Grails Spring Security max concurrent session -

i have grails 2.5.1 app spring security plugin(2.0-rc5). block number of current session per user. have read blog , doesn't work.(http://www.block-consult.com/blog/2012/01/20/restricting-concurrent-user-sessions-in-grails-2-using-spring-security-core-plugin/) resources.groovy

beans = {   sessionregistry(sessionregistryimpl)      concurrencyfilter(concurrentsessionfilter,sessionregistry,'/main/index'){         logouthandlers = [ref("remembermeservices"), ref("securitycontextlogouthandler")]     }     concurrentsessioncontrolstrategy(concurrentsessioncontrolauthenticationstrategy, sessionregistry) {         exceptionifmaximumexceeded = true         maximumsessions = 1      } } 

in boostrap.groovy

 def init = { servletcontext ->     springsecurityutils.clientregisterfilter('concurrencyfilter', securityfilterposition.concurrent_session_filter)   } 

and config.groovy have added this:

grails.plugin.springsecurity.usehttpsessioneventpublisher = true 

thanks..

to start with, let me warn if decided continue solution.

• sessionregistryimpl not scalable. need create own scalable implementation based on scaling plan(e.g. data grid). session replication not enough.
• currently, default logout handlers did not remove sessionregistry properly. have created sample logout handler called customsessionlogouthandler.
• you have override grails spring-security-core login controller handle sessionauthenticationexception.
• you can change number of users can login maximumsessions = 1 -1 unlimited sessions.

first, in resources.groovy

import org.springframework.security.core.session.sessionregistryimpl; import org.springframework.security.web.authentication.session.concurrentsessioncontrolauthenticationstrategy; import org.springframework.security.web.authentication.session.sessionfixationprotectionstrategy; import org.springframework.security.web.authentication.session.registersessionauthenticationstrategy; import org.springframework.security.web.authentication.session.compositesessionauthenticationstrategy; import com.basic.customsessionlogouthandler   // place spring dsl code here beans = {  sessionregistry(sessionregistryimpl)  customsessionlogouthandler(customsessionlogouthandler,ref('sessionregistry')    )  concurrentsessioncontrolauthenticationstrategy(concurrentsessioncontrolauthenticationstrategy,ref('sessionregistry')){     exceptionifmaximumexceeded = true     maximumsessions = 1 }  sessionfixationprotectionstrategy(sessionfixationprotectionstrategy){     migratesessionattributes = true     alwayscreatesession = true } registersessionauthenticationstrategy(registersessionauthenticationstrategy,ref('sessionregistry'))  sessionauthenticationstrategy(compositesessionauthenticationstrategy,[ref('concurrentsessioncontrolauthenticationstrategy'),ref('sessionfixationprotectionstrategy'),ref('registersessionauthenticationstrategy')])  } 

in config.groovy make sure customsessionlogouthandler first before securitycontextlogouthandler:

grails.plugin.springsecurity.logout.handlernames = ['customsessionlogouthandler','securitycontextlogouthandler']  

concurrentsessioncontrolauthenticationstrategy uses i18n. can have in language:

concurrentsessioncontrolauthenticationstrategy.exceededallowed = maximum sessions principal exceeded. {0} 

this sample customsessionlogouthandler can save in src/groovy/com/basic/customsessionlogouthandler.groovy:

/* * copyright 2002-2013 original author or authors.  *  * licensed under apache license, version 2.0 (the "license");  * may not use file except in compliance license.  * may obtain copy of license @  *  *      http://www.apache.org/licenses/license-2.0  *  * unless required applicable law or agreed in writing, software  * distributed under license distributed on "as is" basis,  * without warranties or conditions of kind, either express or implied.  * see license specific language governing permissions ,  * limitations under license.  */ package com.basic;  import javax.servlet.http.httpservletrequest; import javax.servlet.http.httpservletresponse;  import org.springframework.security.core.authentication; import org.springframework.security.web.authentication.logout.logouthandler; import org.springframework.util.assert; import org.springframework.security.core.session.sessionregistry;  /**  * {@link customsessionlogouthandler} in charge of removing {@link sessionregistry} upon logout.  * new {@link sessionregistry} generated framework upon next request.  *  * @author mohd qusyairi  * @since 0.1  */ public final class customsessionlogouthandler implements logouthandler {     private final sessionregistry sessionregistry;      /**      * creates new instance      * @param sessionregistry {@link sessionregistry} use      */     public customsessionlogouthandler(sessionregistry sessionregistry) {         assert.notnull(sessionregistry, "sessionregistry cannot null");         this.sessionregistry = sessionregistry;     }      /**      * clears {@link sessionregistry}      *      * @see org.springframework.security.web.authentication.logout.logouthandler#logout(javax.servlet.http.httpservletrequest,      * javax.servlet.http.httpservletresponse,      * org.springframework.security.core.authentication)      */     public void logout(httpservletrequest request, httpservletresponse response,             authentication authentication) {         this.sessionregistry.removesessioninformation(request.getsession().getid());     } } 

my sample login controller (i copied source) if need too. save normal controller in project override default. see line 115 below handle sessionauthenticationexception:

/* copyright 2013-2016 original author or authors.  *  * licensed under apache license, version 2.0 (the "license");  * may not use file except in compliance license.  * may obtain copy of license @  *  *      http://www.apache.org/licenses/license-2.0  *  * unless required applicable law or agreed in writing, software  * distributed under license distributed on "as is" basis,  * without warranties or conditions of kind, either express or implied.  * see license specific language governing permissions ,  * limitations under license.  */ package com.basic  import grails.converters.json import org.springframework.security.access.annotation.secured import org.springframework.security.authentication.accountexpiredexception import org.springframework.security.authentication.authenticationtrustresolver import org.springframework.security.authentication.credentialsexpiredexception import org.springframework.security.authentication.disabledexception import org.springframework.security.authentication.lockedexception import org.springframework.security.core.authentication import org.springframework.security.core.context.securitycontextholder import org.springframework.security.web.webattributes import org.springframework.security.web.authentication.session.sessionauthenticationexception import javax.servlet.http.httpservletresponse import grails.plugin.springsecurity.springsecurityutils  @secured('permitall') class logincontroller {      /** dependency injection authenticationtrustresolver. */     authenticationtrustresolver authenticationtrustresolver      /** dependency injection springsecurityservice. */     def springsecurityservice      /** default action; redirects 'defaulttargeturl' if logged in, /login/auth otherwise. */     def index() {         if (springsecurityservice.isloggedin()) {             redirect uri: conf.successhandler.defaulttargeturl         }         else {             redirect action: 'auth', params: params         }     }      /** show login page. */     def auth() {          def conf = getconf()          if (springsecurityservice.isloggedin()) {             redirect uri: conf.successhandler.defaulttargeturl             return         }          string posturl = request.contextpath + conf.apf.filterprocessesurl         render view: 'auth', model: [posturl: posturl,                                      remembermeparameter: conf.rememberme.parameter,                                      usernameparameter: conf.apf.usernameparameter,                                      passwordparameter: conf.apf.passwordparameter,                                      gsplayout: conf.gsp.layoutauth]     }      /** redirect action ajax requests. */     def authajax() {         response.setheader 'location', conf.auth.ajaxloginformurl         render(status: httpservletresponse.sc_unauthorized, text: 'unauthorized')     }      /** show denied page. */     def denied() {         if (springsecurityservice.isloggedin() && authenticationtrustresolver.isrememberme(authentication)) {             // have cookie page guarded is_authenticated_fully (or equivalent expression)             redirect action: 'full', params: params             return         }          [gsplayout: conf.gsp.layoutdenied]     }      /** login page users remember-me cookie accessing is_authenticated_fully page. */     def full() {         def conf = getconf()         render view: 'auth', params: params,                model: [hascookie: authenticationtrustresolver.isrememberme(authentication),                        posturl: request.contextpath + conf.apf.filterprocessesurl,                        remembermeparameter: conf.rememberme.parameter,                        usernameparameter: conf.apf.usernameparameter,                        passwordparameter: conf.apf.passwordparameter,                        gsplayout: conf.gsp.layoutauth]     }      /** callback after failed login. redirects auth page warning message. */     def authfail() {          string msg = ''         def exception = session[webattributes.authentication_exception]         if (exception) {             if (exception instanceof accountexpiredexception) {                 msg = message(code: 'springsecurity.errors.login.expired')             }             else if (exception instanceof credentialsexpiredexception) {                 msg = message(code: 'springsecurity.errors.login.passwordexpired')             }             else if (exception instanceof disabledexception) {                 msg = message(code: 'springsecurity.errors.login.disabled')             }             else if (exception instanceof lockedexception) {                 msg = message(code: 'springsecurity.errors.login.locked')             }             else if (exception instanceof sessionauthenticationexception){                 msg = exception.getmessage()             }             else {                 msg = message(code: 'springsecurity.errors.login.fail')             }         }          if (springsecurityservice.isajax(request)) {             render([error: msg] json)         }         else {             flash.message = msg             redirect action: 'auth', params: params         }     }      /** ajax success redirect url. */     def ajaxsuccess() {         render([success: true, username: authentication.name] json)     }      /** ajax denied redirect url. */     def ajaxdenied() {         render([error: 'access denied'] json)     }      protected authentication getauthentication() {         securitycontextholder.context?.authentication     }      protected configobject getconf() {         springsecurityutils.securityconfig     } }