Revision history [back]

click to hide/show revision 1
initial version

asked 2017-05-23 08:25:02 +0800

JustinFrost gravatar image JustinFrost

Sign out all desktops in a Session

When signout is clicked in our application we use spring security to do the session sign out by simply redirecting to a url

Executions.sendRedirect("/appsignout");

This works well once redirected the session is invalidated.

However we have a further requirement to redirect all other desktops in the session to a "You have been signed out" url before the session is invalidated by the /appsignout redirect.

I have setup a session event queue to redirect the other pages in my sign out method:

public static final void doSignOut(DesktopView fromDesktopView){

    setSessionProperty("SIGN_OUT_SESSION_DESKTOP_ID", fromDesktopView.getDesktopId());

    if (getActiveDesktops().size() > 1){
        getActiveDesktops().remove(fromDesktopView);

        // remove any invalid desktops from list
        removeInvalidDesktops();

        EventQueue sessionEventQ = EventQueues.lookup(SessionProperty.SESSION_EVENT_QUEUE.toString(), EventQueues.SESSION, true);
    sessionEventQ.publish(new Event("signOutRedirect" null, null));
    }
    else{
        // publish session sign out event
        SessionManager.getSessionEventQueue().publish(new Event("signOutSession", null, null));
    }
}

The view my desktop has the following subscribed to the event queue :

new EventListener() { public void onEvent(Event event) throws Exception {

    // if sign out event not from source desktop redirect to keep session valid
        if (event.getName().equals("signOutRedirect"))){
        if (!getDesktopId().equals(SessionManager.getSessionAttribute("SIGN_OUT_SESSION_DESKTOP_ID"))){
    SessionManager.getActiveDesktops().remove(thisDesktopView);
    SessionManager.getSessionEventQueue().unsubscribe(this);
    // if this was the last desktop then publish an event to do the actual session signout
    if (SessionManager.getActiveDesktops().isEmpty()){
        SessionManager.getSessionEventQueue().publish("signOutSession", null, null));
    }
    // redirect to signed out page
    Executions.sendRedirect("/security/?function=signout&userProfileSSO=false");
 }
}
// session sign out
else if (event.getName().equals("signOutSession")){
        if getDesktopId().equals(SessionManager.getSessionAttribute("SIGN_OUT_SESSION_DESKTOP_ID")))){
    Executions.sendRedirect("/jeminisignout");
    }
                    }
                }

The issues I am facing are:

  1. am keeping a List of active desktops when it is empty I do the final Session sign out - however I am not confident that these desktops are always valid - sometimes I get an orphan in there. Is there anyway to test is a Desktop is valid ? (I have removed ones that return null from getDesktopCache() and !isAlive())
  2. Because the EventQueue publish is threaded I need a mechanism to determine all other desktops have finished their redirect before I do the actual session sign out.

Sign out all desktops in a Session

When signout is clicked in our application we use spring security to do the session sign out by simply redirecting to a url

Executions.sendRedirect("/appsignout");

This works well once redirected the session is invalidated.

However we have a further requirement to redirect all other desktops in the session to a "You have been signed out" url before the session is invalidated by the /appsignout redirect.

I have setup a session event queue to redirect the other pages in my sign out method:

public static final void doSignOut(DesktopView fromDesktopView){

    setSessionProperty("SIGN_OUT_SESSION_DESKTOP_ID", fromDesktopView.getDesktopId());

    if (getActiveDesktops().size() > 1){
        getActiveDesktops().remove(fromDesktopView);

        // remove any invalid desktops from list
        removeInvalidDesktops();

        EventQueue sessionEventQ = EventQueues.lookup(SessionProperty.SESSION_EVENT_QUEUE.toString(), EventQueues.SESSION, true);
    sessionEventQ.publish(new Event("signOutRedirect" null, null));
    }
    else{
        // publish session sign out event
        SessionManager.getSessionEventQueue().publish(new Event("signOutSession", null, null));
    }
}

The view my desktop has the following subscribed to the event queue :

new EventListener() {
    public void onEvent(Event event) throws Exception {

{

        // if sign out event not from source desktop redirect to keep session valid
         if (event.getName().equals("signOutRedirect"))){
         if (!getDesktopId().equals(SessionManager.getSessionAttribute("SIGN_OUT_SESSION_DESKTOP_ID"))){
     SessionManager.getActiveDesktops().remove(thisDesktopView);
     SessionManager.getSessionEventQueue().unsubscribe(this);
     // if this was the last desktop then publish an event to do the actual session signout
     if (SessionManager.getActiveDesktops().isEmpty()){
         SessionManager.getSessionEventQueue().publish("signOutSession", null, null));
    }
    }
        // redirect to signed out page
     Executions.sendRedirect("/security/?function=signout&userProfileSSO=false");
 }
}
    }
    }
    // session sign out
 else if (event.getName().equals("signOutSession")){
         if getDesktopId().equals(SessionManager.getSessionAttribute("SIGN_OUT_SESSION_DESKTOP_ID")))){
     Executions.sendRedirect("/jeminisignout");
    }
    }

                    }
                }

The issues I am facing are:

  1. am keeping a List of active desktops when it is empty I do the final Session sign out - however I am not confident that these desktops are always valid - sometimes I get an orphan in there. Is there anyway to test is a Desktop is valid ? (I have removed ones that return null from getDesktopCache() and !isAlive())
  2. Because the EventQueue publish is threaded I need a mechanism to determine all other desktops have finished their redirect before I do the actual session sign out.
Support Options
  • Email Support
  • Training
  • Consulting
  • Outsourcing
Learn More