Andrew Cooke | Contents | Latest | RSS | Previous | Next

C[omp]ute

Welcome to my blog, which was once a mailing list of the same name and is still generated by mail. Please reply via the "comment" links.

Always interested in offers/projects/new ideas. Eclectic experience in fields like: numerical computing; Python web; Java enterprise; functional languages; GPGPU; SQL databases; etc. Based in Santiago, Chile; telecommute worldwide. CV; email.

Personal Projects

Choochoo Training Diary

Last 100 entries

[Programming] React Leaflet; AliExpress Independent Sellers; Applebaum - Twilight of Democracy; [Politics] Back + US Elections; [Programming,Exercise] Simple Timer Script; [News] 2019: The year revolt went global; [Politics] The world's most-surveilled cities; [Bike] Hope Freehub; [Restaurant] Mama Chau's (Chinese, Providencia); [Politics] Brexit Podcast; [Diary] Pneumonia; [Politics] Britain's Reichstag Fire moment; install cairo; [Programming] GCC Sanitizer Flags; [GPU, Programming] Per-Thread Program Counters; My Bike Accident - Looking Back One Year; [Python] Geographic heights are incredibly easy!; [Cooking] Cookie Recipe; Efficient, Simple, Directed Maximisation of Noisy Function; And for argparse; Bash Completion in Python; [Computing] Configuring Github Jekyll Locally; [Maths, Link] The Napkin Project; You can Masquerade in Firewalld; [Bike] Servicing Budget (Spring) Forks; [Crypto] CIA Internet Comms Failure; [Python] Cute Rate Limiting API; [Causality] Judea Pearl Lecture; [Security, Computing] Chinese Hardware Hack Of Supermicro Boards; SQLAlchemy Joined Table Inheritance and Delete Cascade; [Translation] The Club; [Computing] Super Potato Bruh; [Computing] Extending Jupyter; Further HRM Details; [Computing, Bike] Activities in ch2; [Books, Link] Modern Japanese Lit; What ended up there; [Link, Book] Logic Book; Update - Garmin Express / Connect; Garmin Forerunner 35 v 230; [Link, Politics, Internet] Government Trolls; [Link, Politics] Why identity politics benefits the right more than the left; SSH Forwarding; A Specification For Repeating Events; A Fight for the Soul of Science; [Science, Book, Link] Lost In Math; OpenSuse Leap 15 Network Fixes; Update; [Book] Galileo's Middle Finger; [Bike] Chinese Carbon Rims; [Bike] Servicing Shimano XT Front Hub HB-M8010; [Bike] Aliexpress Cycling Tops; [Computing] Change to ssh handling of multiple identities?; [Bike] Endura Hummvee Lite II; [Computing] Marble Based Logic; [Link, Politics] Sanity Check For Nuclear Launch; [Link, Science] Entropy and Life; [Link, Bike] Cheap Cycling Jerseys; [Link, Music] Music To Steal 2017; [Link, Future] Simulated Brain Drives Robot; [Link, Computing] Learned Index Structures; Solo Air Equalization; Update: Higher Pressures; Psychology; [Bike] Exercise And Fuel; Continental Race King 2.2; Removing Lowers; Mnesiacs; [Maths, Link] Dividing By Zero; [Book, Review] Ray Monk - Ludwig Wittgenstein: The Duty Of Genius; [Link, Bike, Computing] Evolving Lacing Patterns; [Jam] Strawberry and Orange Jam; [Chile, Privacy] Biometric Check During Mail Delivery; [Link, Chile, Spanish] Article on the Chilean Drought; [Bike] Extended Gear Ratios, Shimano XT M8000 (24/36 Chainring); [Link, Politics, USA] The Future Of American Democracy; Mass Hysteria; [Review, Books, Links] Kazuo Ishiguro - Never Let Me Go; [Link, Books] David Mitchell's Favourite Japanese Fiction; [Link, Bike] Rear Suspension Geometry; [Link, Cycling, Art] Strava Artwork; [Link, Computing] Useful gcc flags; [Link] Voynich Manuscript Decoded; [Bike] Notes on Servicing Suspension Forks; [Links, Computing] Snap, Flatpack, Appimage; [Link, Computing] Oracle is leaving Java (to die); [Link, Politics] Cubans + Ultrasonics; [Book, Link] Laurent Binet; VirtualBox; [Book, Link] No One's Ways; [Link] The Biggest Problem For Cyclists Is Bad Driving; [Computing] Doxygen, Sphinx, Breathe; [Admin] Brokw Recent Permalinks; [Bike, Chile] Buying Bearings in Santiago; [Computing, Opensuse] Upgrading to 42.3; [Link, Physics] First Support for a Physics Theory of Life; [Link, Bike] Peruvian Frame Maker; [Link] Awesome Game Theory Tit-For-Tat Thing; [Food, Review] La Fabbrica - Good Italian Food In Santiago; [Link, Programming] MySQL UTF8 Broken; [Link, Books] Latin American Authors

© 2006-2017 Andrew Cooke (site) / post authors (content).

Session Limitation with Acegi

From: "andrew cooke" <andrew@...>

Date: Mon, 27 Feb 2006 14:44:16 -0300 (CLST)

Sometimes it's useful to restrict a user a single session.  This
simplifies the logic needed to guarantee certain restrictions.

For example, I always want a user to have a minimum of one valid email
address.  With two parallel sessions and two valid emails a user could
delete one email in each session and I would need to verify consistency in
the database.  Restrictig to one session lets me implement the restriction
in the business logic.

However, the exact configuration was not obvious.  After some
experimentation the following seemed to work.

First, you need some way of detectig when sessions expire.  This is
largely automatic as long as you register the following in web.xml:

  <!-- used to track session events (single user session) -->
  <listener>
    <listener-class>org.acegisecurity.ui.\
      session.HttpSessionEventPublisher</listener-class>
  </listener>

I have all my authentication-related xml in web-authentication.xml (and
referenced via context-param in web.xml).  It includes:

  <bean id="authenticationManager"
    class="org.acegisecurity.providers.ProviderManager">
    <property name="sessionController" ref="singleSession"/>
    <property name="providers">
      ...
    </property>
  </bean>

  <bean id="sessionRegistry"
    class="org.acegisecurity.concurrent.SessionRegistryImpl"/>

  <bean id="singleSession"
    class="org.acegisecurity.concurrent.ConcurrentSessionControllerImpl">
    <property name="maximumSessions" value="1"/>
    <property name="exceptionIfMaximumExceeded" value="true"/>
    <property name="sessionRegistry" ref="sessionRegistry"/>
  </bean>

Which is all that is needed (I suspect sessionRegistry is supplied by
default anyway).

The way it seems to work is as follows:
- authenticationManager calls the appropriate provider
- if that succeeds, it calls sessionController
- sessionController applies the appropriate logic, using the information
  in sessionRegistry
- sessionRegistry is correct because of the event system (which includes
  the listener you registered).

Andrew

Session Limitation with Acegi blog post

From: "andrew cooke" <andrew@...>

Date: Fri, 10 Oct 2008 07:07:52 -0400 (CLT)

---------------------------- Original Message ----------------------------
From:    "m zyzy" <myzyzy@...>
Date:    Thu, October 9, 2008 10:40 pm
--------------------------------------------------------------------------

First of all, I am new in spring and acegi , and I know the post is a bit
old, but I am stuck with acegi v1.0.4 - Spring security V2.0.4 -wait for
me-We'll meet in my next project..

why you dont use this filter below ? is there an explanation as why you
didnt use it?
<bean id="concurrentSessionFilter"
class="org.acegisecurity.concurrent.ConcurrentSessionFilter">
      <property name="sessionRegistry"> <ref bean="sessionRegistry"/>
</property>
      <property name="expiredUrl" value="/login.jsp"/>
    </bean>

I also use the same config xml code as you wrote in the blog post but with
the addition of above code and it's work fine for me (of course, with the
above code , I need to add the concurrentSessionFilter in the
filterChainProxy's filter sequence).

-Second as we both use the way that to prevent second login attempt at a
time in different machine/browser , how to show a text message in a jsp
page to indicate that the unsuccessful second logger of user he/she is
trying to log in to is in used already currently? How this can be done?

Thanks .

No Idea!

From: "andrew cooke" <andrew@...>

Date: Fri, 10 Oct 2008 07:14:33 -0400 (CLT)

Hi,

No idea why I didn't use that - perhaps it wasn't around when I wrote the
code?  Perhaps I missed it?

Curiously, it's not mentioned at
http://www.acegisecurity.org/guide/springsecurity.html#concurrent-sessions
either.

I haven't used Acegi since this post, so I'm afraid I can't help more (but
thanks for posting - people do sometimes read this page, according to my
logs, so it will help them).

Cheers,
Andrew

Session Limitation with Acegi blog post

From: "m zyzy" <myzyzy@...>

Date: Fri, 10 Oct 2008 10:40:57 +0800

First of all, I am new in spring and acegi , and I know the post is a bit
old, but I am stuck with acegi v1.0.4 - Spring security V2.0.4 -wait for
me-We'll meet in my next project..

why you dont use this filter below ? is there an explanation as why you
didnt use it?
<bean id="concurrentSessionFilter"
class="org.acegisecurity.concurrent.ConcurrentSessionFilter">
      <property name="sessionRegistry"> <ref bean="sessionRegistry"/>
</property>
      <property name="expiredUrl" value="/login.jsp"/>
    </bean>

I also use the same config xml code as you wrote in the blog post but with
the addition of above code and it's work fine for me (of course, with the
above code , I need to add the concurrentSessionFilter in the
filterChainProxy's filter sequence).

-Second as we both use the way that to prevent second login attempt at a
time in different machine/browser , how to show a text message in a jsp page
to indicate that the unsuccessful second logger of user he/she is trying to
log in to is in used already currently? How this can be done?

Thanks .

Comment on this post