在自定义事件侦听器中注销用户

Question

For Spring Security, I am required to log out a user in AuthenticationSuccessEvent . If the user logs in with valid credentials, I want to log out the user based on some constraints.

How can I do this?

@Override
public void onApplicationEvent(AbstractAuthenticationEvent appEvent) {
    if (appEvent instanceof AuthenticationSuccessEvent) {
        if(Condition true)
        {
            //LOGOUT
        }
    }

Answer 1

I haven't done this in a AuthenticationSuccessEvent yet, but what would try is to do the same thing the LogoutFilter does.

Unfortunaly the LogoutFilter does the logout handling directly in its handler method LogoutFilter.doFilter(ServletRequest req, ServletResponse res, FilterChain chain) , so it would be a hack to invoke it diretly, (but not impossible)

@Autowired
LogoutFilter logoutFilter;


private void doLogout() {
    MockHttpServletRequest request = new MockHttpServletRequest(
          "GET",
          "http://myApp" + this.logoutFilter.getFilterProcessingUrl());        

    this.logoutFilter.doFilter(request, new MockHttpServletResponse(),
                               new MockFilterChain());
}

But this is a hack. -- Anway, I would start with this. It it works, and show that this prove of concept works, then I would implment a more clean solution:

Obain a list of all LogoutHandler s that are registered with the LogoutFilter and invoke them directly and then fire logoutSuccessHandler.onLogoutSuccess (that is exactly what the LogoutFilter does).

@Autowired
List<LogoutHandler> logoutHandlers;

@Autwired
LogoutSuccessHandler logoutSuccessHandler;

private void doLogout() {
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    for (LogoutHandler handler : handlers)
         handler.logout(request, response, auth);

    logoutSuccessHandler.onLogoutSuccess(request, response, auth);
}

---

BUT

if you only want to prevent the user from login because of some constraints, it would be much easyer and cleaner to implement the interface UserDetailsChecker and register you implementation with AbstractUserDetailsAuthenticationProvider.preAuthenticationChecks or .postAuthenticationChecks (It is likely that you use DaoAuthenticationProvider which is a subclass of AbstractUserDetailsAuthenticationProvider )

(Hint: void UserDetailsChecker.check(UserDetails toCheck) (that is the only one method of UserDetailsChecker ) - need to throw a Exception if it want to prevent the user from logging in.)

 private class Demo implements UserDetailsChecker {
    public void check(UserDetails user) {
        if (!user.isAccountNonLocked())
            throw new LockedException("User account is locked");
        if (!user.isEnabled())
            throw new DisabledException("User is disabled"));
        if (!user.isAccountNonExpired())
            throw new AccountExpiredException("User account has expired");
        //And here comes you!
    }
}