春季极限最大训练;限制最大用户 [英] spring limit max sessions ; limit max users

问题描述

我是否可以使用Spring Security来限制能够同时登录网站的最大用户数量?

may i know possible to use spring security to limit max number of users able to login to website at the same time?

绝对不是并发会话控制参数.例如，我要限制最大只允许1000个用户同时登录.如果超过该通知页面说明已超过最大用户数

definately, not concurrent-session-control parameter. what i want is for instance, i want to limit maximum only allow 1000 users login same time. if more than that forward to notice page stating maximum users exceeded

推荐答案

您可以通过访问SessionRegistry来查找当前登录的用户，从而使用Spring Security的并发会话控制.在Spring Security 3中，ConcurrentSessionControlStrategy负责控制是否允许用户登录后创建会话.您可以扩展此类并根据用户数量添加额外的检查:

You can use Spring Security's concurrent session control by accessing the SessionRegistry to find out how many users are currently logged in. In Spring Security 3, the ConcurrentSessionControlStrategy is responsible for controlling whether the user is allowed to create a session after logging in. You can extend this class and add an extra check based on the number of users:

public class MySessionAuthenticationStrategy extends ConcurrentSessionControlStrategy {
    int MAX_USERS = 1000; // Whatever
    SessionRegistry sr;

    public MySessionAuthenticationStrategy(SessionRegistry sr) {
        super(sr);
        this.sr = sr;
    }

    @Override
    public void onAuthentication(Authentication authentication, HttpServletRequest request, HttpServletResponse response) {
        if (sr.getAllPrincipals().size() > MAX_USERS) {
            throw new SessionAuthenticationException("Maximum number of users exceeded");
        }
        super.onAuthentication(authentication, request, response);
    }
}

然后，您应按照 Spring Security参考手册.

在Spring Security 2.0中，并发会话控件的实现略有不同，因此您可以自定义ConcurrentSessionController.

In Spring Security 2.0, the concurrent session control is implemented slightly differently and you would customize the ConcurrentSessionController instead.

这篇关于春季极限最大训练;限制最大用户的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！