Get session from sessionID

[nico.ben]

Hi,
I need to retrieve a session from a sessionID.
So far I haven't found a specific method to do that.
Do you have any suggestions, please?

Thank you,
Nico

[bashan]

Hi,

what exactly are you trying to do?  If you are saving session ids in some map, why not store the session object itself?

[nico.ben]

Hi,
with a callback mechanism I receive back a sessionID, I need to retrieve from seam the session, containing my loggedUser info.

Thanks,
Nic

[luxspes]

Nicola Benaglia wrote on Nov 06, 2009 16:14:


Hi,
I need to retrieve a session from a sessionID.
So far I haven't found a specific method to do that.
Do you have any suggestions, please?

Thank you,
Nico

Have you tried with HttpSession.getId() ?

[luxspes]

Ups, sorry, I understood your question incorrectly, you want to retrieve the session from the id, not the id from the session...

You use to be able to do it with HttpSessionContext, but it got deprecated because it was a security risk...

[luxspes]

Maybe you could set up a HttpSessionListener and store your sessions at the application scope as they are created?

[cash1981]

The easiest you can do to get seam components in scopes are:
Contexts api

Contexts.getSessionContext.get("instanceName");

Or you can directly get it with injection

If you want currentUser logged in (if it is in the session scope):

@In User user;

if(Identity.instance().isLoggedIn())
      return Identity.instance().getPrincipal().getName();

If you want the user entity you have other methods too do that. Let me know if none of this are what you are looking for.

[cash1981]

Here is the one I am using:

http://seamframework.org/Documentation/UsingEntityHomeForEntitiesInLongrunningContexts

Then you can just inject your component and retrieve the current logged in user.

@In User currentUser;

[kapitanpetko]

Francisco Peredo wrote on Nov 06, 2009 23:25:


Maybe you could set up a HttpSessionListener and store your sessions at the application scope as they are created?

And if you need this to work in a (JBoss) cluster, have a look at this.

[nico.ben]

Hi,
I tried to look for the part of the seam code where from the sessionID seam restores the session.

I notice that the only information the cookie (of the seam appl) contains is JSESSIONID.
If I log to my appl and open a second browser window pointing again to my appl, I get to the page of my apll without logging. Seam restore my session from the cookie.
It means that it already does what I need (sessionID-->session).

I don't want to reinvent the wheel (people already did a great job) so I'd like to find if there's a quicker method to do that in seam.
But my knowledge of Seam architecture is not good.
Maybe you can help.

Thank you,
Nico

[ctomc]

Hi,

the best approach is with what Francesco is already suggesting. Do it using HttpSessionListener.
Solution to do this in nonclustered enviroment is quite easy:

Session listener:

public class SessionListener implements HttpSessionListener, java.io.Serializable{
     private static final Logger log = Logger.getLogger(SessionListener.class);
     public void sessionCreated(HttpSessionEvent event) {
          log.info("session created: "+event.getSession().getId());
          SessionTracker.instance().add(event.getSession());
     }

     public void sessionDestroyed(HttpSessionEvent event) {
          log.info("session destroyed: "+event.getSession().getId());
          SessionTracker.instance().remove(event.getSession());
     }
}

Session tracker:

public class SessionTracker {
     private static SessionTracker ourInstance = new SessionTracker();
     private WeakHashMap<String, HttpSession> sessions = new WeakHashMap<String, HttpSession>();

     public static SessionTracker instance() {
          return ourInstance;
     }

     private SessionTracker() {
     }

     public List<HttpSession> getSessions() {
          return new ArrayList<HttpSession>(sessions.values());
     }

     public void add(HttpSession session){
          sessions.put(session.getId(),session);
     }
     public void remove(HttpSession session){
          sessions.remove(session.getId());
     }
     public HttpSession getSession(String id){
          return sessions.get(id); 
     }
}

All you have to do is to register it in web.xml

<listener>
        <display-name>Session tracking</display-name>
        <listener-class>si.banka_koper.tracking.SessionListener</listener-class>
    </listener>

and than you can use it like this:

HttpSession ses = SessionTracker.instance().getSession(sessionId);

[asookazian]

Nicola Benaglia wrote on Nov 06, 2009 23:05:


Hi,
with a callback mechanism I receive back a sessionID, I need to retrieve from seam the session, containing my loggedUser info.

Thanks,
Nic

Please describe the use case.  What is this callback mechanism and why does it exist?  I'm wondering how legitimate is and/or how frequently this use case surfaces (never heard anyone else request this functionality before on this board)...

[nico.ben]

Hi,
I am going to use BIRT viewer to show some reports. That application also runs under jboss as a stand alone application with its contextRoot.
But BIRT also allows you to write Java handler classes and bind them to its report lifecycle.
I will write a class and bind it before accessing to the datasource.
That class will receive the sessionID and will call a servlet on my seam application passing to it:

1) sessionID
2) name of the called report

The seam servlet should retrieve the existing session from the sessionID (1 param; the user is going to call the report from the seam appl) and check whether the user has permission to watch the report (2 param).

In case the servlet denies the permissions, the report lifecycle would stop.

Bye,
Nic

[ctomc]

I see a perfectly good use case here :) As we had it on a project where that code came from.

You have user that is logged in to your application and requests some data from other web page(iframe) and that webpage uses websevice to check if user is really logged into our application (web service to check this is hosted in our app) and if it is it displays proper content for him.

I can see some other use cases but usual principle is the some user from application A requests something from application B and B checks if user is authenticated in app A before sends response.

cheers,
tomaz

[kapitanpetko]

Nicola Benaglia wrote on Nov 07, 2009 16:21:


I am going to use BIRT viewer to show some reports. That application also runs under jboss as a stand alone application with its contextRoot.

If you really have two applications within different contexts, that is really a single sign-on problem. Passing session ID's around will not work. Session1 from app A, and Session1 from app B are really different sessions (not that there is a chance of having the same session ID in real life).