Examples with SessionRegistry org.springframework.security.core.session.SessionRegistry used on opensource projects

Example 6 with SessionRegistry

use of org.springframework.security.core.session.SessionRegistry in project spring-security by spring-projects.

the class SessionManagementConfigurer method createConccurencyFilter.

private ConcurrentSessionFilter createConccurencyFilter(H http) {
    SessionInformationExpiredStrategy expireStrategy = getExpiredSessionStrategy();
    SessionRegistry sessionRegistry = getSessionRegistry(http);
    if (expireStrategy == null) {
        return new ConcurrentSessionFilter(sessionRegistry);
    }
    return new ConcurrentSessionFilter(sessionRegistry, expireStrategy);
}

Example 7 with SessionRegistry

use of org.springframework.security.core.session.SessionRegistry in project spring-security by spring-projects.

the class SessionManagementConfigurer method getSessionAuthenticationStrategy.

/**
	 * Gets the customized {@link SessionAuthenticationStrategy} if
	 * {@link #sessionAuthenticationStrategy(SessionAuthenticationStrategy)} was
	 * specified. Otherwise creates a default {@link SessionAuthenticationStrategy}.
	 *
	 * @return the {@link SessionAuthenticationStrategy} to use
	 */
private SessionAuthenticationStrategy getSessionAuthenticationStrategy(H http) {
    if (this.sessionAuthenticationStrategy != null) {
        return this.sessionAuthenticationStrategy;
    }
    List<SessionAuthenticationStrategy> delegateStrategies = this.sessionAuthenticationStrategies;
    SessionAuthenticationStrategy defaultSessionAuthenticationStrategy;
    if (this.providedSessionAuthenticationStrategy == null) {
        // If a user provided SessionAuthenticationStrategy is not supplied
        // then default to SessionFixationProtectionStrategy
        defaultSessionAuthenticationStrategy = postProcess(this.sessionFixationAuthenticationStrategy);
    } else {
        defaultSessionAuthenticationStrategy = this.providedSessionAuthenticationStrategy;
    }
    if (isConcurrentSessionControlEnabled()) {
        SessionRegistry sessionRegistry = getSessionRegistry(http);
        ConcurrentSessionControlAuthenticationStrategy concurrentSessionControlStrategy = new ConcurrentSessionControlAuthenticationStrategy(sessionRegistry);
        concurrentSessionControlStrategy.setMaximumSessions(this.maximumSessions);
        concurrentSessionControlStrategy.setExceptionIfMaximumExceeded(this.maxSessionsPreventsLogin);
        concurrentSessionControlStrategy = postProcess(concurrentSessionControlStrategy);
        RegisterSessionAuthenticationStrategy registerSessionStrategy = new RegisterSessionAuthenticationStrategy(sessionRegistry);
        registerSessionStrategy = postProcess(registerSessionStrategy);
        delegateStrategies.addAll(Arrays.asList(concurrentSessionControlStrategy, defaultSessionAuthenticationStrategy, registerSessionStrategy));
    } else {
        delegateStrategies.add(defaultSessionAuthenticationStrategy);
    }
    this.sessionAuthenticationStrategy = postProcess(new CompositeSessionAuthenticationStrategy(delegateStrategies));
    return this.sessionAuthenticationStrategy;
}

Example 8 with SessionRegistry

use of org.springframework.security.core.session.SessionRegistry in project spring-security by spring-projects.

the class ProtectPointcutPerformanceTests method usingPrototypeDoesNotParsePointcutOnEachCall.

// Method for use with profiler
@Test
public void usingPrototypeDoesNotParsePointcutOnEachCall() {
    StopWatch sw = new StopWatch();
    sw.start();
    for (int i = 0; i < 1000; i++) {
        try {
            SessionRegistry reg = (SessionRegistry) ctx.getBean("sessionRegistryPrototype");
            reg.getAllPrincipals();
            fail("Expected AuthenticationCredentialsNotFoundException");
        } catch (AuthenticationCredentialsNotFoundException expected) {
        }
    }
    sw.stop();
// assertThat(sw.getTotalTimeMillis() < 1000).isTrue();
}

Example 9 with SessionRegistry

use of org.springframework.security.core.session.SessionRegistry in project spring-security by spring-projects.

the class ConcurrentSessionFilterTests method lastRequestTimeUpdatesCorrectly.

@Test
public void lastRequestTimeUpdatesCorrectly() throws Exception {
    // Setup our HTTP request
    MockHttpServletRequest request = new MockHttpServletRequest();
    MockHttpSession session = new MockHttpSession();
    request.setSession(session);
    MockHttpServletResponse response = new MockHttpServletResponse();
    FilterChain fc = mock(FilterChain.class);
    // Setup our test fixture
    SessionRegistry registry = new SessionRegistryImpl();
    registry.registerNewSession(session.getId(), "principal");
    SimpleRedirectSessionInformationExpiredStrategy expiredSessionStrategy = new SimpleRedirectSessionInformationExpiredStrategy("/expired.jsp");
    ConcurrentSessionFilter filter = new ConcurrentSessionFilter(registry, expiredSessionStrategy);
    Date lastRequest = registry.getSessionInformation(session.getId()).getLastRequest();
    Thread.sleep(1000);
    filter.doFilter(request, response, fc);
    verify(fc).doFilter(request, response);
    assertThat(registry.getSessionInformation(session.getId()).getLastRequest().after(lastRequest)).isTrue();
}

Example 10 with SessionRegistry

use of org.springframework.security.core.session.SessionRegistry in project spring-security by spring-projects.

the class ConcurrentSessionFilterTests method doFilterWhenNoSessionInformationThenChainIsContinued.

@Test
public void doFilterWhenNoSessionInformationThenChainIsContinued() throws Exception {
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.setSession(new MockHttpSession());
    MockHttpServletResponse response = new MockHttpServletResponse();
    RedirectStrategy redirect = mock(RedirectStrategy.class);
    SessionRegistry registry = mock(SessionRegistry.class);
    String expiredUrl = "/expired";
    ConcurrentSessionFilter filter = new ConcurrentSessionFilter(registry, expiredUrl);
    filter.setRedirectStrategy(redirect);
    MockFilterChain chain = new MockFilterChain();
    filter.doFilter(request, response, chain);
    assertThat(chain.getRequest()).isNotNull();
}