How to logging login and logout in Spring Security 4? - spring

Question

At most want to know what is the reason of login failed!
That is the code:
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers("/assets/**",
"/user/register/**",
"/login/**",
"/page-register.html",
"/page-login.html").permitAll()
.anyRequest().authenticated()
.and()
.formLogin()
.successForwardUrl("/index.html")
.loginProcessingUrl("/login")
.loginPage("/page-login.html")
.permitAll()
.and()
.logout()
.permitAll()
.and()
.csrf().disable();
}

Answer 1

By default your spring Application has something called a ApplicationEventPublisher, and Spring security sends AbstractAuthenticationEvent through this event mechnism, so all you have to do is listen. This is rather simple, you just need a component which implements ApplicationListener, like this:
#Component
public class SecurityEventListener implements ApplicationListener<AbstractAuthenticationEvent> {
#Override
public void onApplicationEvent(AbstractAuthenticationEvent event) {
System.out.println(event);
}
}
If you are using Spring 4.2 or newer, you don't need to implement the interface, just annotate the method with #EventListener. You can read more about listeners here
When login fails, the event will extend AbstractAuthenticationFailureEvent, and contain the exception which was thrown. You can check the events source property to see what the user entered in the login form, and which IP he connected from.