2

I do the following:

  1. login to my spring application (e.g. as user 'admin')
  2. stop tomcat
  3. Now I see the session being serialized into sessions.ser file
  4. I restart tomcat
  5. the sessions.ser file disappears (I guess it is being deserialized during server start?)
  6. Now I send a request which requires a logged-in user (as done in step 1, i.e. I hit F5 in the browser where I was already logged-in before, so I guess the request sends along the jSessionId etc.)
  7. When debugging, I can observe how spring successfully loads the SecurityContext in

HttpSessionSecurityContextRepository.readSecurityContextFromSession

with the stored Session-Information (it is a UsernamePasswordAuthenticationToken containing an Authentication object containing the Principal etc. thus getting the custom User object seems possible)

  1. Spring accepts the request, i.e. there is no need to re-login and the appropiate response is sent

However, when trying to list the logged-in users using the SessionRegistry via

for (Object principal : sessionRegistry.getAllPrincipals()) {
            MyCustomUser myCustomUser = (MyCustomUser) principal;
            ClientQueryDetails client = clientQuery.getDetails(myCustomUser 
                    .getClientId()).get();
            List<SessionInformation> sessions = sessionRegistry.getAllSessions(
                    principal, false);
            for (SessionInformation sessionInformation : sessions) {
                result.add(new SessionInfo(client.getName(), myCustomUser 
                        .getUsername(), sessionInformation.getSessionId(),
                        sessionInformation.getLastRequest()));
            }
        }

as I normally do to visualize the users/sessions currently active, it is empty.

Why does Spring not add those Principals to the SessionRegistry in this moment? Can/Should I do it somehow manually?

I've read https://github.com/spring-projects/spring-security/issues/2062 which sounds like doing so would be a bad idea.

Also related seems Getting logged in users with sessionRegistry not work when manually authenticate

I've also found http://forum.spring.io/forum/spring-projects/web/71503-spring-not-restoring-persistent-sessions-to-session-registry

So to summarize my questions:

  1. Why doesn't spring re-add the serialized session informations to the SessionRegistry?
  2. Is querying the SessionRegistry in order to display all active Sessions to the user (i.e. the logged-in users) the correct way to do so? EDIT Yes, this is definitely the purpose of the SessionRegisty: https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#list-authenticated-principals

  3. Should I add the Principals manually to the SessionRegistry? EDIT https://github.com/spring-projects/spring-security/issues/2062 provides different ways of manually readding sessions to the SessionRegistry, however it seems there are some caveats in doing so.

  4. Where and how exactely is the Session from sessions.ser being deserialized into and where does spring obtain it? Or in other words, how does the session-information get from the sessions.ser file into the SecurityContext of spring? Especially how is it "handed over" from tomcat to spring?

SebastianRiemer
  • 1,495
  • 2
  • 20
  • 33
  • 1
    #4: **sessions.ser** is Tomcat saving the [`HttpSession`](http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpSession.html), and has nothing to do with Spring. Spring can get information by calling [`getAttribute()`](http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpSession.html#getAttribute(java.lang.String)). However, for the logged-in user, Spring can also call [`HttpServletRequest.getUserPrincipal()`](http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#getUserPrincipal()). To see exactly what it does, look at the Spring source code. – Andreas Sep 26 '17 at 17:20
  • The `SessionRegistry` is an in-memory map of currently attached users. That is obviously destroyed when you shutdown tomcat and empty when you start it. If you want that different use a persistent `SessionRegistry` instead. – M. Deinum Sep 26 '17 at 17:47

1 Answers1

0

My solution to the problem of not seeing Sessions in the SessionRegistry but having valid Sessions (i.e. logged-in users) is, to simply delete the SESSIONS.ser File on Server restart.

As a consequence, all users have to login again, and the SessionRegistry is populated accordingly. Since I have no pressing need to keep the sessions alive this is a good solution for me.

SebastianRiemer
  • 1,495
  • 2
  • 20
  • 33