APIs or patterns for listing authenticated users.

[Dave Patterson]

Hi All,

I'm looking for some feedback on a working solution I've implemented that feels a bit clunky.

The basic requirement was to remove stale entries from a simple locking mechanisim if the user had logged off or timed out.

My solution (after a few suggestions from the websphere usenet group) was to implement a session binding listener and add one of these objects to each users session as they log in. (I use a global filter to test each request to ensure the users session contains a listener.)

The listener class has a static hashmap that stores a list of all logged on users. As bind and unbind events are fired the relevant user is added or removed from the list. A public method returns the current 'active' user list which we use to verify our lock entries.

Has anyone else tackled this kind of problem before?

Thanks

Dave Patterson.

/*
 * Created on 11-Jun-04 by Dave Patterson
 */
package com.hhh.locking;
 
import java.util.Collection;
import java.util.HashMap;
import java.util.Iterator;
 
import javax.servlet.http.HttpSessionBindingEvent;
import javax.servlet.http.HttpSessionBindingListener;
 
public class UserListListener implements HttpSessionBindingListener {
 
  private static HashMap userList = new HashMap();
  private String userId;
 
  public UserListListener(String userId) {
    this.userId = userId;
  }
 
  public void valueBound(HttpSessionBindingEvent event) {
    System.out.println("Added user " + userId + 
      " for session " + event.getSession().getId() );
    userList.put(event.getSession().getId(),this.userId);
  }
 
  public void valueUnbound(HttpSessionBindingEvent event) {
    String sessionId = event.getSession().getId();
    userList.remove(sessionId);
    System.out.println("Removed user for session " +
      event.getSession().getId() );
  }
 
  public static Collection getUserList() {
    return userList.values();
  } 
}
 
/*
 * Created on 11-Jun-04 by Dave Patterson
 */
package com.hhh.lawline.locking;
 
import java.io.IOException;
import java.security.Principal;
 
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;
 
public class UserListFilter implements Filter {
 
  public void destroy() {}
 
  public void doFilter(ServletRequest request, ServletResponse resp,
FilterChain chain) throws ServletException, IOException {
    Principal userPrincipal = ((HttpServletRequest)
request).getUserPrincipal();
    HttpSession session =  ((HttpServletRequest)
request).getSession();
    UserListListener userList;
    userList = (UserListListener) session.getAttribute("user.list");
    if (userList == null) {
      userList = new UserListListener(userPrincipal.getName());
      session.setAttribute("user.list", userList);
      System.out.println("Added user " + userPrincipal.getName());
    }   chain.doFilter(request, resp);
    }
 
    public void init(FilterConfig config) throws ServletException {
  }
}