Spring maximum number of sessions; limit the maximum number of users

Question

Can I find out if it is possible to use spring protection to limit the maximum number of users who can simultaneously log in to the site?

Definitely, not a concurrent session management option. what I want, for example, I want to limit the maximum, allow only 1000 users at a time. if more than above, to notice that the page with maximum users exceeded

Answer 1

You can use Spring concurrent security session control by contacting SessionRegistry to find out how many users are currently logged in. In Spring Security 3, ConcurrentSessionControlStrategy is responsible for controlling whether the user is allowed to create a session after logging in. You can expand this class and add additional verification depending on the number of users:

public class MySessionAuthenticationStrategy extends ConcurrentSessionControlStrategy { int MAX_USERS = 1000; // Whatever SessionRegistry sr; public MySessionAuthenticationStrategy(SessionRegistry sr) { super(sr); this.sr = sr; } @Override public void onAuthentication(Authentication authentication, HttpServletRequest request, HttpServletResponse response) { if (sr.getAllPrincipals().size() > MAX_USERS) { throw new SessionAuthenticationException("Maximum number of users exceeded"); } super.onAuthentication(authentication, request, response); } } 

You then enter this into the security namespace, as described in the Spring Security Reference Guide .

In Spring Security 2.0, concurrent session control is slightly different, and you should configure ConcurrentSessionController instead.

Answer 2

I do not have enough reputation to add a comment. But getAllPrincipals returns all participants, including from expired sessions. Use the method as shown below for getAllActiveSessions.

 private List<SessionInformation> getActiveSessions(SessionRegistry sessionRegistry) { final List<Object> principals = sessionRegistry.getAllPrincipals(); if (principals != null) { List<SessionInformation> sessions = new ArrayList<>(); for (Object principal : principals) { sessions.addAll(sessionRegistry.getAllSessions(principal, false)); } return sessions; } return Collections.emptyList(); } 

Answer 3

this post is a little old, but I had the same problem in spring security 4.1, and I solved it like that.

management session

 <security:http disable-url-rewriting="true" use-expressions="true" auto-config="true"> <security:session-management invalid-session-url="/app/login" session-authentication-strategy-ref="sessionAuthenticationStrategy"> </security:session-management> </security:http> 

authentication session strategy-ref

 <bean id="sessionAuthenticationStrategy" class="org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy"> <constructor-arg> <list> <bean class="org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy"> <constructor-arg ref="sessionRegistry"/> <property name="maximumSessions" value="1" /> <property name="exceptionIfMaximumExceeded" value="true" /> </bean> <bean class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy"> </bean> <bean class="org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy"> <constructor-arg ref="sessionRegistry"/> </bean> </list> </constructor-arg> </bean> 

Session session

 @Autowired private SessionRegistry sessionRegistry; 

Authentication

 List<SessionInformation> sessions = new ArrayList<>(); for (Object principal : sessionRegistry.getAllPrincipals()) { sessions.addAll(sessionRegistry.getAllSessions(principal, false)); } LOGGER.info("Sessiones Activas: " + sessions.size()); // filtro para limite de sessiones if (sessions.size() < max_sessions) { //authentication } else { throw new SessionAuthenticationException("Maximo numero de Usuarios exedido."); } 

this way because I authenticate based on security: custom-filter