vendredi 22 mai 2015

does spring FORM_LOGIN_FILTER supports ConcurrentSessionControl?

I am doing a basic spring security setup. i have configured spring-security.xml as below,

<http auto-config='false' entry-point-ref="authenticationEntryPoint">
        <custom-filter position="FORM_LOGIN_FILTER" ref="authenticationFilter" />
        <logout delete-cookies="JSESSIONID" logout-success-url="/" />
        <!-- <session-management > <concurrency-control max-sessions="1" error-if-maximum-exceeded="true" 
            expired-url="/"/> </session-management> -->
            <session-management session-authentication-strategy-ref="sas"/>
    </http>

    <beans:bean id="authenticationFilter" class="com.diners.security.AuthenticationFilter">
        <beans:property name="authenticationManager" ref="authenticationManager" />
    </beans:bean>

    <beans:bean id="authenticationEntryPoint"
        class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
        <beans:property name="loginFormUrl" value="/index.jsp" />
    </beans:bean>

    <beans:bean id="concurrencyFilter"
        class="org.springframework.security.web.session.ConcurrentSessionFilter">
        <beans:property name="sessionRegistry" ref="sessionRegistry" />
        <beans:property name="expiredUrl" value="/" />
    </beans:bean>
    <beans:bean id="sas"
        class="org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy">
        <beans:constructor-arg name="sessionRegistry"
            ref="sessionRegistry" />
        <beans:property name="maximumSessions" value="1" />
    </beans:bean>

    <beans:bean id="sessionRegistry"
        class="org.springframework.security.core.session.SessionRegistryImpl" />

    <authentication-manager alias="authenticationManager">
        <authentication-provider>
            <password-encoder ref="encoder" />
            <user-service>
                <user name="kalai"
                    password="$2a$10$EblZqNptyYvcLm/VwDCVAuBjzZOI7khzdyGPBr08PpIi0na624b8."
                    authorities="ROLE_ADMIN" />
                <user name="magesh"
                    password="$2a$10$EblZqNptyYvcLm/VwDCVAuBjzZOI7khzdyGPBr08PpIi0na624b8."
                    authorities="ROLE_USER" />
            </user-service>
        </authentication-provider>
    </authentication-manager>

    <beans:bean id="encoder"
        class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder">
        <beans:constructor-arg name="strength" value="11" />
    </beans:bean>

I am using a custom form login filter. i want concurrency control for login. so that the user can have only one session at a moment. he cannot login in some other browser and so till his current session expires / manual logout.

Some states that adding the below listener will resolve the issue. so i added the below in web.xml

<listener>
        <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
    </listener> 

But it didn't helped me either. The i found in some posts that form login filter will not support concurrentsessioncontrol.Do i need to implement any stuff. can anyone suggest on this or can you provide alternatives for the same. i have a custom filter for providing json response on successful and unsuccessful authentication.

Any helping hands will be much appreciated.

Aucun commentaire:

Enregistrer un commentaire