Support querying for sessions by user identifier

Fixes gh-7

samples/findbyusername/README.adoc

@@ -0,0 +1,4 @@
+Demonstrates using Spring Session to lookup a user's session by the username.
+The sample provides a hook to add the current username to the session (required for finding the user) by providing a custom implementation of Spring Security's `AuthenticationSuccessHandler`.
+
+NOTE: This product includes GeoLite2 data created by MaxMind, available from http://www.maxmind.com

samples/findbyusername/build.gradle

@@ -0,0 +1,54 @@
+buildscript {
+	repositories {
+		mavenCentral()
+	}
+	dependencies {
+		classpath("org.springframework.boot:spring-boot-gradle-plugin:$springBootVersion")
+	}
+}
+
+apply plugin: 'spring-boot'
+
+apply from: JAVA_GRADLE
+
+tasks.findByPath("artifactoryPublish")?.enabled = false
+
+group = 'samples'
+
+dependencies {
+	compile project(':spring-session'),
+			"org.springframework.boot:spring-boot-starter-redis",
+			"org.springframework.boot:spring-boot-starter-web",
+			"org.springframework.boot:spring-boot-starter-thymeleaf",
+			"nz.net.ultraq.thymeleaf:thymeleaf-layout-dialect",
+			"org.springframework.security:spring-security-web:$springSecurityVersion",
+			"org.springframework.security:spring-security-config:$springSecurityVersion",
+			"com.maxmind.geoip2:geoip2:2.3.1",
+			"org.apache.httpcomponents:httpclient:4.4.1"
+
+	testCompile "org.springframework.boot:spring-boot-starter-test",
+				'org.easytesting:fest-assert:1.4'
+
+	integrationTestCompile gebDependencies,
+			"org.spockframework:spock-spring:$spockVersion"
+
+}
+
+integrationTest {
+	doFirst {
+		def port = reservePort()
+
+		def host = 'localhost:' + port
+		systemProperties['geb.build.baseUrl'] = 'http://'+host+'/'
+		systemProperties['geb.build.reportsDir'] = 'build/geb-reports'
+		systemProperties['server.port'] = port
+		systemProperties['management.port'] = 0
+	}
+}
+
+def reservePort() {
+	def socket = new ServerSocket(0)
+	def result = socket.localPort
+	socket.close()
+	result
+}

samples/findbyusername/src/integration-test/groovy/sample/FindByUsernameTests.groovy

@@ -0,0 +1,104 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sample
+
+import geb.Browser
+import geb.spock.*
+
+import org.openqa.selenium.htmlunit.HtmlUnitDriver
+import org.springframework.boot.test.IntegrationTest
+import org.springframework.boot.test.SpringApplicationContextLoader
+import org.springframework.test.context.ContextConfiguration
+import org.springframework.test.context.web.WebAppConfiguration
+
+import pages.*
+import sample.pages.HomePage
+import sample.pages.LoginPage
+import spock.lang.Stepwise
+
+/**
+ * Tests findbyusername web application
+ *
+ * @author Rob Winch
+ */
+@Stepwise
+@ContextConfiguration(classes = FindByUsernameApplication, loader = SpringApplicationContextLoader)
+@WebAppConfiguration
+@IntegrationTest
+class FindByUsernameTests extends MultiBrowserGebSpec {
+	def 'Unauthenticated user sent to log in page'() {
+		given: 'unauthenticated user request protected page'
+		withBrowserSession a, {
+			via HomePage
+			then: 'sent to the log in page'
+			at LoginPage
+		}
+	}
+
+	def 'Log in views home page'() {
+		when: 'log in successfully'
+		a.login()
+		then: 'sent to original page'
+		a.at HomePage
+		and: 'the username is displayed'
+		a.username == 'user'
+		and: 'Spring Session Management is being used'
+		a.driver.manage().cookies.find { it.name == 'SESSION' }
+		and: 'Standard Session is NOT being used'
+		!a.driver.manage().cookies.find { it.name == 'JSESSIONID' }
+		and: 'Session id exists and terminate disabled'
+		a.sessionId
+		a.terminate(a.sessionId).@disabled
+	}
+
+	def 'Other Browser: Unauthenticated user sent to log in page'() {
+		given:
+		withBrowserSession b, {
+			via HomePage
+			then: 'sent to the log in page'
+			at LoginPage
+		}
+	}
+
+	def 'Other Browser: Log in views home page'() {
+		when: 'log in successfully'
+		b.login()
+		then: 'sent to original page'
+		b.at HomePage
+		and: 'the username is displayed'
+		b.username == 'user'
+		and: 'Spring Session Management is being used'
+		b.driver.manage().cookies.find { it.name == 'SESSION' }
+		and: 'Standard Session is NOT being used'
+		!b.driver.manage().cookies.find { it.name == 'JSESSIONID' }
+		and: 'Session id exists and terminate disabled'
+		b.sessionId
+		b.terminate(b.sessionId).@disabled
+	}
+
+	def 'Other Browser: Terminate Original'() {
+		setup: 'get the session id from browser a'
+		def sessionId = a.sessionId
+		when: 'we terminate browser a session'
+		b.terminate(sessionId).click(HomePage)
+		then: 'session is not listed'
+		!b.terminate(sessionId)
+		when: 'browser a visits home page after session was terminated'
+		a.via HomePage
+		then: 'browser a sent to log in'
+		a.at LoginPage
+	}
+}

samples/findbyusername/src/integration-test/groovy/sample/MultiBrowserGebSpec.groovy

@@ -0,0 +1,100 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sample;
+import geb.*
+import spock.lang.*
+
+/**
+ * https://github.com/kensiprell/geb-multibrowser
+ */
+abstract class MultiBrowserGebSpec extends Specification {
+    String gebConfEnv = null
+    String gebConfScript = null
+
+    // Map of geb browsers which can be referenced by name in the spec
+    // THese currently share the same config.  This is not a problem for
+    // my uses, but I can see potential for wanting to configure different
+    // browsers separately
+    @Shared _browsers = createBrowserMap()
+    def currentBrowser
+
+    def createBrowserMap() {
+        [:].withDefault { new Browser(createConf()) }
+    }
+
+    Configuration createConf() {
+        // Use the standard configured geb driver, but turn off cacheing so
+        // we can run multiple
+        def conf = new ConfigurationLoader(gebConfEnv).getConf(gebConfScript)
+        conf.cacheDriver = false
+        return conf
+    }
+
+    def withBrowserSession(browser, Closure c) {
+        currentBrowser = browser
+        def returnedValue = c.call()
+        currentBrowser = null
+        returnedValue
+    }
+
+    void resetBrowsers() {
+        _browsers.each { k, browser ->
+            if (browser.config?.autoClearCookies) {
+                browser.clearCookiesQuietly()
+            }
+            browser.quit()
+        }
+        _browsers = createBrowserMap()
+    }
+
+    def propertyMissing(String name) {
+        if(currentBrowser) {
+            return currentBrowser."$name"
+        } else {
+            return _browsers[name]
+        }
+    }
+
+    def methodMissing(String name, args) {
+        if(currentBrowser) {
+            return currentBrowser."$name"(*args)
+        } else {
+            def browser = _browsers[name]
+            if(args) {
+                return browser."${args[0]}"(*(args[1..-1]))
+            } else {
+                return browser
+            }
+        }
+    }
+
+    def propertyMissing(String name, value) {
+        if(!currentBrowser) throw new IllegalArgumentException("No context for setting property $name")
+        currentBrowser."$name" = value
+    }
+
+    private isSpecStepwise() {
+        this.class.getAnnotation(Stepwise) != null
+    }
+
+    def cleanup() {
+        if (!isSpecStepwise()) resetBrowsers()
+    }
+
+    def cleanupSpec() {
+        if (isSpecStepwise()) resetBrowsers()
+    }
+}

samples/findbyusername/src/integration-test/groovy/sample/pages/HomePage.groovy

@@ -0,0 +1,46 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sample.pages
+
+import geb.*
+
+/**
+ * The home page
+ *
+ * @author Rob Winch
+ */
+class HomePage extends Page {
+	static url = ''
+	static at = { assert driver.title == 'Spring Session Sample - Secured Content'; true}
+	static content = {
+		username { $('#un').text() }
+		logout(to:LoginPage) { $('input[type=submit]').click() }
+		sessions { moduleList AttributeRow, $("table tr").tail() }
+		terminate(required:false) { sessionId -> $("#terminate-$sessionId") }
+		sessionId { $("#session-id").text() }
+	}
+}
+
+class AttributeRow extends Module {
+	static content = {
+		cell { $("td", it) }
+		location { cell(0).text() }
+		created { cell(1).text() }
+		lastUpdated { cell(2).text() }
+		information { cell(3).text() }
+		terminate { cell(4).text() }
+	}
+}

samples/findbyusername/src/integration-test/groovy/sample/pages/LoginPage.groovy

@@ -0,0 +1,37 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sample.pages
+
+import geb.*
+
+/**
+ * The Links Page
+ *
+ * @author Rob Winch
+ */
+class LoginPage extends Page {
+	static url = '/login'
+	static at = { assert driver.title == 'Spring Session Sample - Log In'; true}
+	static content = {
+		form { $('form') }
+		submit { $('button[type=submit]') }
+		login(required:false) { user='user', pass='password' ->
+			form.username = user
+			form.password = pass
+			submit.click(HomePage)
+		}
+	}
+}

samples/findbyusername/src/main/java/sample/FindByUsernameApplication.java

@@ -0,0 +1,34 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package sample;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
+import org.springframework.context.annotation.ComponentScan;
+import org.springframework.context.annotation.Configuration;
+
+/**
+ * @author Rob Winch
+ */
+@Configuration
+@ComponentScan
+@EnableAutoConfiguration
+public class FindByUsernameApplication {
+
+	public static void main(String[] args) {
+		SpringApplication.run(FindByUsernameApplication.class, args);
+	}
+}

samples/findbyusername/src/main/java/sample/config/GeoConfig.java

@@ -0,0 +1,39 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sample.config;
+
+import java.io.InputStream;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+import com.maxmind.geoip2.DatabaseReader;
+
+/**
+ *
+ * @author Rob Winch
+ *
+ */
+@Configuration
+public class GeoConfig {
+
+	@Bean
+	public DatabaseReader geoDatabaseReader(@Value("classpath:GeoLite2-City.mmdb") InputStream geoInputStream) throws Exception {
+		return new DatabaseReader.Builder(geoInputStream).build();
+	}
+
+}

samples/findbyusername/src/main/java/sample/config/HttpSessionConfig.java

@@ -0,0 +1,28 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sample.config;
+
+import org.springframework.session.data.redis.config.annotation.web.http.EnableRedisHttpSession;
+
+/**
+ *
+ * @author Rob Winch
+ *
+ */
+// tag::class[]
+@EnableRedisHttpSession // <1>
+public class HttpSessionConfig { }
+// end::class[]

samples/findbyusername/src/main/java/sample/config/SecurityConfig.java

@@ -0,0 +1,74 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package sample.config;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
+
+import sample.session.CompositeAuthenticationSuccessHandler;
+import sample.session.SpringSessionPrincipalNameSuccessHandler;
+
+/**
+ * @author Rob Winch
+ */
+
+@EnableWebSecurity
+public class SecurityConfig extends WebSecurityConfigurerAdapter {
+
+	// tag::config[]
+	@Override
+	protected void configure(HttpSecurity http) throws Exception {
+		CompositeAuthenticationSuccessHandler successHandler = createHandler();
+
+		http
+			.formLogin()
+				.successHandler(successHandler)
+				.loginPage("/login")
+				.permitAll()
+				.and()
+			.authorizeRequests()
+				.antMatchers("/resources/**").permitAll()
+				.anyRequest().authenticated()
+				.and()
+			.logout()
+				.permitAll();
+	}
+	// end::config[]
+
+	// tag::handler[]
+	private CompositeAuthenticationSuccessHandler createHandler() {
+		SpringSessionPrincipalNameSuccessHandler setUsernameHandler =
+				new SpringSessionPrincipalNameSuccessHandler();
+		SavedRequestAwareAuthenticationSuccessHandler defaultHandler =
+				new SavedRequestAwareAuthenticationSuccessHandler();
+
+		CompositeAuthenticationSuccessHandler successHandler =
+				new CompositeAuthenticationSuccessHandler(setUsernameHandler, defaultHandler);
+		return successHandler;
+	}
+	// end::handler[]
+
+	@Autowired
+	public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
+		auth
+			.inMemoryAuthentication()
+				.withUser("user").password("password").roles("USER");
+	}
+}

samples/findbyusername/src/main/java/sample/mvc/IndexController.java

@@ -0,0 +1,61 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package sample.mvc;
+
+import java.security.Principal;
+import java.util.Collection;
+import java.util.Set;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.session.ExpiringSession;
+import org.springframework.session.FindByPrincipalNameSessionRepository;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+
+/**
+ * Controller for sending the user to the login view.
+ *
+ * @author Rob Winch
+ *
+ */
+@Controller
+public class IndexController {
+	// tag::findbyusername[]
+	@Autowired
+	FindByPrincipalNameSessionRepository<? extends ExpiringSession> sessions;
+
+	@RequestMapping("/")
+	public String index(Principal principal, Model model) {
+		Collection<? extends ExpiringSession> usersSessions =
+				sessions.findByPrincipalName(principal.getName()).values();
+		model.addAttribute("sessions", usersSessions);
+		return "index";
+	}
+	// end::findbyusername[]
+
+	@RequestMapping(value = "/sessions/{sessionIdToDelete}", method = RequestMethod.DELETE)
+	public String removeSession(Principal principal, @PathVariable String sessionIdToDelete) {
+		Set<String> usersSessionIds = sessions.findByPrincipalName(principal.getName()).keySet();
+		if(usersSessionIds.contains(sessionIdToDelete)) {
+			sessions.delete(sessionIdToDelete);
+		}
+
+		return "redirect:/";
+	}
+}

samples/findbyusername/src/main/java/sample/mvc/LoginController.java

@@ -0,0 +1,33 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sample.mvc;
+
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+/**
+ * Returns view for log in page
+ *
+ * @author Rob Winch
+ */
+@Controller
+public class LoginController {
+
+	@RequestMapping("/login")
+	public String login() {
+		return "login";
+	}
+}

samples/findbyusername/src/main/java/sample/session/CompositeAuthenticationSuccessHandler.java

@@ -0,0 +1,49 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sample.session;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.List;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.security.core.Authentication;
+import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
+
+/**
+ * @author Rob Winch
+ *
+ */
+// tag::class[]
+public class CompositeAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
+	private List<AuthenticationSuccessHandler> handlers;
+
+	public CompositeAuthenticationSuccessHandler(AuthenticationSuccessHandler... handlers) {
+		super();
+		this.handlers = Arrays.asList(handlers);
+	}
+
+	public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
+			Authentication authentication) throws IOException, ServletException {
+		for(AuthenticationSuccessHandler handler : handlers) {
+			handler.onAuthenticationSuccess(request, response, authentication);
+		}
+	}
+}
+// end::class[]

samples/findbyusername/src/main/java/sample/session/SessionDetails.java

@@ -0,0 +1,50 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sample.session;
+
+import java.io.Serializable;
+
+/**
+ * An example of how users can provide details about their session.
+ *
+ * @author Rob Winch
+ * @see SessionDetailsFilter
+ */
+// tag::class[]
+public class SessionDetails implements Serializable {
+	private String location;
+
+	private String accessType;
+
+	public String getLocation() {
+		return location;
+	}
+
+	public void setLocation(String location) {
+		this.location = location;
+	}
+
+	public String getAccessType() {
+		return accessType;
+	}
+
+	public void setAccessType(String accessType) {
+		this.accessType = accessType;
+	}
+
+	private static final long serialVersionUID = 8850489178248613501L;
+}
+// end::class[]

samples/findbyusername/src/main/java/sample/session/SessionDetailsFilter.java

@@ -0,0 +1,107 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sample.session;
+
+import java.io.IOException;
+import java.net.InetAddress;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.core.Ordered;
+import org.springframework.core.annotation.Order;
+import org.springframework.stereotype.Component;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import com.maxmind.geoip2.DatabaseReader;
+import com.maxmind.geoip2.model.CityResponse;
+
+/**
+ * Inserts the session details into the session for every request. Some users
+ * may prefer to insert session details only after authentication. This is fine,
+ * but it may be valuable to the most up to date information so that if someone
+ * stole the user's session id it can be observed.
+ *
+ * @author Rob Winch
+ *
+ */
+// tag::class[]
+@Component
+@Order(Ordered.HIGHEST_PRECEDENCE + 101)
+public class SessionDetailsFilter extends OncePerRequestFilter {
+	static final String UNKNOWN = "Unknown";
+
+	private DatabaseReader reader;
+
+	@Autowired
+	public SessionDetailsFilter(DatabaseReader reader) {
+		this.reader = reader;
+	}
+
+	// tag::dofilterinternal[]
+	public void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
+			throws IOException, ServletException {
+		chain.doFilter(request, response);
+
+		HttpSession session = request.getSession(false);
+		if (session != null) {
+			String remoteAddr = getRemoteAddress(request);
+			String geoLocation = getGeoLocation(remoteAddr);
+
+			SessionDetails details = new SessionDetails();
+			details.setAccessType(request.getHeader("User-Agent"));
+			details.setLocation(remoteAddr + " " + geoLocation);
+
+			session.setAttribute("SESSION_DETAILS", details);
+		}
+	}
+	// end::dofilterinternal[]
+
+	String getGeoLocation(String remoteAddr) {
+		try {
+			CityResponse city = reader.city(InetAddress.getByName(remoteAddr));
+			String cityName = city.getCity().getName();
+			String countryName = city.getCountry().getName();
+			if(cityName == null && countryName == null) {
+				return null;
+			} else if(cityName == null) {
+				return countryName;
+			} else if(countryName == null) {
+				return cityName;
+			}
+			return cityName + ", " + countryName;
+		} catch (Exception e) {
+			return UNKNOWN;
+
+		}
+	}
+
+	private String getRemoteAddress(HttpServletRequest request) {
+		String remoteAddr = request.getHeader("X-FORWARDED-FOR");
+		if (remoteAddr == null) {
+			remoteAddr = request.getRemoteAddr();
+		} else if (remoteAddr.contains(",")) {
+			remoteAddr = remoteAddr.split(",")[0];
+		}
+		return remoteAddr;
+	}
+}
+//end::class[]
+

samples/findbyusername/src/main/java/sample/session/SpringSessionPrincipalNameSuccessHandler.java

@@ -0,0 +1,52 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sample.session;
+
+import java.io.IOException;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+
+import org.springframework.security.core.Authentication;
+import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
+import org.springframework.session.FindByPrincipalNameSessionRepository;
+import org.springframework.session.Session;
+
+/**
+ * Inserts the username into Spring session after we successfully authenticate.
+ * Adding the principal name to the session is a requirement of
+ * {@link FindByPrincipalNameSessionRepository}
+ *
+ * @author Rob Winch
+ */
+// tag::class[]
+public class SpringSessionPrincipalNameSuccessHandler
+		implements AuthenticationSuccessHandler {
+
+	public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
+			Authentication authentication) throws IOException, ServletException {
+
+		HttpSession session = request.getSession();
+		String currentUsername = authentication.getName();
+
+		// tag::set-username[]
+		session.setAttribute(Session.PRINCIPAL_NAME_ATTRIBUTE_NAME, currentUsername);
+		// end::set-username[]
+	}
+}
+// end::class[]

samples/findbyusername/src/main/resources/application.properties

@@ -0,0 +1,2 @@
+spring.thymeleaf.cache=false
+spring.template.cache=false

samples/findbyusername/src/main/resources/templates/index.html

@@ -0,0 +1,36 @@
+<html xmlns:th="http://www.thymeleaf.org" xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout" layout:decorator="layout">
+<head>
+	<title>Secured Content</title>
+</head>
+<body>
+	<div layout:fragment="content">
+		<h1>Secured Page</h1>
+		<p>This page is secured using Spring Boot, Spring Session, and Spring Security.</p>
+
+		<p>Your current session id is <span id="session-id" th:text="${#httpSession.id}"></span></p>
+
+		<table class="table table-stripped">
+			<tr>
+				<th>Id Suffix</th>
+				<th>Location</th>
+				<th>Created</th>
+				<th>Last Updated</th>
+				<th>Information</th>
+				<th>Terminate</th>
+			</tr>
+			<tr th:each="session : ${sessions}" th:with="details=${session.getAttribute('SESSION_DETAILS')}">
+				<td th:text="${session.id.substring(30)}"></td>
+				<td th:text="${details.location}"></td>
+				<td th:text="${#dates.format(new java.util.Date(session.creationTime),'dd/MMM/yyyy HH:mm:ss')}"></td>
+				<td th:text="${#dates.format(new java.util.Date(session.lastAccessedTime),'dd/MMM/yyyy HH:mm:ss')}"></td>
+				<td th:text="${details.accessType}"></td>
+				<td>
+					<form th:action="@{'/sessions/' + ${session.id}}" th:method="delete">
+						<input th:id="'terminate-' + ${session.id}" type="submit" value="Terminate" th:disabled="${session.id == #httpSession.id}"/>
+					</form>
+				</td>
+			</tr>
+		</table>
+	</div>
+</body>
+</html>

samples/findbyusername/src/main/resources/templates/layout.html

@@ -0,0 +1,122 @@
+<!DOCTYPE html SYSTEM "http://www.thymeleaf.org/dtd/xhtml1-strict-thymeleaf-spring4-3.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml"
+			xmlns:th="http://www.thymeleaf.org"
+			xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout">
+	<head>
+		<title layout:title-pattern="$DECORATOR_TITLE - $CONTENT_TITLE">Spring Session Sample</title>
+		<link rel="icon" type="image/x-icon" th:href="@{/resources/img/favicon.ico}" href="../static/img/favicon.ico"/>
+		<link th:href="@{/resources/css/bootstrap.css}" href="../static/css/bootstrap.css" rel="stylesheet"></link>
+		<style type="text/css">
+			/* Sticky footer styles
+			-------------------------------------------------- */
+
+			html,
+			body {
+				height: 100%;
+				/* The html and body elements cannot have any padding or margin. */
+			}
+
+			/* Wrapper for page content to push down footer */
+			#wrap {
+				min-height: 100%;
+				height: auto !important;
+				height: 100%;
+				/* Negative indent footer by it's height */
+				margin: 0 auto -60px;
+			}
+
+			/* Set the fixed height of the footer here */
+			#push,
+			#footer {
+				height: 60px;
+			}
+			#footer {
+				background-color: #f5f5f5;
+			}
+
+			/* Lastly, apply responsive CSS fixes as necessary */
+			@media (max-width: 767px) {
+				#footer {
+					margin-left: -20px;
+					margin-right: -20px;
+					padding-left: 20px;
+					padding-right: 20px;
+				}
+			}
+
+
+
+			/* Custom page CSS
+			-------------------------------------------------- */
+			/* Not required for template or sticky footer method. */
+
+			.container {
+				width: auto;
+				max-width: 680px;
+			}
+			.container .credit {
+				margin: 20px 0;
+				text-align: center;
+			}
+			a {
+					color: green;
+			}
+			.navbar-form {
+				margin-left: 1em;
+			}
+		</style>
+		<link th:href="@{resources/css/bootstrap-responsive.css}" href="/static/css/bootstrap-responsive.css" rel="stylesheet"></link>
+
+		<!-- HTML5 shim, for IE6-8 support of HTML5 elements -->
+		<!--[if lt IE 9]>
+			<script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
+		<![endif]-->
+	</head>
+
+
+	<body>
+		<div id="wrap">
+			<div class="navbar navbar-inverse navbar-static-top">
+				<div class="navbar-inner">
+					<div class="container">
+						<a class="brand" th:href="@{/}"><img th:src="@{/resources/img/logo.png}" alt="Spring Security Sample"/></a>
+
+<div class="nav-collapse collapse"
+		 th:with="currentUser=${#httpServletRequest.userPrincipal?.principal}">
+	<div th:if="${currentUser != null}">
+			<form class="navbar-form pull-right" th:action="@{/logout}" method="post">
+					<input type="submit" value="Log out" />
+			</form>
+			<p id="un" class="navbar-text pull-right" th:text="${currentUser.username}">
+				sample_user
+			</p>
+	</div>
+	<ul class="nav">
+	</ul>
+</div>
+
+				</div>
+			</div>
+		</div>
+			<!-- Begin page content -->
+			<div class="container">
+				<div class="alert alert-success"
+							th:if="${globalMessage}"
+							th:text="${globalMessage}">
+						Some Success message
+				</div>
+				<div layout:fragment="content">
+						Fake content
+				</div>
+			</div>
+
+			<div id="push"><!--  --></div>
+		</div>
+
+		<div id="footer">
+			<div class="container">
+				<p class="muted credit">This product includes GeoLite2 data created by MaxMind, available from <a href="http://www.maxmind.com">http://www.maxmind.com</a>.</p>
+			</div>
+		</div>
+	</body>
+</html>

samples/findbyusername/src/main/resources/templates/login.html

@@ -0,0 +1,47 @@
+<html xmlns:th="http://www.thymeleaf.org"
+	xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout"
+	layout:decorator="layout">
+<head>
+<title>Log In</title>
+</head>
+<body>
+	<div layout:fragment="content">
+		<form name="f" th:action="@{/login}" method="post">
+			<fieldset>
+				<legend>Please Login</legend>
+				<div th:if="${param.error}" class="alert alert-error">Invalid
+					username and password.</div>
+				<div th:if="${param.logout}" class="alert alert-success">You
+					have been logged out.</div>
+				<label for="username">Username</label> <input type="text"
+					id="username" name="username" /> <label for="password">Password</label>
+				<input type="password" id="password" name="password" />
+				<div class="form-actions">
+					<button type="submit" class="btn">Log in</button>
+				</div>
+			</fieldset>
+		</form>
+
+		<div class="container">
+			<p>The intention is to demo a way to terminate a user's active
+				session without access to the device. Consider the following</p>
+			<ul>
+				<li>User goes to library and authenticates to the application</li>
+				<li>User goes home and realizes they forgot to log out</li>
+				<li>User can log in and terminate the session from the library
+					using clues like the location, created time, last accessed time,
+					etc.</li>
+			</ul>
+
+			<p>To emulate the workflow:</p>
+
+			<ul>
+				<li>Sign in with the <b>username</b> "user" and <b>password</b> "password"</li>
+				<li>Sign in again using an incognito window</li>
+				<li>Terminate your original session</li>
+				<li>Refresh the original window and see you are logged out</li>
+			</ul>
+		</div>
+	</div>
+</body>
+</html>

samples/findbyusername/src/test/java/sample/session/SessionDetailsFilterTests.java

@@ -0,0 +1,62 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sample.session;
+
+import static org.fest.assertions.Assertions.*;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.test.context.ContextConfiguration;
+import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
+
+import com.maxmind.geoip2.DatabaseReader;
+
+import sample.config.GeoConfig;
+
+/**
+ * @author Rob Winch
+ *
+ */
+@RunWith(SpringJUnit4ClassRunner.class)
+@ContextConfiguration(classes = GeoConfig.class)
+public class SessionDetailsFilterTests {
+	@Autowired
+	DatabaseReader reader;
+
+	SessionDetailsFilter filter;
+
+	@Before
+	public void setup() {
+		filter = new SessionDetailsFilter(reader);
+	}
+
+	@Test
+	public void getGeoLocationHanldesInvalidIp() {
+		assertThat(filter.getGeoLocation("a")).isEqualTo(SessionDetailsFilter.UNKNOWN);
+	}
+
+	@Test
+	public void getGeoLocationNullCity() {
+		assertThat(filter.getGeoLocation("22.231.113.64")).isEqualTo("United States");
+	}
+
+	@Test
+	public void getGeoLocationBoth() {
+		assertThat(filter.getGeoLocation("184.154.83.119")).isEqualTo("Chicago, United States");
+	}
+}