Spring Session integration with Spring Security on concurrent session control

[ltzdby]

I'm configuring Spring Session integration with Spring Security on concurrent session control, on Spring Boot. I followed the steps illustrated on Spring Session reference but got an error:

Description:

Field sessionRepository in com.xxx.configuration.WebSecurityConfiguration required a bean of type 'org.springframework.session.FindByIndexNameSessionRepository' that could not be found.

The injection point has the following annotations:

• @org.springframework.beans.factory.annotation.Autowired(required=true)

Action:

Consider defining a bean of type 'org.springframework.session.FindByIndexNameSessionRepository' in your configuration.

Versions:
Spring Boot 2.1.2.RELEASE
Spring Session 2.1.3.RELEASE
Spring Security 5.1.3.RELEASE

Here is some code for reproducing:

WebSecurityConfiguration.java:

@Configuration
@EnableWebSecurity
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
    ...

    @Autowired
    protected FindByIndexNameSessionRepository<? extends Session> sessionRepository;

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity.authorizeRequests()
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .and()
                .logout()
                .logoutUrl("/logout")
                .logoutSuccessUrl("/");
        httpSecurity.sessionManagement()
                .maximumSessions(1)
                .maxSessionsPreventsLogin(false)
                .sessionRegistry(sessionRegistry());
    }

    @Bean
    protected SpringSessionBackedSessionRegistry sessionRegistry(){
        return new SpringSessionBackedSessionRegistry<>(this.sessionRepository);
    }
}

application.properties:

...
spring.session.store-type=redis
spring.session.redis.flush-mode=on_save
spring.session.redis.namespace=spring:session
...

I've also tried the code following, but it does not working:

WebSecurityConfiguration.java:

@Configuration
@EnableWebSecurity
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
    ...

    @Autowired
    **protected FindByIndexNameSessionRepository sessionRepository;**

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity.authorizeRequests()
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .and()
                .logout()
                .logoutUrl("/logout")
                .logoutSuccessUrl("/");
        httpSecurity.sessionManagement()
                .maximumSessions(1)
                .maxSessionsPreventsLogin(false)
                .sessionRegistry(sessionRegistry());
    }

    @Bean
    protected SpringSessionBackedSessionRegistry sessionRegistry(){
        **return new SpringSessionBackedSessionRegistry(this.sessionRepository);**
    }
}

I wonder if I should define a bean of type 'FindByIndexNameSessionRepository' somewhere in my configuration, even with Spring Boot's auto-configuration? I looked up documents of Spring Session, Spring Boot and Spring Security but found no further information.
Is there any mistake in my usage of Spring Session (and Spring Boot's auto-configuration) or the document needs further explanation of this integration ( or it is a bug ) ?

[ltzdby]

Solve this issue by adding a dependency to pom.xml:

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-redis</artifactId>
  <version>1.4.7.RELEASE</version>
</dependency>

Hope to add this dependency to the document HttpSession with Redis Guide to avoid more confusion like this issue. ^_^

[DongJigong]

try do this

<dependency> <groupId>org.springframework.session</groupId> <artifactId>spring-session-data-redis</artifactId> </dependency>

[mivui]

if you use redis,@EnableRedisHttpSession must be enabled

//{@link RedisHttpSessionConfiguration#sessionRepository()}
@Autowired
private RedisOperationsSessionRepository redisOperationsSessionRepository;

@Bean
public SpringSessionBackedSessionRegistry sessionRegistry() {
    return new SpringSessionBackedSessionRegistry<>(redisOperationsSessionRepository);
}

Or reference #1304