spring security - is there an way to get session registry inside my application (without explicilty customizing the concurrentFilter)

Question

I was referring to this thread, and in the second last post by Rob Winch (Spring Security Lead), he mentions that we can have access to the sessionRegisty :

<session-management>
  <concurrency-control session-registry-alias="sessionRegistry"/>
</session-management>

Therefore, I register the HttpSessionEventPublisher filter in web.xml and specify the above setting in my <http> section. I DON'T add this :

<beans:bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl" />

and in my class, I inject an instance of sessionRegistry like this :

@Autowired
private SessionRegistry sessionRegistry

This is how I am trying to find out the sessions for a user:

List<SessionInformation> userSessions = sessionRegistry.getAllSessions(username,false);
        for (SessionInformation userSession : userSessions){
            userSession.expireNow();
        }

The principal is the username of the user. Upon debugging, the sessionRegistry variable's principals and sessionids variables are empty. Am I doing anything wrong here, or are the steps mentioned by krams's blog, the only way to do this ?

Answer 1

Well you can autowire sessionRegistry. Nothing is wrong. I used it to track SessionInformation and registered sessions for UserPrincipal