{"id":16220,"date":"2014-12-04T14:42:46","date_gmt":"2014-12-04T09:12:46","guid":{"rendered":"http:\/\/www.tothenew.com\/blog\/?p=16220"},"modified":"2016-12-19T14:54:46","modified_gmt":"2016-12-19T09:24:46","slug":"restricting-concurrent-sessions-for-a-single-user-using-grails-and-spring-security","status":"publish","type":"post","link":"https:\/\/www.tothenew.com\/blog\/restricting-concurrent-sessions-for-a-single-user-using-grails-and-spring-security\/","title":{"rendered":"Restricting concurrent sessions for a single user using Grails and Spring Security"},"content":{"rendered":"

Restricting concurrent sessions for a single user is a very common requirement for any software tool which requires licensing based on number of users.<\/p>\n

You can read about how we can manage (or allow) concurrent sessions with Grails 2 using Spring security plugin in this awesome concise blog here.<\/p>\n

let us see how we can allow or restrict the concurrent sessions for the different users i.e. restricting the concurrent sessions for the some users and allowing multiple sessions for a specific set of users.<\/p>\n

In our application, we have \u2018Executive Users\u2019 and \u2018Administrator\u2019 where the \u2018Executive Users\u2019 can not have concurrent sessions but the \u2018Administrators\u2019 can have multiple concurrent sessions i.e. they can login simultaneously from different clients\/devices with the same username.<\/p>\n

In order to achieve this (restriction and allowing of concurrent sessions for different sets of users), we need to do the following steps:<\/p>\n

    \n
  1. \n

    First off we have to extend the org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy<\/span> class and override the getMaximumSessionsForThisUser()<\/span> method<\/p>\n

    [java]
    \n import org.springframework.security.core.session.SessionRegistry
    \n import org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy<\/p>\n

    class MyConcurrentSessionControlStrategy extends ConcurrentSessionControlStrategy {<\/p>\n

    MyConcurrentSessionControlStrategy(SessionRegistry sessionRegistry) {
    \n super(sessionRegistry)
    \n }<\/p>\n

    protected int getMaximumSessionsForThisUser(org.springframework.security.core.Authentication authentication) {
    \n Long maximumSession = 1
    \n if (Role.ROLE_ADMIN in authentication.authorities*.authority) {
    \n maximumSession = -1
    \n }
    \n return maximumSession;
    \n }
    \n }
    \n [\/java]<\/p>\n

    Here, we are giving infinite concurrent sessions to the users with role \u2018Administrators\u2019 whereas all the other users can have only one session. The values given to the maximumSession can be:<\/p>\n

    -1 for infinite session,
    \n +ve \u2018n\u2019 value for \u2018n\u2019 number of sessions allowed; the value 0 is not allowed.<\/li>\n

  2. \n

    Update resources.groovy to include your own version of ConcurrentSessionControlStrategy class i.e. MyConcurrentSessionControlStrategy:<\/p>\n<\/li>\n<\/ol>\n

    [java]<\/p>\n

    import org.springframework.security.core.session.SessionRegistryImpl
    \nimport org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy
    \nimport org.springframework.security.web.session.ConcurrentSessionFilter<\/p>\n

    beans = {
    \n sessionRegistry(SessionRegistryImpl)<\/p>\n

    concurrencyFilter(ConcurrentSessionFilter) {
    \n sessionRegistry = sessionRegistry
    \n logoutHandlers = [ref("rememberMeServices"), ref("securityContextLogoutHandler")]
    \n expiredUrl = ‘\/login\/concurrentSession’
    \n }<\/p>\n

    concurrentSessionControlStrategy(MyConcurrentSessionControlStrategy, sessionRegistry) {
    \n alwaysCreateSession = true
    \n exceptionIfMaximumExceeded = false
    \n maximumSessions = 1
    \n }
    \n}<\/p>\n

    [\/java]<\/p>\n

     <\/p>\n

    Lets take a look on the beans that we are injecting<\/p>\n

      \n
    1. \n

      sessionRegistry: We must use the SessionRegistryImpl provided by Spring security plugin.<\/p>\n<\/li>\n

    2. \n

      concurrencyFilter:<\/p>\n

        \n
      1. \n

        sessionRegistry: Setting sessionRegistry bean to use overridden implementation to ensure that every registered session\u2019s \u201clast updated\u201d time is always correct and check if the session is expired then call the configured logout handlers.<\/p>\n<\/li>\n

      2. \n

        logoutHandlers: Updating logout handlers with rememberMeServices and securityContextLogoutHandler – By default only securityContextLogoutHandler is registered. But we also need to add rememberMeServices bean to ensure that \u201cremember me cookie\u201d is also expired if user concurrent session exceeds the maximumSession otherwise this cookie creates a new session and invalidate the other one.<\/p>\n<\/li>\n

      3. \n

        expiredUrl: This field is used to redirect the user to this url if the number of active sessions for this user exceeds the maximum allowed limit.<\/p>\n<\/li>\n<\/ol>\n<\/li>\n

      4. \n

        concurrentSessionControlStrategy:<\/p>\n

          \n
        1. \n

          alwaysCreateSession: Set the value of this field to true in order to allow concurrent sessions.<\/p>\n<\/li>\n

        2. \n

          exceptionIfMaximumExceeded:<\/p>\n

            \n
          1. \n

            Set it to \u201ctrue\u201d to invalidate the new session that we are creating if the concurrent sessions exceed the maximumSession.<\/p>\n<\/li>\n

          2. \n

            Set it to \u201cfalse\u201d to invalidate the oldest session that was created for the user if the concurrent sessions exceed the maximumSession.<\/p>\n<\/li>\n<\/ol>\n<\/li>\n

          3. \n

            maximumSession: Set the maximum concurrent sessions allowed for a user.<\/p>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

             <\/p>\n

            By doing this, Spring security will restrict the concurrent logins for the users and also ensure that users with the specific role only can have multiple sessions.<\/p>\n

            Hope this helps !!!<\/p>\n","protected":false},"excerpt":{"rendered":"

            Restricting concurrent sessions for a single user is a very common requirement for any software tool which requires licensing based on number of users. You can read about how we can manage (or allow) concurrent sessions with Grails 2 using Spring security plugin in this awesome concise blog here. let us see how we can […]<\/p>\n","protected":false},"author":103,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":47,"footnotes":""},"categories":[7],"tags":[1560,4840,108,878,4841,672],"class_list":["post-16220","post","type-post","status-publish","format-standard","hentry","category-grails","tag-concurrent-session","tag-grails","tag-session","tag-login","tag-spring","tag-spring-security"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t