spring security session registry empty
spring-security
Solution
Try this. It has worked for me.
in `<http></http>`,
`<session-management session-authentication-strategy-ref="sas" invalid-session-url="/invalid-session" />`
And declare beans as follows:
`<beans:bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl"/>`
`<beans:bean id="sas" class="org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy"> <beans:constructor-arg name="sessionRegistry" ref="sessionRegistry" /> <beans:property name="maximumSessions" value="1" /> </beans:bean>`
And do not forget to add org.springframework.security.web.session.HttpSessionEventPublisher listener to your web configuration.
Problem
I have a spring mvc webapp using spring security and one thing I would like to do every time a user logs in is log the number of concurrent users on the system. To do this I have given my session registry an alias and then I autowire into a class and say... ``` List<Object> principals = sessionRegistry.getAllPrincipals(); MDC.put(MDCKeyConstants.CONCURRENT_USER_COUNT, principals.size()); ``` but principals.size is coming to 0 . i.e. the principals list is empty. Am I missing something else that I need to configure? Sorry for the long post but I'm putting my spring security config here to try and get some help with the issue.. thanks in advance... ``` <http use-expressions="true" auto-config="false" entry-point-ref="loginUrlAuthenticationEntryPoint"> <!-- custom filters --> <custom-filter position="FORM_LOGIN_FILTER" ref="twoFactorAuthenticationFilter" /> <custom-filter after="SECURITY_CONTEXT_FILTER" ref="securityLoggingFilter"/> <!-- session management --> <session-management invalid-session-url="/sessionExpired.htm" session-authentication-error-url="/alreadyLoggedIn.htm"> <concurrency-control max-sessions="1" expired-url="/sessionExpiredDuplicateLogin.htm" error-if-maximum-exceeded="false" session-registry-alias="sessionRegistry"/> </session-management> <!-- error handlers --> <access-denied-handler error-page="/accessDenied.htm"/> <!-- logout --> <logout logout-success-url="/logout.htm" invalidate-session="false" delete-cookies="JSESSIONID"/> <!-- authorize pages --> <intercept-url pattern="/home.htm" access="isAuthenticated()" /> <intercept-url pattern="/shortsAndOvers.htm" access="isAuthenticated()" /> <intercept-url pattern="/shortsAndOversDaily.htm" access="isAuthenticated()" /> <intercept-url pattern="/birtpage.htm" access="isAuthenticated()" /> <intercept-url pattern="/reports/show.htm" access="isAuthenticated()" /> </http> <!-- =============================== --> <!-- AUTHENTICATION BEANS --> <!-- =============================== --> <beans:bean id="authenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"> <beans:property name="userDetailsService" ref="userDetailsDao" /> <beans:property name="passwordEncoder" ref="encoder" /> </beans:bean> <beans:bean id="twoFactorAuthenticationFilter" class="com.mycompany.reporting.security.TwoFactorAuthenticationFilter"> <beans:property name="authenticationManager" ref="authenticationManager" /> <beans:property name="authenticationFailureHandler" ref="failureHandler" /> <beans:property name="authenticationSuccessHandler" ref="successHandler" /> <beans:property name="filterProcessesUrl" value="/j_spring_security_check" /> <beans:property name="postOnly" value="true" /> </beans:bean> <beans:bean id="loginUrlAuthenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"> <beans:property name="loginFormUrl" value="/login.htm" /> </beans:bean> <beans:bean id="successHandler" class="com.mycompany.reporting.security.CustomSavedRequestAwareAuthenticationSuccessHandler"> <beans:property name="defaultTargetUrl" value="/home.htm" /> </beans:bean> <beans:bean id="failureHandler" class="com.mycompany.reporting.security.CustomSimpleUrlAuthenticationFailureHandler"> <beans:property name="defaultFailureUrl" value="/loginfailed.htm" /> </beans:bean> <authentication-manager alias="authenticationManager"> <authentication-provider ref="authenticationProvider"></authentication-provider> </authentication-manager> ```