struts2+springsecurity+spring-session-data-redis使用redis存储session

springsecurity做权限验证，采用默认的session管理，在系统重新部署启动之后，之前登录的用户session无法被保存，需要用户重新登录，这里使用redis来做session存储，系统重启之后，session还在，无需重新登录。

使用redis做session存储，本身配置比较简单，但是这里和struts2结合，就需要注意。

springSessionRepositoryFilter的映射配置需要在springsecurity和struts2的filter前面。要不然，还是不会生效。

首先需要增加spring-session-data-redis的依赖。

<dependency>
	<groupId>org.springframework.session</groupId>
	<artifactId>spring-session-data-redis</artifactId>
	<version>1.3.5.RELEASE</version>
</dependency>

其次，需要配置redis连接和redis session相关的bean，让spring去管理redis的连接。

spring-redis.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:context="http://www.springframework.org/schema/context"
	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.3.xsd">

    <bean id="jedisPoolConfig" class="redis.clients.jedis.JedisPoolConfig">
         <property name="maxIdle" value="0" />
         <property name="maxTotal" value="20" />
         <property name="maxWaitMillis" value="1000" />
         <property name="testOnBorrow" value="false" />
    </bean>
    
    <bean id="jedisConnectionFactory" class="org.springframework.data.redis.connection.jedis.JedisConnectionFactory">
         <property name="hostName" value="${redis.host}" />
         <property name="port" value="${redis.port}" />
         <property name="poolConfig" ref="jedisPoolConfig" />
    </bean>
    
    <bean class="org.springframework.session.data.redis.config.annotation.web.http.RedisHttpSessionConfiguration">
        <property name="maxInactiveIntervalInSeconds" value="6000" />
    </bean>
    
</beans>

在spring-security.xml配置文件中，增加redis session相关的配置。

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:sec="http://www.springframework.org/schema/security"
	xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.2.xsd
	http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">

    <bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl" />
    <bean id="sessionAuthenticationStrategy" class="org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy">
         <constructor-arg>
            <list>
                 <bean class="org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy">
                    <constructor-arg ref="sessionRegistry" />
                 </bean>
                 <bean class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy"></bean>
                 <bean class="org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy">
                     <constructor-arg ref="sessionRegistry" />
                 </bean>
            </list>
         </constructor-arg>
    </bean>
    <sec:http pattern="/" security="none"/>
    <sec:http auto-config="true" authentication-manager-ref="authentication-manager">
        <sec:intercept-url pattern="/**" access="isAuthenticated()"/>
        <sec:form-login 
           login-page="/"
        		login-processing-url="/login"
         		default-target-url="/admin/user!list.action"
         		authentication-failure-url="/"
         		username-parameter="username"
         		password-parameter="password"
        />
        <sec:headers disabled="true"/>
        <sec:csrf disabled="true"/>
        <sec:logout logout-url="/logout" logout-success-url="/"/>
        <sec:session-management invalid-session-url="/" session-authentication-strategy-ref="sessionAuthenticationStrategy"/>
    </sec:http>
    <bean id="securityUserDetailsService" class="com.xxx.ssh.web.service.impl.SecurityUserDetailsService">
    </bean>
    <sec:authentication-manager id="authentication-manager">
        <sec:authentication-provider user-service-ref="securityUserDetailsService">
           <sec:password-encoder hash="md5"/>
        </sec:authentication-provider>
    </sec:authentication-manager>
</beans>

web.xml配置的详细配置：

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0">
    <display-name>ssh</display-name>
	<context-param>
		<param-name>contextConfigLocation</param-name>
		<param-value>classpath:spring.xml,classpath:spring-security.xml</param-value>
	</context-param>
	<listener>
		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
	</listener>
	<filter>
	      <filter-name>ssh</filter-name>
	      <filter-class>org.apache.struts2.dispatcher.filter.StrutsPrepareAndExecuteFilter</filter-class>
	 </filter>	 
	<filter>
	       <filter-name>springSecurityFilterChain</filter-name>
	       <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
	</filter>
	<filter>
	       <filter-name>springSessionRepositoryFilter</filter-name>
	       <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
	</filter>
	<filter-mapping>
	      <filter-name>springSessionRepositoryFilter</filter-name>
	      <url-pattern>/*</url-pattern>
	</filter-mapping>
	<filter-mapping>
	      <filter-name>springSecurityFilterChain</filter-name>
	      <url-pattern>/*</url-pattern>
	</filter-mapping>		
	<filter-mapping>
	      <filter-name>ssh</filter-name>
	      <url-pattern>/*</url-pattern>
	</filter-mapping>
</web-app>

这里尤其要注意三个filter的顺序，springsession-springsecurity-struts2。这里虽然springSessionRepositoryFilter和springSecurityFilterChain对应的filter-class是一个，但是还是需要配置两遍。

经过这样的配置，无需编写java代码，就可以实现redis存储session，项目重新部署，用户会无感知。无需重新登录。

用户登录之后存储在redis中的session相关的信息：

完整项目代码地址：https://github.com/buejee/ssh.git