Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1147: Remove use of SessionRegistryUtils. Inlined the methods.

This commit is contained in:
Luke Taylor 2009-05-01 06:45:34 +00:00
parent 8c94e39150
commit 4bc788828c
4 changed files with 18 additions and 73 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
core/src/main/java/org/springframework/security/authentication/concurrent/ConcurrentSessionControllerImpl.java
View File

@ -88,10 +88,9 @@ public class ConcurrentSessionControllerImpl implements ConcurrentSessionControl
public void checkAuthenticationAllowed(Authentication request) throws AuthenticationException {
Assert.notNull(request, "Authentication request cannot be null (violation of interface contract)");
Object principal = SessionRegistryUtils.obtainPrincipalFromAuthentication(request);
String sessionId = SessionRegistryUtils.obtainSessionIdFromAuthentication(request);
String sessionId = obtainSessionId(request);
final List<SessionInformation> sessions = sessionRegistry.getAllSessions(principal, false);
final List<SessionInformation> sessions = sessionRegistry.getAllSessions(request.getPrincipal(), false);
int sessionCount = sessions == null ? 0 : sessions.size();
@ -137,10 +136,7 @@ public class ConcurrentSessionControllerImpl implements ConcurrentSessionControl
public void registerSuccessfulAuthentication(Authentication authentication) {
Assert.notNull(authentication, "Authentication cannot be null (violation of interface contract)");
Object principal = SessionRegistryUtils.obtainPrincipalFromAuthentication(authentication);
String sessionId = SessionRegistryUtils.obtainSessionIdFromAuthentication(authentication);
sessionRegistry.registerNewSession(sessionId, principal);
sessionRegistry.registerNewSession(obtainSessionId(authentication), authentication.getPrincipal());
}
public void setExceptionIfMaximumExceeded(boolean exceptionIfMaximumExceeded) {
@ -162,4 +158,17 @@ public class ConcurrentSessionControllerImpl implements ConcurrentSessionControl
public SessionRegistry getSessionRegistry() {
return sessionRegistry;
}
private String obtainSessionId(Authentication auth) {
if (auth.getDetails() == null || !(auth.getDetails() instanceof SessionIdentifierAware)) {
throw new IllegalArgumentException("The 'details' property of the supplied Authentication " +
"object must be set and must implement 'SessionIdentifierAware', but Authentication.getDetails() " +
"returned " + auth.getDetails());
}
String sessionId = ((SessionIdentifierAware) auth.getDetails()).getSessionId();
Assert.hasText(sessionId, "SessionIdentifierAware did not return a Session ID (" + auth.getDetails() + ")");
return sessionId;
}
}

1
core/src/main/java/org/springframework/security/authentication/concurrent/SessionRegistryImpl.java
View File

@ -39,7 +39,6 @@ import org.springframework.util.Assert;
* <p>
* NB: It is important that you register the {@link org.springframework.security.web.session.HttpSessionEventPublisher} in
* <code>web.xml</code> so that this class is notified of sessions that expire.
* </p>
*
* @author Ben Alex
* @version $Id$

60
core/src/main/java/org/springframework/security/authentication/concurrent/SessionRegistryUtils.java
View File

@ -1,60 +0,0 @@
/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.authentication.concurrent;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.util.Assert;
/**
* Utility methods to assist with concurrent session management.
*
* @author Ben Alex
* @version $Id$
*/
public final class SessionRegistryUtils {
//~ Constructors ===================================================================================================
private SessionRegistryUtils() {
}
//~ Methods ========================================================================================================
public static Object obtainPrincipalFromAuthentication(Authentication auth) {
Assert.notNull(auth, "Authentication required");
Assert.notNull(auth.getPrincipal(), "Authentication.getPrincipal() required");
if (auth.getPrincipal() instanceof UserDetails) {
return ((UserDetails) auth.getPrincipal()).getUsername();
} else {
return auth.getPrincipal();
}
}
public static String obtainSessionIdFromAuthentication(Authentication auth) {
Assert.notNull(auth, "Authentication required");
Assert.notNull(auth.getDetails(), "Authentication.getDetails() required");
Assert.isInstanceOf(SessionIdentifierAware.class, auth.getDetails());
String sessionId = ((SessionIdentifierAware) auth.getDetails()).getSessionId();
Assert.hasText(sessionId, "SessionIdentifierAware did not return a Session ID (" + auth.getDetails() + ")");
return sessionId;
}
}

7
web/src/main/java/org/springframework/security/web/util/SessionUtils.java
View File

@ -10,7 +10,6 @@ import javax.servlet.http.HttpSession;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.security.authentication.concurrent.SessionRegistry;
import org.springframework.security.authentication.concurrent.SessionRegistryUtils;
import org.springframework.security.core.context.SecurityContextHolder;
/**
@ -67,10 +66,8 @@ public final class SessionUtils {
if (sessionRegistry != null) {
sessionRegistry.removeSessionInformation(originalSessionId);
Object principal = SessionRegistryUtils.obtainPrincipalFromAuthentication(
SecurityContextHolder.getContext().getAuthentication());
sessionRegistry.registerNewSession(session.getId(), principal);
sessionRegistry.registerNewSession(session.getId(),
SecurityContextHolder.getContext().getAuthentication().getPrincipal());
}
}
}