每个用户的最大用户会话数-Apache Shiro [英] Max user sessions per user - apache shiro

问题描述

我已经配置了 Apache shiro ，它在我的应用程序中正常工作.

I have configured Apache shiro and it works fine with my application.

现在，我需要为每个用户配置最大会话数，这意味着一个用户无法登录到另一台计算机，或者如果他尝试登录，则该用户将使其先前的会话无效，或者也许他无法使用新会话登录.

Now i need to configure max sessions per user, meaning one user cannot login into another machine or if he tries to login, it should invalidate its previous session or maybe he cannot login with new session.

在单个时间点，应该只有一个用户会话.

At single point of time, there should only be one user session.

LoginServlet

UsernamePasswordToken token = new UsernamePasswordToken(username , password);
org.apache.shiro.subject.Subject subject = SecurityUtils.getSubject();
subject.login(token);
loginSuccessful = true;
token.clear();

配置xml

<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager" />
    </bean>

<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="cacheManager" ref="shiroCacheManager" />
        <property name="realm" ref="myRealm" />
    </bean>

    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />

    <bean id="shiroCacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
    </bean>

<bean id="myRealm" class="com.mypackage.service.shiro.RoleSecurityJdbcRealm">
        <property name="dataSource" ref="shiroDatasource" />
        <property name="permissionsLookupEnabled" value="true"></property>
</bean>

推荐答案

您需要从ModularRealmAuthenticator类中实现doAuthenticate(AuthenticationToken authenticationToken)，如果为该用户找到另一个活动会话，则抛出ConcurrentAccessException.

You need implement doAuthenticate(AuthenticationToken authenticationToken) from Class ModularRealmAuthenticator and throw ConcurrentAccessException if you find another active session for this user.

所有活动会话均可从

集合activeSessions =(((DefaultSessionManager)SecurityUtils.getSecurityManager()).getActiveSessions()

Collection activeSessions = ((DefaultSessionManager)SecurityUtils.getSecurityManager()).getActiveSessions()

这篇关于每个用户的最大用户会话数-Apache Shiro的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！