how to obtain a list of all currently logged-in users (including rememberme cookies) in grails with spring security

Question

I'm building a grails app that has the spring-security-core 1.2.7.3 plugin as well as spring-security-ui 0.2 plugin, and would like to obtain a list of ALL the users that are currently logged in (ie have a currently active session). Users can login either through a login controller (daoAuthenticationProvider) or automatically through a rememberMe cookie. I have implemented the code below, using ConcurrentSessionControlStrategy to create a sessionRegistry:

in /conf/spring/resources.groovy:

import org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy
import org.springframework.security.web.session.ConcurrentSessionFilter
import org.springframework.security.core.session.SessionRegistryImpl
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy

beans = {
userDetailsService(lablore.MyUserDetailsService)

    sessionRegistry(SessionRegistryImpl)

    sessionAuthenticationStrategy(ConcurrentSessionControlStrategy, sessionRegistry) {
        maximumSessions = -1
    }

    concurrentSessionFilter(ConcurrentSessionFilter){
        sessionRegistry = sessionRegistry
        expiredUrl = '/login/concurrentSession'
    }

}

In /plugins/spring-security-core/conf/DefaultSecurityConfig.groovy

useHttpSessionEventPublisher = true

In the controller:

controller{
    def sessionRegistry

    action(){
        def loggedInUsers = sessionRegistry.getAllPrincipals()
    }
}

It works well for -users that login through the login page -users that logout through a 'logout' link -users who's session expires HOWEVER, it does NOT work for users that authenticate automatically with a rememberMe cookie. It doesn't see that they have a newly created session. If I understand correctly, this is because the RememberMeAuthenticationFilter is 'further up' in the filter chain compared to the ConcurrentSessionFilter, which is the one running the sessionRegistry? Or, I messed something up with my configurations....

Any help on how to get this to work would be great !

Thanks!!

Answer 1

The ConcurrentSessionControlStrategy is deprecated,

Use the ConcurrentSessionControlAuthenticationStrategy instead

Alternatively,

You can implement the HttpSessionListener interface which has the sessionCreated(HttpSessionEvent event) and sessionDestroyed(HttpSessionEvent event) methods, But you have to add the class you used

Implementations of this interface are notified of changes to the list of active sessions in a web application. To receive notification events, the implementation class must be configured in the deployment descriptor for the web application.

You can either add the implementation class to your deployment descriptor like so(i.e you web.xml file)

<listener>
   <listener-class>com.hazelcast.web.SessionListener</listener-class>
</listener>

or by using the WebXmlConfig plugin in grails

Your implementation class could look like below, see Online users with Spring Security also

class WebSessionListener implements HttpSessionListener{

     sessionCreated(HttpSessionEvent se){

          //Checked if user has logged in Here  and keep record 
              HttpSession webSession = se.getSession();

     }

     sessionDestroyed(HttpSessionEvent se){

          //Checked if user has logged in Here  and keep record     
            HttpSession webSession = se.getSession();
     }

}