.security.web.session.ConcurrentSessionFilter">
<beans:property name="sessionRegistry" ref="sessionRegistry" />
<beans:property name="expiredUrl" value="/" />
</beans:bean>
<beans:bean id="sas"
class="org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy">
<beans:constructor-arg name="sessionRegistry"
ref="sessionRegistry" />
<beans:property name="maximumSessions" value="1" />
</beans:bean>
<beans:bean id="sessionRegistry"
class="org.springframework.security.core.session.SessionRegistryImpl" />
<authentication-manager alias="authenticationManager">
<authentication-provider>
<password-encoder ref="encoder" />
<user-service>
<user name="kalai"
password="$2a$10$EblZqNptyYvcLm/VwDCVAuBjzZOI7khzdyGPBr08PpIi0na624b8."
authorities="ROLE_ADMIN" />
<user name="magesh"
password="$2a$10$EblZqNptyYvcLm/VwDCVAuBjzZOI7khzdyGPBr08PpIi0na624b8."
authorities="ROLE_USER" />
</user-service>
</authentication-provider>
</authentication-manager>
<beans:bean id="encoder"
class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder">
<beans:constructor-arg name="strength" value="11" />
</beans:bean>
I am using a custom form login filter. i want concurrency control for login. so that the user can have only one session at a moment. he cannot login in some other browser and so till his current session expires / manual logout.
Some states that adding the below listener will resolve the issue. so i added the below in web.xml
<listener>
<listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
</listener>
But it didn't helped me either. The i found in some posts that form login filter will not support concurrentsessioncontrol.Do i need to implement any stuff. can anyone suggest on this or can you provide alternatives for the same. i have a custom filter for providing json response on successful and unsuccessful authentication.
Any helping hands will be much appreciated.
Aucun commentaire:
Enregistrer un commentaire