如何通過登錄註銷用戶（不是當前）？

Question

我在我的系統中兩個角色：用戶和管理

管理員可以通過名字登出任何用戶。

我該怎麼做？ 我需要的是這樣的：

service.logoutUser(anotherUserName)

的配置是這樣的：

@Configuration 
@EnableWebSecurity 
public class WebSecurityConfig extends WebSecurityConfigurerAdapter { 
    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http 
      .authorizeRequests() 
       .antMatchers 
       .... 
       .formLogin() 
       .loginProcessingUrl("/api/login") 
       .successHandler(authenticationSuccessHandler) 
       .failureHandler(new SimpleUrlAuthenticationFailureHandler()) 
       .and() 
      .rememberMe() 
       .key("...") 
       .rememberMeCookieName("...") 
       .userDetailsService(userDetailsService) 
       .and() 
      .csrf() 
       .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()) 
       .and() 
      .logout() 
       .deleteCookies("JSESSIONID") 
       .logoutUrl("/logout") 
       .logoutSuccessHandler(new HttpStatusReturningLogoutSuccessHandler()) 
       .permitAll(); 

Answer 1

事情是這樣的：

import org.springframework.security.core.userdetails.User; 
... 
... 
Set<SimpleGrantedAuthority> userRoles = new HashSet<>(); 
userRoles.add(new SimpleGrantedAuthority("ROLE_USER")); 
User user = new User(anotherUserName, "", userRoles); 
List<SessionInformation> sessions = sessionRegistry.getAllSessions(u, false); 

for(SessionInformation info : infos) { 
    info.expireNow(); 
}