How to get a list of all currently registered users (including cookie memme) in grails with spring security

Question

I am creating a grails application that has the spring -security-core 1.2.7.3 plugin as well as the spring -security-ui 0.2 plugin and would like to get a list of ALL users who are currently logged in (i.e. has the currently active session). Users can log in either through the login controller (daoAuthenticationProvider) or automatically through the rememberMe cookie. I executed the code below using ConcurrentSessionControlStrategy to create sessionRegistry:

in / conf / spring / resources.groovy:

import org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy import org.springframework.security.web.session.ConcurrentSessionFilter import org.springframework.security.core.session.SessionRegistryImpl import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy beans = { userDetailsService(lablore.MyUserDetailsService) sessionRegistry(SessionRegistryImpl) sessionAuthenticationStrategy(ConcurrentSessionControlStrategy, sessionRegistry) { maximumSessions = -1 } concurrentSessionFilter(ConcurrentSessionFilter){ sessionRegistry = sessionRegistry expiredUrl = '/login/concurrentSession' } } 

In / plugins / spring -security-core / conf / DefaultSecurityConfig.groovy

 useHttpSessionEventPublisher = true 

In the controller:

 controller{ def sessionRegistry action(){ def loggedInUsers = sessionRegistry.getAllPrincipals() } } 

This works well for - users who log in to the login page - users logging out through the "log out" link - users whose expiration is HOWEVER, it does NOT work for users who are automatically authenticated using the rememberMe cookie. He does not see that they have a new session. If I understand correctly, this is due to the fact that RememberMeAuthenticationFilter is "further up" in the filter chain compared to the ConcurrentSessionFilter that works with SessionRegistry? Or, I messed up something with my configurations ....

Any help on how to make this work would be great!

Thanks!!

Answer 1

ConcurrentSessionControlStrategy is deprecated,

Use ConcurrentSessionControlAuthenticationStrategy instead

As an alternative,

You can implement the HttpSessionListener interface that has sessionCreated ( HttpSessionEvent event) and sessionDestroyed ( HttpSessionEvent ), but you need to add the class that you used

Implementations of this interface are notified of changes in the list of active sessions in the web application. To receive notifications, the implementation class must be configured in the deployment descriptor for the web application.

You can either add an implementation class to the deployment descriptor like this (e.g. web.xml file)

 <listener> <listener-class>com.hazelcast.web.SessionListener</listener-class> </listener> 

or using the WebXmlConfig plugin in grails

Your implementation class might look like this, see Users Online with Spring Security also

 class WebSessionListener implements HttpSessionListener{ sessionCreated(HttpSessionEvent se){ //Checked if user has logged in Here and keep record HttpSession webSession = se.getSession(); } sessionDestroyed(HttpSessionEvent se){ //Checked if user has logged in Here and keep record HttpSession webSession = se.getSession(); } }