Security patterns: Forcing disconnection

[DarioCrivelli]

Hi

assuming you asked for an example based on JMX (i.e. option 2), we show you a code snippet that, added to the Metadata Adapter code, listens to the notifications for session initiation and termination and causes each session to be closed after it has lived longer than five minutes.

There are several ways to access Lightstreamer MBeans server from the Metadata Adapter.
We use the simplest one, which takes advantage of the fact that Lightstreamer Server loads all the Adapters in its main ClassLoader;
so we access the MBeans server via static references, through the MBeanServerFactory.findMBeanServer method.

<br /> private final Set currSessions = new HashSet();<br /> private final Timer timer = new Timer();<br /> private final long expiryTime = 5 * 60 * 1000;<br /> <br /> private final MBeanServer server;<br /> {<br /> ObjectName serverMBeanName = null;<br /> try {<br /> serverMBeanName = new ObjectName("com.lightstreamer", "type", "Server");<br /> // this MBean is always defined by Lightstreamer MBean server;<br /> // we use it as a mean to identify Lightstreamer MBean server<br /> } catch (MalformedObjectNameException e1) {<br /> // TODO<br /> }<br /> <br /> if (serverMBeanName != null) {<br /> ArrayList servers = MBeanServerFactory.findMBeanServer(null);<br /> MBeanServer found = null;<br /> for (int i = 0; i < servers.size(); i++) {<br /> found = (MBeanServer) servers.get(i);<br /> if (found.isRegistered(serverMBeanName)) {<br /> break;<br /> } else {<br /> found = null;<br /> }<br /> }<br /> if (found == null) {<br /> // TODO<br /> }<br /> server = found;<br /> } else {<br /> server = null;<br /> }<br /> }<br /> <br /> public void notifyNewSession(String user, final String session) throws CreditsException, NotificationException {<br /> synchronized (currSessions) {<br /> currSessions.add(session);<br /> }<br /> timer.schedule(new TimerTask() {<br /> public void run() {<br /> synchronized (currSessions) {<br /> if (! currSessions.contains(session)) {<br /> return;<br /> }<br /> }<br /> killSession(session);<br /> // this also causes notifySessionClose to be called<br /> }<br /> }, expiryTime);<br /> }<br /> <br /> public void notifySessionClose(String session) throws NotificationException {<br /> synchronized (currSessions) {<br /> currSessions.remove(session);<br /> }<br /> }<br /> <br /> private void killSession(String session) {<br /> if (server == null) {<br /> // TODO<br /> return;<br /> }<br /> ObjectName sessionMBeanName = null;<br /> Hashtable props = new Hashtable();<br /> props.put("type", "Session");<br /> props.put("sessionId", session);<br /> try {<br /> sessionMBeanName = new ObjectName("com.lightstreamer", props);<br /> } catch (MalformedObjectNameException e1) {<br /> // TODO<br /> return;<br /> }<br /> <br /> Object ret;<br /> try {<br /> ret = server.invoke(sessionMBeanName, "destroySession", null, null);<br /> } catch (InstanceNotFoundException e) {<br /> // it is still possible that the session has just ended<br /> return;<br /> } catch (MBeanException e) {<br /> // TODO<br /> return;<br /> } catch (ReflectionException e) {<br /> // TODO<br /> return;<br /> }<br /> <br /> if (((Boolean) ret).booleanValue() == false) {<br /> // it is still possible that the session has just ended<br /> return;<br /> }<br /> }<br />

Old note (until Web Client Library version 4.2.1)

Note that this closure strategy is entirely server-side and the client receives no notice of the closure reason.
The client only sees an unexpected closure.
This means that, if the client is a web page based on the Web Client Library, the client will enter stalled state and, eventually, an attempt to create a new session will be performed.
In this sense, option 3 may be preferrable to both 1 and 2.

New note (since Web Client Library version 4.2.2)

Note that, in case a session is forcibly closed by the Server, the Web Client Library enters in "DISCONNECTED" state and does not try to recover the session; it just notifies application code through the "onServerError" event handler, with proper error codes.

About getting extended information on the sessions by taking advantage of the JMX interface:
Old note (for LS Server up to and including 3.6)

It has to be considered that many of the SessionMBean methods (and getUserAgent in particular) have not been implemented yet.
This is not reported in the MBeanInfo interface, but is shown in the javadoc-style interface description.

New note (for LS Server 4.0 and later, still to be released at time of writing)

All the information available on the SessionMBean is reported in the javadoc-style interface description.
Note that the same information is available dynamically through the MBeanInfo interface.

Dario