Spring Security并发会话：无法使“max-sessions”字段可配置

Question

<security:session-management>
    <security:concurrency-control max-sessions="${maxConcurrentSessionsCount}" session-registry-ref="sessionRegistry" expired-url="/handleInvalidatedSession.gs4tr"/>
</security:session-management>`

"attribute 'max-sessions' on element 'security:concurrency-control' is not valid with respect to its type, 'positiveInteger'".

编辑：在“services.properties”中配置为：“MaxConcurrentSessionsCount=2”

在启动应用程序时，它抛出下一个错误：

No, it doesn't. It throws next ERROR on starting app:

017-09-14 15:46:47,724错误[org.gs4tr.projectdirector.service.context.contextLoaderListener][localhost-startStop-1][user:]-org.springframework.beans.factory.XML.xmlBeanDefinitionStoreException:来自类路径资源[org/gs4tr/foundation/modules/webmvc/spring/applicationcontext-security-default.XML]的XML文档中的第75行无效；嵌套异常是org.xml.sax.SaxParseException；亚麻编号：75；专栏编号：72；CVC-datatype-valid.1.2.1:“${maxConcurrentSessionsCount}”不是“integer”的有效值。在org.springframework.beans.factory.xml.xmlBeanDefinitionReader.doloadBeanDefinition(xmlBeanDefinitionReader.java:399)在org.springframework.beans.factory.xml.xmlBeanDefinitionReader.xml.xmlBeanDefinitionReader.loadBeanDefinition(xmlBeanDefinitionReader.java:336)在181）在org.springframework.beans.factory.support.abstractBeanDefinitionReader.loadBeanDefinitions（AbstractBeanDefinitionReader.java:217)在org.springframework.beans.factory.support.abstractBeanDefinitionReader.loadBeanDefinitions（AbstractBeanDefinitionReader.java:217)在4）在org.springframework.context.support.AbstractRefreshableApplicationContext.java:129)在org.springframework.context.support.AbstractApplicationContext.regresh（AbstractApplicationContext.java:537)在org.springframework.context.support.AbstractApplicationContext.refresh（AbstractApplicationContext.java:452)在：306）在org.springframework.web.context.contextLoaderListener.contextInitialized(contextLoaderListener.java:106)在org.gs4tr.projectDirector.service.context.context.contextLoaderListener.contextInitialized(contextLoaderListener.java:73)在org.apache.catalina.core.standardContext.listenerstart(standardContext.java:4811)在pache.catalina.util.lifecyclebase.start(Lifecyclebase.java:147)

Answer 1

这是max-session属性的定义：

<xs:attribute name="max-sessions" type="xs:positiveInteger">
<xs:annotation>
<xs:documentation>
The maximum number of sessions a single authenticated user can have open at the same time. Defaults to "1".
</xs:documentation>
</xs:annotation>
</xs:attribute>

可以看到，属性的类型是PositiveInteger，并且不允许使用SPEL。

SpEL（例如，获取属性值）是一个字符串，在某些情况下，您可以使用SpEL：