How to remove existing sessions by specific principal name

Question

I'm using Spring Session 1.3.0 with Redis backend in my project.

I have an use case that the super admin might update the roles of existing user who might already logged in. I want to delete the existing session records for those users after changing their roles.

Is there API of Spring Session to archive it?

Answer 1

    @Autowired
    private SessionRegistry sessionRegistry;

    public void expireUserSessions(String username) {
        for (Object principal : sessionRegistry.getAllPrincipals()) {
            if (principal instanceof User) {
                UserDetails userDetails = (UserDetails) principal;
                if (userDetails.getUsername().equals(username)) {
                    for (SessionInformation information : sessionRegistry.getAllSessions(userDetails, true)) {
                        information.expireNow();
                    }
                }
            }
        }
    }

Answer 2

Also work out another way to clean sessions of specific user,

@Autowired
FindByIndexNameSessionRepository sessionRepository;

sessionRepository.findByIndexNameAndIndexValue(FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME,
                username).keySet().forEach(session -> sessionRepository.delete((String) session));