2.4. Application APIs
These are the APIs to use when the application has to work with sessions and login state directly. They are optional, not required — you use them when building features such as showing a list of connected users on an administrator screen or forcibly logging out a particular user.
All APIs are called on the object obtained from SessionLoginManager.getInstance().
| What you want to do | Method |
|---|---|
| Check whether this request is a duplicate login | isDuplicated(request) |
| Get the logged-in user ID | loggedInUserId(request) |
| List the users currently logged in | getLoginUsers() |
| View the session attributes of a particular user | getSessionAttributes(sessionId) |
| Force a particular user to log out | logout(loginId, sessionId) |
| Read a value directly from the store | getAttributeDirect(sessionId, name) |
Checking for a Duplicate Login
Checks whether a login for the same account has occurred elsewhere. When you set invalidateDuplicateLogin to false and handle logout yourself, this value is what you base the decision on.
boolean isDuplicated = SessionLoginManager.getInstance().isDuplicated(request);
Logged-In User Information
Returns the user ID logged in to the session of the current request. This is the value passed to login(request, [USER_ID]) at login time. If the user is not logged in, there is no value.
String loginUserId = SessionLoginManager.getInstance().loggedInUserId(request);
List of Logged-In Users
Returns the list of users currently logged in. Use it to show connected users on an administrator screen.
List<LoginUser> loginUsers = SessionLoginManager.getInstance().getLoginUsers();
A single LoginUser holds the following values.
| Value | Content |
|---|---|
getLoginId() | The user ID passed at login time |
getSessionId() | That user's session ID. Used for forced logout and attribute lookups |
getType() | The type, if one was passed at login time |
getSessionTimeout() | The timeout of that session, in minutes |
getStatus() | Session status |
To select only a particular user or type, use the following.
List<LoginUser> byId = SessionLoginManager.getInstance().getLoginUsersById("hong");
List<LoginUser> byType = SessionLoginManager.getInstance().getLoginUsersByType("admin");
Session Attributes of a Logged-In User
Given a session ID, returns all values held in that session. Obtain the session ID from getSessionId() on the entries returned by getLoginUsers() above.
Map<String, Object> sessionAttributes = SessionLoginManager.getInstance().getSessionAttributes(sessionId);
Forcing a Particular User to Log Out
Use this when an administrator logs out a particular user. It returns true on success.
This call does not delete the session data; it only marks that a duplicate login has occurred. Logout is carried out the next time that user sends a request. To specify the login type as well, use the three-argument form.
SessionLoginManager.getInstance().logout(loginId, sessionId);
SessionLoginManager.getInstance().logout(loginId, sessionId, type);
Reading Data Stored on the Session Server
Use this when you need to read another user's session value directly from the store. The session of the current request can be read with request.getSession().getAttribute(), so this API is not needed for that.
// true if the attribute exists for that session ID
public boolean isAttributeExistDirect(String sessionId, String name)
// returns the attribute value for that session ID as an Object
public Object getAttributeDirect(String sessionId, String name)
SessionLoginManager.getInstance().getAttributeDirect(session.getId(), "userId");
SessionLoginManager.getInstance().isAttributeExistDirect(session.getId(), "userId");
If you read a value immediately after storing it, it may not have reached the store yet and no value is returned. In that case, use the form that takes a retry time in milliseconds. It retries the read for that long.
SessionLoginManager.getInstance().getAttributeDirect(sessionId, "userId", 500);