How do I get the Spring Security SessionRegistry?

Question

I can't seem to find how to get a reference to the Spring Security (V3) SessionRegistry inside of a Struts action.

I've configured the listener inside of my web.xml file:

<listener>
    <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
</listener>

And I've tried to use the @Autowired annotation to bring it into an action:

@Autowired
private SessionRegistry sessionRegistry;

@Override
public String execute() throws Exception {
    numberOfUsersLoggedin= sessionRegistry.getAllPrincipals().size();
    return SUCCESS;       
}

public SessionRegistry getSessionRegistry() {
    return sessionRegistry;
}

public void setSessionRegistry(SessionRegistry sessionRegistry) {
    this.sessionRegistry = sessionRegistry;
}

The http configuration looks like this:

    <session-management invalid-session-url="/public/login.do?login_error=expired"
        session-authentication-error-url="/public/login.do" 
        session-fixation-protection="newSession">
        <concurrency-control max-sessions="1" error-if-maximum-exceeded="true"/>
    </session-management>    

Generally I am more comfortable wiring the Spring bean myself, but not sure how this is exposed using the namespace. Each time the action executes, the session registry is null.

Can anyone point out what I am doing wrong here, or show me the way to an example?

Thanks in advance for any/all replies!

Answer 1

If you are configuring Spring Security by namespace, the following attributes of concurrency-control tag can be useful for accessing SystemRegistry:

1. session-registry-alias.
2. session-registry-ref.

Description of each of attributes from official documentation:

session-registry-alias. It can also be useful to have a reference to the internal session registry for use in your own beans or an admin interface. You can expose the internal bean using the session-registry-alias attribute, giving it a name that you can use elsewhere in your configuration.

session-registry-ref. The user can supply their own SessionRegistry implementation using the session-registry-ref attribute. The other concurrent session control beans will be wired up to use it.