From 5d26ab4df4bea79f8c829c8d11157107862a3b32 Mon Sep 17 00:00:00 2001
From: Vedran Pavic <vedran.pavic@gmail.com>
Date: Fri, 9 Aug 2019 21:47:21 +0200
Subject: [PATCH] Add support for AuthenticatedPrincipal in
 SpringSessionBackedSessionRegistry

Resolves: #1488
---
 .../SpringSessionBackedSessionRegistry.java   | 12 +---
 ...pringSessionBackedSessionRegistryTest.java | 56 ++++++++++++++++++-
 2 files changed, 57 insertions(+), 11 deletions(-)

diff --git a/spring-session-core/src/main/java/org/springframework/session/security/SpringSessionBackedSessionRegistry.java b/spring-session-core/src/main/java/org/springframework/session/security/SpringSessionBackedSessionRegistry.java
index f999cb6b..cfb7acdb 100644
--- a/spring-session-core/src/main/java/org/springframework/session/security/SpringSessionBackedSessionRegistry.java
+++ b/spring-session-core/src/main/java/org/springframework/session/security/SpringSessionBackedSessionRegistry.java
@@ -16,14 +16,13 @@
 
 package org.springframework.session.security;
 
-import java.security.Principal;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
 
+import org.springframework.security.authentication.TestingAuthenticationToken;
 import org.springframework.security.core.session.SessionInformation;
 import org.springframework.security.core.session.SessionRegistry;
-import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.session.FindByIndexNameSessionRepository;
 import org.springframework.session.Session;
 import org.springframework.util.Assert;
@@ -110,13 +109,8 @@ public class SpringSessionBackedSessionRegistry<S extends Session> implements Se
 	 * could be derived
 	 */
 	protected String name(Object principal) {
-		if (principal instanceof UserDetails) {
-			return ((UserDetails) principal).getUsername();
-		}
-		if (principal instanceof Principal) {
-			return ((Principal) principal).getName();
-		}
-		return principal.toString();
+		// We are reusing the logic from AbstractAuthenticationToken#getName
+		return new TestingAuthenticationToken(principal, null).getName();
 	}
 
 }
diff --git a/spring-session-core/src/test/java/org/springframework/session/security/SpringSessionBackedSessionRegistryTest.java b/spring-session-core/src/test/java/org/springframework/session/security/SpringSessionBackedSessionRegistryTest.java
index 255e03a4..0c694568 100644
--- a/spring-session-core/src/test/java/org/springframework/session/security/SpringSessionBackedSessionRegistryTest.java
+++ b/spring-session-core/src/test/java/org/springframework/session/security/SpringSessionBackedSessionRegistryTest.java
@@ -16,6 +16,7 @@
 
 package org.springframework.session.security;
 
+import java.security.Principal;
 import java.time.Instant;
 import java.time.temporal.ChronoUnit;
 import java.util.Collections;
@@ -30,6 +31,7 @@ import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.MockitoAnnotations;
 
+import org.springframework.security.core.AuthenticatedPrincipal;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextImpl;
 import org.springframework.security.core.session.SessionInformation;
@@ -104,11 +106,25 @@ class SpringSessionBackedSessionRegistryTest {
 	}
 
 	@Test
-	void getAllSessions() {
+	void getAllSessionsForUserDetails() {
 		setUpSessions();
-
 		List<SessionInformation> allSessionInfos = this.sessionRegistry.getAllSessions(PRINCIPAL, true);
+		assertThat(allSessionInfos).extracting("sessionId").containsExactly(SESSION_ID, SESSION_ID2);
+	}
 
+	@Test
+	void getAllSessionsForAuthenticatedPrincipal() {
+		setUpSessions();
+		List<SessionInformation> allSessionInfos = this.sessionRegistry
+				.getAllSessions((AuthenticatedPrincipal) () -> USER_NAME, true);
+		assertThat(allSessionInfos).extracting("sessionId").containsExactly(SESSION_ID, SESSION_ID2);
+	}
+
+	@Test
+	void getAllSessionsForPrincipal() {
+		setUpSessions();
+		List<SessionInformation> allSessionInfos = this.sessionRegistry.getAllSessions(new TestPrincipal(USER_NAME),
+				true);
 		assertThat(allSessionInfos).extracting("sessionId").containsExactly(SESSION_ID, SESSION_ID2);
 	}
 
@@ -159,4 +175,40 @@ class SpringSessionBackedSessionRegistryTest {
 		when(this.sessionRepository.findByPrincipalName(USER_NAME)).thenReturn(sessions);
 	}
 
+	private static final class TestPrincipal implements Principal {
+
+		private final String name;
+
+		private TestPrincipal(String name) {
+			this.name = name;
+		}
+
+		@Override
+		public String getName() {
+			return this.name;
+		}
+
+		@Override
+		public boolean equals(Object another) {
+			if (this == another) {
+				return true;
+			}
+			if (another instanceof TestPrincipal) {
+				return this.name.equals(((TestPrincipal) another).name);
+			}
+			return false;
+		}
+
+		@Override
+		public int hashCode() {
+			return this.name.hashCode();
+		}
+
+		@Override
+		public String toString() {
+			return this.name;
+		}
+
+	}
+
 }