如何在Spring Security 3.1中使用併發控制與FilterChainProxy

Question

嗨我試圖用spring security3.1實現併發控制，但它不工作。我使用FilterChainProxy，所以我不知道如何使用它的併發控制。我試過的代碼在我缺少的東西下面請幫助我？

Bean文件

<?xml version="1.0" encoding="UTF-8"?> 

    <beans xmlns="http://www.springframework.org/schema/beans" 
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security" 
     xsi:schemaLocation=" 
      http://www.springframework.org/schema/beans 
      http://www.springframework.org/schema/beans/spring-beans-3.0.xsd 
      http://www.springframework.org/schema/security 
      http://www.springframework.org/schema/security/spring-security-3.1.xsd 
     "> 

     <!-- Custom code by rajesh --> 
     <!-- =================================================================== --> 

     <!-- Create sessionRegistry Implementation Bean --> 
     <bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl" /> 

     <bean name="concurrencyFilter" class="org.springframework.security.web.session.ConcurrentSessionFilter"> 
      <property name="sessionRegistry" ref="sessionRegistry"/> 
      <property name="expiredUrl" value="/modules/my/login.do"/> 
     </bean> 



     <bean id="sas" class="com.xxxx.xxx.security.filter.MyConcurrentSessionControlStrategy"> 
      <constructor-arg name="sessionRegistry" ref="sessionRegistry" /> 
      <property name="securityImpl" ref="SecurityImpl"/> 
     </bean> 
     <!-- =================================================================== --> 
     <!--  Custom code ended by rajesh --> 


     <!-- Create ISecurity Implementation Bean --> 
     <bean id="SecurityImpl" class="com.xxxx.xxx.security.impl.SecurityImpl"> 
      <property name="dao"> 
       <bean class="com.xxxx.xxx.security.impl.SecurityDAO"> 
        <property name="sessionFactory" ref="mySessionFactory" /> 
       </bean> 
      </property> 
      <property name="sessionRegistry" ref="sessionRegistry" /> 
      <property name="persistentRememberMeTokenRepositoryImpl" > 
       <bean 
        class="com.xxxx.xxx.impl.core.security.persisted.tokens.PersistentRememberMeTokenRepositoryImpl"> 
        <property name="dao"> 
         <bean 
          class="com.xxxx.xxx.impl.core.security.persisted.tokens.PersistentRememberMeTokenDAO"> 
          <property name="sessionFactory" ref="mySessionFactory" /> 
         </bean> 
        </property> 
       </bean> 
      </property> 
     </bean> 

    <bean id="ISecurityImpl" 
      class="org.springframework.transaction.interceptor.TransactionProxyFactoryBean"> 
      <property name="transactionManager" ref="myTransactionManager" /> 
      <property name="target" ref="SecurityImpl" /> 
      <property name="proxyTargetClass" value="false" /> 
      <property name="transactionAttributes"> 
       <props> 
        <prop key="set*">PROPAGATION_REQUIRED</prop> 
        <prop key="checkPasswordExpiry">PROPAGATION_REQUIRED</prop> 
        <prop key="expireSessionBySessionId">PROPAGATION_REQUIRED</prop> 
       </props> 
      </property> 
     </bean> 

     <bean id="myFilterSecurityInterceptor" class="org.springframework.security.web.FilterChainProxy"> 
      <security:filter-chain-map request-matcher="ant" > 
       <security:filter-chain pattern="/**" 
        filters="securityContextPersistenceFilter,concurrencyFilter, logoutFilter, usernamePasswordAuthenticationFilter, rememberMeAuthenticationFilter, passwordExpiryFilter , anonymousAuthenticationFilter, accountExpiryFilter, exceptionTranslationFilter, filterSecurityInterceptor" /> 
      </security:filter-chain-map> 
     </bean> 
     <bean id="securityContextPersistenceFilter" 
      class="org.springframework.security.web.context.SecurityContextPersistenceFilter" /> 

     <bean id="logoutFilter" 
      class="org.springframework.security.web.authentication.logout.LogoutFilter"> 
      <!-- the post-logout destination --> 
      <constructor-arg value="/modules/my/login.do" /> 
      <constructor-arg> 
       <array> 
        <ref bean="myRememberMeService"/> 
        <bean class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" /> 
       </array> 
      </constructor-arg> 
      <property name="filterProcessesUrl" value="/logout_my" /> 
     </bean> 

     <bean id="usernamePasswordAuthenticationFilter" 
      class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"> 
      <property name="sessionAuthenticationStrategy" ref="sas" /> 
      <property name="authenticationManager" ref="myAuthenticationManager" /> 
      <property name="rememberMeServices" ref="myRememberMeService" /> 
      <property name="filterProcessesUrl" value="/my_authentication_service"></property> 
      <property name="usernameParameter" value="loginid" /> 
      <property name="passwordParameter" value="password" /> 
      <property name="authenticationFailureHandler" ref="AuthenticationFailureHandler" /> 
      <property name="authenticationSuccessHandler" ref="AuthenticationSuccessHandler" /> 
     </bean> 
     <bean id="accountExpiryFilter" class="com.xxxx.xxx.security.filter.MyAccountExpiryFilter"> 
      <property name="securityImpl" ref="SecurityImpl"/> 
      <property name="authenticationFailureHandler" ref="AuthenticationFailureHandler" /> 
      <property name="authenticationSuccessHandler" ref="AuthenticationSuccessHandler" /> 
     </bean> 
     <bean id="passwordExpiryFilter" 
      class="com.xxxx.xxx.security.filter.MyPasswordExpiryFilter"> 
      <property name="securityImpl" ref="SecurityImpl"/> 
      <property name="authenticationFailureHandler" ref="AuthenticationFailureHandler" /> 
      <property name="authenticationSuccessHandler" ref="AuthenticationSuccessHandler" /> 
     </bean> 

     <bean id="AuthenticationFailureHandlerImpl" 
      class="com.xxxx.xxx.security.impl.AuthenticationFailureHandlerImpl"> 
      <property name="dao"> 
       <bean class="com.xxxx.xxx.security.impl.SecurityDAO"> 
        <property name="sessionFactory" ref="mySessionFactory" /> 
       </bean> 
      </property> 
      <property name="defaultFailureUrl" value="/modules/my/login.do?error=1" /> 
     </bean> 

     <bean id="AuthenticationFailureHandler" 
      class="org.springframework.transaction.interceptor.TransactionProxyFactoryBean"> 
      <property name="transactionManager" ref="myTransactionManager" /> 
      <property name="target" ref="AuthenticationFailureHandlerImpl" /> 
      <property name="proxyTargetClass" value="true" /> 
      <property name="transactionAttributes"> 
       <props> 
        <prop key="onAuthenticationFailure">PROPAGATION_REQUIRED</prop> 
       </props> 
      </property> 
     </bean> 

     <bean id="AuthenticationSuccessHandlerImpl" 
      class="com.xxxx.xxx.security.impl.AuthenticationSuccessHandler"> 
      <property name="dao"> 
       <bean class="com.xxxx.xxx.security.impl.SecurityDAO"> 
        <property name="sessionFactory" ref="mySessionFactory" /> 
       </bean> 
      </property> 
      <property name="targetUrlParameter" value="redirect-to"></property> 
     </bean> 

     <bean id="AuthenticationSuccessHandler" 
      class="org.springframework.transaction.interceptor.TransactionProxyFactoryBean"> 
      <property name="transactionManager" ref="myTransactionManager" /> 
      <property name="target" ref="AuthenticationSuccessHandlerImpl" /> 
      <property name="proxyTargetClass" value="true" /> 
      <property name="transactionAttributes"> 
       <props> 
        <prop key="onAuthenticationSuccess">PROPAGATION_REQUIRED</prop> 
       </props> 
      </property> 
     </bean> 

     <bean id="rememberMeAuthenticationFilter" 
      class="com.xxxx.xxx.security.filter.MyRememberMeAuthenticationFilter"> 
      <property name="rememberMeServices" ref="myRememberMeService" /> 
      <property name="authenticationManager" ref="myAuthenticationManager" /> 
      <property name="securityImpl" ref="SecurityImpl"/> 
     </bean> 

     <bean id="anonymousAuthenticationFilter" 
      class="org.springframework.security.web.authentication.AnonymousAuthenticationFilter"> 
      <property name="userAttribute" value="anonymousUser,ROLE_ANONYMOUS" /> 
      <property name="key" value="XXXXXXXX" /> 
     </bean> 
     <bean id="exceptionTranslationFilter" 
      class="org.springframework.security.web.access.ExceptionTranslationFilter"> 
      <property name="authenticationEntryPoint"> 
       <bean 
        class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"> 
        <property name="loginFormUrl" value="/modules/my/login.do" /> 
       </bean> 
      </property> 
      <property name="accessDeniedHandler" ref="AccessDeniedHandler" /> 
     </bean> 

     <bean id="AccessDeniedHandlerImpl" class="com.xxxx.xxx.security.impl.AccessDeniedHandlerImpl"> 
      <property name="dao"> 
       <bean class="com.xxxx.xxx.security.impl.SecurityDAO"> 
        <property name="sessionFactory" ref="mySessionFactory" /> 
       </bean> 
      </property> 
      <property name="errorPage" value="/modules/errors/accessDenied.do" /> 
     </bean> 

     <bean id="AccessDeniedHandler" 
      class="org.springframework.transaction.interceptor.TransactionProxyFactoryBean"> 
      <property name="transactionManager" ref="myTransactionManager" /> 
      <property name="target" ref="AccessDeniedHandlerImpl" /> 
      <property name="proxyTargetClass" value="true" /> 
      <property name="transactionAttributes"> 
       <props> 
        <prop key="handle">PROPAGATION_REQUIRED</prop> 
       </props> 
      </property> 
     </bean> 


     <bean id="filterSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor"> 
      <property name="authenticationManager" ref="myAuthenticationManager" /> 
      <property name="accessDecisionManager" ref="myAffirmativeBasedAccessDecisionManager" /> 
      <property name="securityMetadataSource"> 
       <security:filter-security-metadata-source 
        use-expressions="true" lowercase-comparisons="true"> 
        <!-- Core Actions --> 
        <security:intercept-url pattern="/modules/my/login.do" 
         access="permitAll" /> 
        <security:intercept-url pattern="/modules/my/credentialExpired.do" 
         access="hasRole('ROLE_ANONYMOUS')" /> 
        <security:intercept-url pattern="/modules/my/*" 
         access="hasRole('ROLE_ADMIN')" /> 
       </security:filter-security-metadata-source> 
      </property> 
     </bean> 

     <bean class="org.springframework.security.access.vote.AffirmativeBased" 
      id="myAffirmativeBasedAccessDecisionManager"> 
      <property name="decisionVoters"> 
       <list> 
        <bean id="webExpressionVoter" 
         class="org.springframework.security.web.access.expression.WebExpressionVoter"> 
         <property name="expressionHandler" ref="MyWebSecurityExpressionHandler" /> 
        </bean> 
        <bean class="org.springframework.security.access.vote.RoleVoter" /> 
        <bean class="org.springframework.security.access.vote.AuthenticatedVoter" /> 
       </list> 
      </property> 
     </bean> 

     <bean id="MyWebSecurityExpressionHandler" 
      class="com.xxxx.xxx.security.spring.web.MyWebSecurityExpressionHandler"> 
      <property name="iSecurity" ref="SecurityImpl" /> 
      <property name="roleHierarchy"> 
       <bean 
        class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl"> 
        <property name="hierarchy"> 
         <value> 
          ROLE_MY > ROLE_ADMIN 
          ROLE_ADMIN > ROLE_USER 
          ROLE_USER > ROLE_PORTAL_USER 
          ROLE_PORTAL_USER > ROLE_GUEST 
          ROLE_GUEST > ROLE_ANONYMOUS 
         </value> 
        </property> 
       </bean> 
      </property> 
     </bean> 


     <bean id="myAuthenticationManager" 
      class="org.springframework.security.authentication.ProviderManager"> 
      <property name="authenticationEventPublisher" ref="myAuthEventPublisher" /> 
      <property name="providers"> 
       <list> 
        <bean 
         class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"> 
         <property name="userDetailsService" ref="myUserDetailsService" /> 
         <property name="passwordEncoder"> 
          <bean id="myPasswordEncoder" 
           class="com.xxxx.xxx.security.spring.MyPasswordEncoder"> 
           <property name="passwordEncryptor" ref="myPasswordEncryptor"></property> 
          </bean> 
         </property> 
        </bean> 
        <bean 
         class="org.springframework.security.authentication.AnonymousAuthenticationProvider "> 
         <property name="key" value="xxxxxxxxxxxxxx" /> 
        </bean> 
        <bean 
         class="org.springframework.security.authentication.RememberMeAuthenticationProvider"> 
         <property name="key" value="MY_SECURE_REMME_MY_APP" /> 
        </bean> 
       </list> 
      </property> 
     </bean> 

     <bean id="myUserDetailsService" class="com.xxxx.xxx.impl.core.users.UserImpl"> 
      <property name="dao" ref="userDao" /> 
      <property name="passwordEncryptor" ref="myPasswordEncryptor" /> 
     </bean> 

     <!-- like for example at new user sign-up. --> 

     <bean id="myRememberMeService" 
      class="com.xxxx.xxx.security.impl.DefaultMyRememberMeServices"> 
      <property name="tokenRepository"> 
       <bean 
        class="org.springframework.transaction.interceptor.TransactionProxyFactoryBean"> 
        <property name="transactionManager" ref="myTransactionManager" /> 
        <property name="target"> 
         <bean 
          class="com.xxxx.xxx.impl.core.security.persisted.tokens.PersistentRememberMeTokenRepositoryImpl"> 
          <property name="dao"> 
           <bean 
            class="com.xxxx.xxx.impl.core.security.persisted.tokens.PersistentRememberMeTokenDAO"> 
            <property name="sessionFactory" ref="mySessionFactory" /> 
           </bean> 
          </property> 
         </bean> 
        </property> 
        <property name="proxyTargetClass" value="false" /> 
        <property name="transactionAttributes"> 
         <props> 
          <prop key="*">PROPAGATION_REQUIRED</prop> 
         </props> 
        </property> 
       </bean> 
      </property> 
      <property name="userDetailsService" ref="myUserDetailsService" /> 
      <property name="key" value="MY_SECURE_REMME_MY_APP" /> 
      <property name="alwaysRemember" value="false" /> 
      <property name="useSecureCookie" value="true" /> 
      <property name="cookieName" value="MY_SECURE_REMME" /> 
      <property name="parameter" value="MY_REMME" /> 
      <property name="dao"> 
       <bean class="com.xxxx.xxx.security.impl.SecurityDAO"> 
        <property name="sessionFactory" ref="mySessionFactory" /> 
       </bean> 
      </property> 
     </bean> 

     <bean id="myPasswordEncryptor" class="com.xxxx.xxx.security.spring.MyPasswordEncryptor" /> 

     <bean id="myAuthEventPublisher" 
      class="org.springframework.security.authentication.DefaultAuthenticationEventPublisher" /> 
     <bean id="authenticationListener" 
      class="org.springframework.security.authentication.event.LoggerListener" /> 
     <bean id="authorizationListener" 
      class="org.springframework.security.access.event.LoggerListener" /> 

     <bean id="DatabaseConfigImpl" class="com.xxxx.xxx.impl.core.database.config.DatabaseConfigImpl"></bean> 
     <bean id="IDatabaseConfig" class="org.springframework.transaction.interceptor.TransactionProxyFactoryBean"> 
      <property name="target" ref="DatabaseConfigImpl" /> 
      <property name="proxyTargetClass" value="false"/> 
      <property name="transactionAttributes"> 
       <props> 
        <prop key="add*">PROPAGATION_REQUIRED</prop> 
        <prop key="update*">PROPAGATION_REQUIRED</prop> 
        <prop key="delete*">PROPAGATION_REQUIRED</prop> 
       </props> 
      </property> 
     </bean> 
    </beans> 

在這種MyConcurrentSessionControlStrategy類擴展ConcurrentSessionControlStrategy類定製implementation.I也是用自定義filter.I已經在web.xml中還增加了HttpSessionEventPublisher

我的應用程序是working.I我沒有得到如何應用併發控制。

Answer 1

既然你還沒有表現出對usernamePasswordAuthenticationFilter的配置，我的第一個猜測是，你忘了通過注入ConcurrentSessionControlStrategy成豆有添加必要的鉤子。在添加您自己的自定義版本的類之前，您應該證明您可以使用標準類來處理它。在the reference manual中有一個示例配置。從那裏開始，確保有效，然後嘗試添加您的MyConcurrentSessionControlStrategy。沒有看到該類的代碼，它可能很容易就是那裏的錯誤。另外，如果你想描述一個問題，你應該詳細解釋什麼「不工作」，即使它只是當你認爲它應該是啓用時沒有啓用的功能。調試日誌也是一個有用的信息來源。