Spring安全性:添加"成功登录事件监听器"

Question

我是Spring Security的新手.如何添加将在用户成功登录时调用的事件侦听器？此外,我需要在此侦听器中获取某种唯一的会话ID,该ID应该可以进一步使用.我需要此ID与另一台服务器同步.

Answer 1

您需要定义一个实现ApplicationListener的Spring Bean .

然后,在您的代码中,执行以下操作:

public void onApplicationEvent(ApplicationEvent appEvent)
{
    if (appEvent instanceof AuthenticationSuccessEvent)
    {
        AuthenticationSuccessEvent event = (AuthenticationSuccessEvent) appEvent;
        UserDetails userDetails = (UserDetails) event.getAuthentication().getPrincipal();

        // ....
    }
}

然后,在applicationContext.xml文件中,只需定义该bean,它就会自动开始接收事件:)

Answer 2

AuthenticationSuccessEvent的问题是它不会在remember-me登录时发布.如果您使用的是remember-me身份验证,请使用InteractiveAuthenticationSuccessEvent,它适用于正常登录以及记住我的登录.

@Component
public class LoginListener implements ApplicationListener<InteractiveAuthenticationSuccessEvent> {

    @Override
    public void onApplicationEvent(InteractiveAuthenticationSuccessEvent event)
    {
        UserDetails userDetails = (UserDetails) event.getAuthentication().getPrincipal();
        // ...
    }
}

Answer 3

与Phill的答案类似,但经过修改以考虑Generics:

public class AuthenticationListener implements ApplicationListener<AuthenticationSuccessEvent> {

  @Override
  public void onApplicationEvent(final AuthenticationSuccessEvent event) {

      // ...

  }

}

Answer 4

在Grails中,使用Spring Security Plugin,您可以在Config.groovy中执行此操作:

grails.plugins.springsecurity.useSecurityEventListener = true

grails.plugins.springsecurity.onAuthenticationSuccessEvent = { e, appCtx ->

        def session = SecurityRequestHolder.request.getSession(false)
        session.myVar = true

}

Answer 5

另一种使用方式 @EventListener

@EventListener
public void doSomething(InteractiveAuthenticationSuccessEvent event) { // any spring event
    // your code 

}