Support querying for sessions by user identifier

Fixes gh-7

samples/findbyusername/src/main/java/sample/FindByUsernameApplication.java

@@ -0,0 +1,34 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package sample;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
+import org.springframework.context.annotation.ComponentScan;
+import org.springframework.context.annotation.Configuration;
+
+/**
+ * @author Rob Winch
+ */
+@Configuration
+@ComponentScan
+@EnableAutoConfiguration
+public class FindByUsernameApplication {
+
+	public static void main(String[] args) {
+		SpringApplication.run(FindByUsernameApplication.class, args);
+	}
+}

samples/findbyusername/src/main/java/sample/config/GeoConfig.java

@@ -0,0 +1,39 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sample.config;
+
+import java.io.InputStream;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+import com.maxmind.geoip2.DatabaseReader;
+
+/**
+ *
+ * @author Rob Winch
+ *
+ */
+@Configuration
+public class GeoConfig {
+
+	@Bean
+	public DatabaseReader geoDatabaseReader(@Value("classpath:GeoLite2-City.mmdb") InputStream geoInputStream) throws Exception {
+		return new DatabaseReader.Builder(geoInputStream).build();
+	}
+
+}

samples/findbyusername/src/main/java/sample/config/HttpSessionConfig.java

@@ -0,0 +1,28 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sample.config;
+
+import org.springframework.session.data.redis.config.annotation.web.http.EnableRedisHttpSession;
+
+/**
+ *
+ * @author Rob Winch
+ *
+ */
+// tag::class[]
+@EnableRedisHttpSession // <1>
+public class HttpSessionConfig { }
+// end::class[]

samples/findbyusername/src/main/java/sample/config/SecurityConfig.java

@@ -0,0 +1,74 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package sample.config;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
+
+import sample.session.CompositeAuthenticationSuccessHandler;
+import sample.session.SpringSessionPrincipalNameSuccessHandler;
+
+/**
+ * @author Rob Winch
+ */
+
+@EnableWebSecurity
+public class SecurityConfig extends WebSecurityConfigurerAdapter {
+
+	// tag::config[]
+	@Override
+	protected void configure(HttpSecurity http) throws Exception {
+		CompositeAuthenticationSuccessHandler successHandler = createHandler();
+
+		http
+			.formLogin()
+				.successHandler(successHandler)
+				.loginPage("/login")
+				.permitAll()
+				.and()
+			.authorizeRequests()
+				.antMatchers("/resources/**").permitAll()
+				.anyRequest().authenticated()
+				.and()
+			.logout()
+				.permitAll();
+	}
+	// end::config[]
+
+	// tag::handler[]
+	private CompositeAuthenticationSuccessHandler createHandler() {
+		SpringSessionPrincipalNameSuccessHandler setUsernameHandler =
+				new SpringSessionPrincipalNameSuccessHandler();
+		SavedRequestAwareAuthenticationSuccessHandler defaultHandler =
+				new SavedRequestAwareAuthenticationSuccessHandler();
+
+		CompositeAuthenticationSuccessHandler successHandler =
+				new CompositeAuthenticationSuccessHandler(setUsernameHandler, defaultHandler);
+		return successHandler;
+	}
+	// end::handler[]
+
+	@Autowired
+	public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
+		auth
+			.inMemoryAuthentication()
+				.withUser("user").password("password").roles("USER");
+	}
+}

samples/findbyusername/src/main/java/sample/mvc/IndexController.java

@@ -0,0 +1,61 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package sample.mvc;
+
+import java.security.Principal;
+import java.util.Collection;
+import java.util.Set;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.session.ExpiringSession;
+import org.springframework.session.FindByPrincipalNameSessionRepository;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+
+/**
+ * Controller for sending the user to the login view.
+ *
+ * @author Rob Winch
+ *
+ */
+@Controller
+public class IndexController {
+	// tag::findbyusername[]
+	@Autowired
+	FindByPrincipalNameSessionRepository<? extends ExpiringSession> sessions;
+
+	@RequestMapping("/")
+	public String index(Principal principal, Model model) {
+		Collection<? extends ExpiringSession> usersSessions =
+				sessions.findByPrincipalName(principal.getName()).values();
+		model.addAttribute("sessions", usersSessions);
+		return "index";
+	}
+	// end::findbyusername[]
+
+	@RequestMapping(value = "/sessions/{sessionIdToDelete}", method = RequestMethod.DELETE)
+	public String removeSession(Principal principal, @PathVariable String sessionIdToDelete) {
+		Set<String> usersSessionIds = sessions.findByPrincipalName(principal.getName()).keySet();
+		if(usersSessionIds.contains(sessionIdToDelete)) {
+			sessions.delete(sessionIdToDelete);
+		}
+
+		return "redirect:/";
+	}
+}

samples/findbyusername/src/main/java/sample/mvc/LoginController.java

@@ -0,0 +1,33 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sample.mvc;
+
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+/**
+ * Returns view for log in page
+ *
+ * @author Rob Winch
+ */
+@Controller
+public class LoginController {
+
+	@RequestMapping("/login")
+	public String login() {
+		return "login";
+	}
+}

samples/findbyusername/src/main/java/sample/session/CompositeAuthenticationSuccessHandler.java

@@ -0,0 +1,49 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sample.session;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.List;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.security.core.Authentication;
+import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
+
+/**
+ * @author Rob Winch
+ *
+ */
+// tag::class[]
+public class CompositeAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
+	private List<AuthenticationSuccessHandler> handlers;
+
+	public CompositeAuthenticationSuccessHandler(AuthenticationSuccessHandler... handlers) {
+		super();
+		this.handlers = Arrays.asList(handlers);
+	}
+
+	public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
+			Authentication authentication) throws IOException, ServletException {
+		for(AuthenticationSuccessHandler handler : handlers) {
+			handler.onAuthenticationSuccess(request, response, authentication);
+		}
+	}
+}
+// end::class[]

samples/findbyusername/src/main/java/sample/session/SessionDetails.java

@@ -0,0 +1,50 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sample.session;
+
+import java.io.Serializable;
+
+/**
+ * An example of how users can provide details about their session.
+ *
+ * @author Rob Winch
+ * @see SessionDetailsFilter
+ */
+// tag::class[]
+public class SessionDetails implements Serializable {
+	private String location;
+
+	private String accessType;
+
+	public String getLocation() {
+		return location;
+	}
+
+	public void setLocation(String location) {
+		this.location = location;
+	}
+
+	public String getAccessType() {
+		return accessType;
+	}
+
+	public void setAccessType(String accessType) {
+		this.accessType = accessType;
+	}
+
+	private static final long serialVersionUID = 8850489178248613501L;
+}
+// end::class[]

samples/findbyusername/src/main/java/sample/session/SessionDetailsFilter.java

@@ -0,0 +1,107 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sample.session;
+
+import java.io.IOException;
+import java.net.InetAddress;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.core.Ordered;
+import org.springframework.core.annotation.Order;
+import org.springframework.stereotype.Component;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import com.maxmind.geoip2.DatabaseReader;
+import com.maxmind.geoip2.model.CityResponse;
+
+/**
+ * Inserts the session details into the session for every request. Some users
+ * may prefer to insert session details only after authentication. This is fine,
+ * but it may be valuable to the most up to date information so that if someone
+ * stole the user's session id it can be observed.
+ *
+ * @author Rob Winch
+ *
+ */
+// tag::class[]
+@Component
+@Order(Ordered.HIGHEST_PRECEDENCE + 101)
+public class SessionDetailsFilter extends OncePerRequestFilter {
+	static final String UNKNOWN = "Unknown";
+
+	private DatabaseReader reader;
+
+	@Autowired
+	public SessionDetailsFilter(DatabaseReader reader) {
+		this.reader = reader;
+	}
+
+	// tag::dofilterinternal[]
+	public void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
+			throws IOException, ServletException {
+		chain.doFilter(request, response);
+
+		HttpSession session = request.getSession(false);
+		if (session != null) {
+			String remoteAddr = getRemoteAddress(request);
+			String geoLocation = getGeoLocation(remoteAddr);
+
+			SessionDetails details = new SessionDetails();
+			details.setAccessType(request.getHeader("User-Agent"));
+			details.setLocation(remoteAddr + " " + geoLocation);
+
+			session.setAttribute("SESSION_DETAILS", details);
+		}
+	}
+	// end::dofilterinternal[]
+
+	String getGeoLocation(String remoteAddr) {
+		try {
+			CityResponse city = reader.city(InetAddress.getByName(remoteAddr));
+			String cityName = city.getCity().getName();
+			String countryName = city.getCountry().getName();
+			if(cityName == null && countryName == null) {
+				return null;
+			} else if(cityName == null) {
+				return countryName;
+			} else if(countryName == null) {
+				return cityName;
+			}
+			return cityName + ", " + countryName;
+		} catch (Exception e) {
+			return UNKNOWN;
+
+		}
+	}
+
+	private String getRemoteAddress(HttpServletRequest request) {
+		String remoteAddr = request.getHeader("X-FORWARDED-FOR");
+		if (remoteAddr == null) {
+			remoteAddr = request.getRemoteAddr();
+		} else if (remoteAddr.contains(",")) {
+			remoteAddr = remoteAddr.split(",")[0];
+		}
+		return remoteAddr;
+	}
+}
+//end::class[]
+

samples/findbyusername/src/main/java/sample/session/SpringSessionPrincipalNameSuccessHandler.java

@@ -0,0 +1,52 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sample.session;
+
+import java.io.IOException;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+
+import org.springframework.security.core.Authentication;
+import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
+import org.springframework.session.FindByPrincipalNameSessionRepository;
+import org.springframework.session.Session;
+
+/**
+ * Inserts the username into Spring session after we successfully authenticate.
+ * Adding the principal name to the session is a requirement of
+ * {@link FindByPrincipalNameSessionRepository}
+ *
+ * @author Rob Winch
+ */
+// tag::class[]
+public class SpringSessionPrincipalNameSuccessHandler
+		implements AuthenticationSuccessHandler {
+
+	public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
+			Authentication authentication) throws IOException, ServletException {
+
+		HttpSession session = request.getSession();
+		String currentUsername = authentication.getName();
+
+		// tag::set-username[]
+		session.setAttribute(Session.PRINCIPAL_NAME_ATTRIBUTE_NAME, currentUsername);
+		// end::set-username[]
+	}
+}
+// end::class[]