how to create logout session in spring? - spring

Question

1).I am new to spring technology.so I am starting with login and log out webapp.
2).I have created login page in jsp also I have added web.xml and spring-servlet.xml.
Now.If I wants to invalidate session for the user how should I do that and where changes should occure,please help me with this...I am posting login controller and all pages.
controller:
#Controller
public class AdminLoginController extends AbstractController
{
static Logger log = Logger.getLogger(AdminLoginController.class.getName());
#RequestMapping(value = "/loginForm", method ={RequestMethod.GET,RequestMethod.POST})
public ModelAndView showForm(ModelMap model)
{
AdminLoginForm loginForm = new AdminLoginForm();
model.put("loginForm", loginForm);
log.info("Inside Controller returning to loginform page....");
return new ModelAndView( GlobalConstants.LOGIN_PAGE);
}
#RequestMapping(value = "/login" ,method ={RequestMethod.POST, RequestMethod.GET})
public ModelAndView processForm(#ModelAttribute("loginForm")AdminLoginForm loginForm, BindingResult result , HttpServletRequest request, HttpServletResponse response, ModelMap model)
{
try{
loginForm = (AdminLoginForm) model.get("loginForm");
String returnPage="";
model=super.execute(model);
if(result.hasErrors()){
return new ModelAndView(GlobalConstants.ERRORPAGE);
}
AdminLoginWorker worker=new AdminLoginWorker();
boolean status=worker.validateUser(loginForm);
if(status)
{
model.addObject("request", request);
HttpSession session=super.getSession(model);
CommonDTOBean dtoBean=(CommonDTOBean)session.getAttribute("dtoBean");
if("Admin".equalsIgnoreCase(loginForm.getUserType())){
dtoBean.setEmp_id(loginForm.getUserName());
dtoBean.setEmpType("Admin");
session.setAttribute("dtoBean", dtoBean);
return new ModelAndView(GlobalConstants.HOME_PAGE);
}else{
dtoBean.setEmp_id(loginForm.getUserName());
dtoBean.setEmpType("Employee");
session.setAttribute("dtoBean", dtoBean);
return new ModelAndView(GlobalConstants.EMP_HOME_PAGE);
}
}
else
{
return new ModelAndView(GlobalConstants.LOGIN_PAGE);
}
}catch(Exception e){
e.printStackTrace();
}
return new ModelAndView(GlobalConstants.LOGIN_PAGE);
}
and spring-servlet.xml is:
<context:component-scan base-package="com.portal.controller" />
<bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
<property name="prefix" value="/jsp/" />
<property name="suffix" value=".jsp" />
</bean>
<bean id="messageSource" class="org.springframework.context.support.ReloadableResourceBundleMessageSource">
<property name="basename" value="classpath:messages"/>
<property name="defaultEncoding" value="UTF-8"/>
</bean>
<bean id="localeChangeInterceptor"
class="org.springframework.web.servlet.i18n.LocaleChangeInterceptor">
<property name="paramName" value="lang" />
</bean>
<bean id="localeResolver"
class="org.springframework.web.servlet.i18n.CookieLocaleResolver">
<property name="defaultLocale" value="en"/>
</bean>
<bean id="handlerMapping"
class="org.springframework.web.servlet.mvc.annotation.DefaultAnnotationHandlerMapping">
<property name="interceptors">
<ref bean="localeChangeInterceptor" />
</property>
</bean>
</beans>
1.Is it necessary to create securityContentxt.xml for logout.
2.The above controller class extends the some abstract class which validates whether the session is empty or not.
Please help me with this and I have gone through the http://docs.spring.io/spring-security/site/docs/3.0.x/reference/ns-config.html#ns-session-mgmt site but did not understand.
I have tried the solution I got from here but could not work out.I havge configured the spring-security.xml:
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.0.xsd">
<http auto-config="true">
<intercept-url pattern="/loginPage" access="IS_AUTHENTICATED_ANONYMOUSLY" />
<logout logout-success-url="/errorPage" logout-url="//errorPage"/>
<session-management invalid-session-url="/home?invalid=true" />
</http>
and I have added the the following code in web.xml:
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>*.do</url-pattern>
</filter-mapping>
And then I am getting this error:
java.lang.IllegalStateException: No WebApplicationContext found: no ContextLoaderListener registered?
org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:251)
can any one tell whts wrong with this?

Answer 1

For the logout a simple link like
Logout
should be enough to launch the logout controller.
About the rest of your question I don't really understand if the login part is working and you just neededed the logout or if you need help on the whole system. Once the login works and you have your user correctly stored in session, there's nothing else you have to do, Spring security manages everything. If you need additional help, provide more informations and I'll be glad to help!
Cheers

Answer 2

in your jsp this works :
Logout
or if you need to do it from another source, programitcally in java
SecurityContextHolder.clearContext();
and remove session :
HttpSession session = request.getSession(false);
if (session != null) {
session.invalidate();
}