Question

I want a method in a session scoped backing bean to be called after a user logs in. How can I do that?

Environment: Spring Security 3.0.x, Spring 3.0.x and JSF 1.2. The backing beans are managed by Spring.

Background: Sessions are created even without login. My session scoped bean holds settings, that are initially set to default values. After login I want to update the session state to the preferences stored in the database for that particular user. To achieve that I imagined an interface or even simpler an annotated (e.g. @PostLogin) method, but so far I have not found anything like that.

It would be OK if that method is called on every principal change, i.e. also on logout. It would also be acceptable if the whole bean is destructed and recreated on login, though my other session scoped beans should survive.

What I have found so far is:

• ApplicationListener<AuthenticationSuccessEvent>: The listener apparently needs to be application scoped, and I can’t get access to my session scoped bean in it. @Autowired plus scope proxy don’t work. The injected object is broken; it does not contain its dependencies although the real backing bean does.
• <form-login authentication-success-handler-ref=”..”>: haven’t tried this, but I need the method to be called independent of the used login procedure. Other than form based we support remember me and programmatic login (e.g. automatically logged in after password forgotten process).

Answer 1

Answering my own question:

ApplicationListener was the right track, however @Autowired was not.

I defined an interface with one method, that is implemented by my session scoped bean. The (singleton scoped) event listener class then uses ApplicationContext.getBeansOfType(..) to find the session beans by that interface and invokes the interface’s method on each of them.