Alguem tem algum exemplo gerenciamento de sessões no spring security?
Fiz o exemplo conforme o manual e não funciona.
Estou tentando matar a sessão do usuário caso alguem tente logar em outra máquina ou navegador.
Segue o código abaixo:
CONFIGURACAO SPRING
<security:http auto-config="false" use-expressions="true" entry-point-ref="authenticationEntryPoint">
<security:custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter" />
<security:custom-filter ref="authenticationFilter" position="FORM_LOGIN_FILTER"/>
<security:intercept-url pattern="/pages/view/**" access="isAuthenticated()"/>
<security:logout invalidate-session="true" logout-success-url="/login" logout-url="/logout"/>
<security:session-management session-authentication-strategy-ref="sas"/>
</security:http>
<bean id="concurrencyFilter" class="org.springframework.security.web.session.ConcurrentSessionFilter">
<property name="sessionRegistry" ref="sessionRegistry" />
<property name="expiredUrl" value="/expired" />
</bean>
<bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl" />
<bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
<property name="loginFormUrl" value="/index.jsf"/>
</bean>
<bean id="customAuthenticationSuccessHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler">
<property name="defaultTargetUrl" value="/logado"/>
</bean>
<bean id="customAuthenticationFailureHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
<property name="defaultFailureUrl" value="/login?error=true"/>
</bean>
<bean id="authenticationFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
<property name="sessionAuthenticationStrategy" ref="sas" />
<property name="authenticationManager" ref="_authenticationManager"/>
<property name="authenticationFailureHandler" ref="customAuthenticationFailureHandler" />
<property name="authenticationSuccessHandler" ref="customAuthenticationSuccessHandler"/>
</bean>
<bean id="sas" class="org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy">
<constructor-arg name="sessionRegistry" ref="sessionRegistry"/>
<property name="maximumSessions" value="1"/>
<property name="exceptionIfMaximumExceeded" value="true"/>
</bean>CLASSE
public UsuarioSistemaDTO requestAutenticarUsuario(String usuario, String senha) throws BusinessMessageException, ApplicationMessageException{
UsuarioSistemaDTO dto = new UsuarioSistemaDTO();
try{
ApplicationContext appContext = FacesContextUtils.getWebApplicationContext(FacesContext.getCurrentInstance());
AuthenticationManager manager = (AuthenticationManager) appContext.getBean("_authenticationManager");
UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(usuario, senha);
Authentication authentication = manager.authenticate(usernamePasswordAuthenticationToken);
SecurityContextHolder.getContext().setAuthentication(authentication);
List<GrantedAuthority> authorities = (List<GrantedAuthority>) SecurityContextHolder.getContext().getAuthentication().getAuthorities();
dto.setUsuario(usuario);
SecurityContextHolder.getContext().getAuthentication();
List<String> permissoes = new ArrayList<String>();
for (GrantedAuthority grantedAuthority : authorities) {
permissoes.add(grantedAuthority.getAuthority());
}
dto.setPermissoes(permissoes);
Funcionario funcionario = funcionarioService.getByUser(usuario);
sessionService.initSession(funcionario);
//NAO OBTEM OS USUARIO REGISTRADOS NA SESSAO <<<<<<<------------------------------------------------------------------------
for(Object object:sessionRegistry.getAllPrincipals()){
System.out.println(object.toString());
}
}catch (BadCredentialsException e) {
throw new BusinessMessageException(this.getMessage("exceptions.usuario.senha.invalido"));
}catch (Exception e) {
throw new ApplicationMessageException(this.getMessage("app.error.unknown"));
}
return dto;
}