Spring Security session concurrency - spring

Question

I have an app build with Spring 4.0 and Security 3.2 and I want to implement session concurrency but it does not seems to work. All other aspects of security are working just fine. Here are my xml configs:
first of all in my web.xml:
<listener>
<listener-class>
org.springframework.security.web.session.HttpSessionEventPublisher
</listener-class>
</listener>
then in my security.xml
<security:http auto-config="false"
use-expressions="true"
authentication-manager-ref="authManager"
access-decision-manager-ref="webAccessDecisionManager"
entry-point-ref="authenticationEntryPoint">
<security:intercept-url pattern="/agent/**" access="hasAnyRole('ROLE_AGENT')" />
<security:intercept-url pattern="/admin/**" access="hasRole('ROLE_ADMIN')" />
<security:intercept-url pattern="/public/**" access="permitAll" />
<security:intercept-url pattern="/**" access="permitAll" />
<security:session-management session-authentication-strategy-ref="sas"
invalid-session-url="/public/login.xhtml"/>
<security:logout logout-success-url="/public/login.xhtml"
invalidate-session="true"
delete-cookies="true"/>
<security:expression-handler ref="webExpressionHandler"/>
<security:custom-filter position="FORM_LOGIN_FILTER" ref="myAuthFilter" />
<security:custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter" />
</security:http>
and
<bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
<constructor-arg index="0" value="/public/login.xhtml" />
</bean>
<bean id="customAuthenticationFailureHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"
p:defaultFailureUrl="/public/login.xhtml" />
<bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl"/>
<bean id="concurrencyFilter" class="org.springframework.security.web.session.ConcurrentSessionFilter">
<constructor-arg index="0" ref="sessionRegistry"/>
<constructor-arg index="1" value="/session-expired.htm"/>
</bean>
<bean id="myAuthFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
<property name="sessionAuthenticationStrategy" ref="sas" />
<property name="authenticationManager" ref="authManager" />
<property name="authenticationFailureHandler" ref="customAuthenticationFailureHandler"/>
</bean>
<bean id="sas" class="org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy">
<constructor-arg name="sessionRegistry" ref="sessionRegistry" />
<property name="maximumSessions" value="1" />
<property name="exceptionIfMaximumExceeded" value="true" />
</bean>
<bean id="authManager" class="org.springframework.security.authentication.ProviderManager">
<property name="providers">
<list>
<ref bean="myCompLdapAuthProvider"/>
<ref bean="myCompDBAuthProvider"/>
</list>
</property>
</bean>
My UserDetails implements hashCode() an equals() and with all this the concurrent session limitation does not work. After a little debug session I have observed that my session is never found in sessionRegistry and I guess that this is the main reason, but I do not know why!?
Any idea of what I`m doing wrong here ?
P.S. I have such records in my debug logs:
(FilterChainProxy.java:337) - /resources/images/icons/connection_on.gif at position 2 of 11 in additional filter chain; firing Filter: 'ConcurrentSessionFilter'
(FilterChainProxy.java:337) - /resources/images/icons/connection_on.gif at position 3 of 11 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
(FilterChainProxy.java:337) - /resources/images/icons/connection_on.gif at position 4 of 11 in additional filter chain; firing Filter: 'LogoutFilter'
(FilterChainProxy.java:337) - /resources/images/icons/connection_on.gif at position 5 of 11 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
(FilterChainProxy.java:337) - /resources/images/icons/connection_on.gif at position 6 of 11 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
(FilterChainProxy.java:337) - /resources/images/icons/connection_on.gif at position 7 of 11 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
(FilterChainProxy.java:337) - /resources/images/icons/connection_on.gif at position 8 of 11 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
(AnonymousAuthenticationFilter.java:107) - SecurityContextHolder not populated with anonymous token, as it already contained: 'org.springframework.security.authentication.UsernamePasswordAuthenticationToken#96cf68e: Principal: MyUserDetails [username=adrian.videanu, dn=org.springframework.ldap.core.DirContextAdapter: dn=cn=Adrian Videanu,ou=IT,ou=Organization .....
so the filters are invoked...
Updates
I can see that the session creation event is published because i have this line in logs :
(HttpSessionEventPublisher.java:66) - Publishing event: org.springframework.security.web.session.HttpSessionCreatedEvent[source=org.apache.catalina.session.StandardSessionFacade#3827a0aa]
but i never hit registerNewSession method from SessionRegistryImpl as I guess it should. Also the HttpSessionEventPublisher is invoked when I initially open the login page because I guess that`s when the session is created, but then after I enter the credentials and push submit HttpSessionEventPublisher is not invoked anymore.
Updates 2
As a test I have injected SessionRegistryImpl to one of my beans in order to try to access some of its methods:
#Named
#Scope("view")
public class UserDashboardMB implements Serializable {
private static final long serialVersionUID = 1L;
#Inject
private SessionRegistry sessionRegistry;
public void init(){
System.out.println("-- START INIT -- ");
List<Object> principals = sessionRegistry.getAllPrincipals();
System.out.println("Principals = "+principals);
for (Object p:principals){
System.out.println("Principal = "+p);
}
System.out.println("-- STOP INIT -- ");
}
}
and the output is :
INFO: -- START INIT --
INFO: Principals = []
INFO: -- STOP INIT --
so, nothing is populated there.
Update 3
I have replaced "sas" bean with the one provided by Serge but it still doesn`t seems to work. I have neabled the debugger again and I thing that the problem is that on class UsernamePasswordAuthenticationFilter at method doFilter() none of my requests are processed as it should.Here is a part of doFilter():
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) req;
HttpServletResponse response = (HttpServletResponse) res;
if (!requiresAuthentication(request, response)) {
chain.doFilter(request, response);
return;
}
if (logger.isDebugEnabled()) {
logger.debug("Request is to process authentication");
}
Authentication authResult;
// rest of method here
}
From what I see in the debugger my requests doesn't seems to require auth and chain.doFilter(request, response); is invoked.
Update 4
I guess i found the issue. The filter is not running as it should because the filterUrl param is not the proper one. As i read in the docs:
This filter by default responds to the URL /j_spring_security_check.
but my login part is implemented with JSF managed beans and actions. Now, my login form is at /public/login.xhtml and the url that the login info are posted is the same. If I set this as filterUrl I have problems because is called at the intial form rendering also and I have a infinite loop there as no user/password are set up.
Any idea how to overcome that ?
This is how my LoginManagedBean looks like:
#Named
#Scope("request")
public class LoginMB implements Serializable {
private static final long serialVersionUID = 1L;
#Autowired
#Qualifier("authManager")
private AuthenticationManager authenticationManager;
// setters and getters
public String login(){
FacesContext context = FacesContext.getCurrentInstance();
try {
Authentication request = new UsernamePasswordAuthenticationToken(this.getUsername(), this.getPassword());
Authentication result = authenticationManager.authenticate(request);
SecurityContextHolder.getContext().setAuthentication(result);
// perform some extra logic here and return protected page
return "/agent/dashboard.xhtml?faces-redirect=true";
} catch (AuthenticationException e) {
e.printStackTrace();
logger.error("Auth Exception ->"+e.getMessage());
FacesMessage fm = new FacesMessage("Invalid user/password");
fm.setSeverity(FacesMessage.SEVERITY_ERROR);
context.addMessage(null, fm);
}
return null;
}
}

Answer 1

There is a slight difference between spring security 3.1 and spring security 3.2 concerning concurrency session management.
The old ConcurrentSessionControlStrategy is now deprecated. It checked if the number of concurrent sessions was exceeded and registered sessions in a SessionRegistry for future use.
It has been partially replaced in 3.2 by ConcurrentSessionControlAuthenticationStrategy. It effectively controls if the number of concurrent sessions is exceeded but no longer registers new sessions (even if javadoc pretends to : I looked in the source code to understand it!)
The registration of sessions is now delegated to RegisterSessionAuthenticationStrategy! So for session concurrency to work, you have to use both. And the example in 3.2 reference manual, effectively uses for bean sas a CompositeSessionAuthenticationStrategy containing a ConcurrentSessionControlAuthenticationStrategy, a SessionFixationProtectionStrategy and a RegisterSessionAuthenticationStrategy!
For the whole thing to work, you just have to replace your sas bean with:
<bean id="sas" class="org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy">
<constructor-arg>
<list>
<bean class="org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy">
<constructor-arg ref="sessionRegistry"/>
<property name="maximumSessions" value="1" />
<property name="exceptionIfMaximumExceeded" value="true" />
</bean>
<bean class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy">
</bean>
<bean class="org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy">
<constructor-arg ref="sessionRegistry"/>
</bean>
</list>
</constructor-arg>
</bean>

Answer 2

I have finally managed to fix the issue. The problem was due to my mix setup between spring standard filters and custom jsf login form. I have left in my xml conf only the "sas" bean as Serge pointed out and the in my LoginMB I have manually and programmatically invoked the SessionAuthenticationStrategy onAuthentication() method. So now my LoginMB looks like:
#Named
#Scope("request")
public class LoginMB implements Serializable {
#Autowired
#Qualifier("authManager")
private AuthenticationManager authenticationManager;
#Inject
#Qualifier("sas")
private SessionAuthenticationStrategy sessionAuthenticationStrategy;
public String login(){
FacesContext context = FacesContext.getCurrentInstance();
try {
Authentication authRequest = new UsernamePasswordAuthenticationToken(this.getUsername(), this.getPassword());
Authentication result = authenticationManager.authenticate(authRequest);
SecurityContextHolder.getContext().setAuthentication(result);
HttpServletRequest httpReq = (HttpServletRequest)FacesContext.getCurrentInstance().getExternalContext().getRequest();
HttpServletResponse httpResp = (HttpServletResponse)FacesContext.getCurrentInstance().getExternalContext().getResponse();
sessionAuthenticationStrategy.onAuthentication(result, httpReq, httpResp);
// custom logic here
return "/agent/dashboard.xhtml?faces-redirect=true";
}catch(SessionAuthenticationException sae){
sae.printStackTrace();
logger.error("Auth Exception ->"+sae.getMessage());
String userMessage = "Session auth exception!";
if (sae.getMessage().compareTo("Maximum sessions of 1 for this principal exceeded") == 0){
userMessage = "Cannot login from more than 1 location.";
}
FacesMessage fm = new FacesMessage(userMessage);
fm.setSeverity(FacesMessage.SEVERITY_FATAL);
context.addMessage(null, fm);
}
catch (AuthenticationException e) {
e.printStackTrace();
logger.error("Auth Exception ->"+e.getMessage());
FacesMessage fm = new FacesMessage("Invalid user/password");
fm.setSeverity(FacesMessage.SEVERITY_FATAL);
context.addMessage(null, fm);
}
return null;
}
Now the sessions are registered and session limitation is working.