手动注销其他用户

Question

In my application I need to programmatically logout a user, not the current one. I was able to expire its session but this does not force a logout for that specific user. So my question is, how can I force a logout on the user's next request? This is my code now:

sessionRegistry.getAllPrincipals().each {
   principal = it
   sessionRegistry.getAllSessions(it, false).each {
       if (principal.username == userSec.username) {
           it.expireNow()
       }
   }
}

I have this in my resources.groovy:

sessionRegistry(SessionRegistryImpl)
    sessionAuthenticationStrategy(ConcurrentSessionControlStrategy, sessionRegistry) {
        maximumSessions = -1
    }
    concurrentSessionFilter(ConcurrentSessionFilter){
        sessionRegistry = sessionRegistry
        expiredUrl = '/login/concurrentSession'
    }

Answer 1

Using the session mechanismus it is not possible. You have to use a storage medium where you can keep the users. This medium can be either an in-RAM singleton, like ConcurrentHashMap instance, or a DB, depending on your clustering architecture.

Then upon each call to springSecurityService.currentUser (eg in Spring Security core plugin), you have to check if the sessionRegistry contains that user, and if not, invalidate the session or the user