title: how to obtain a list of all currently logged-in users (including rememberme cookies) in grails with spring security
body: <p>I'm building a grails app that has the spring-security-core 1.2.7.3 plugin as well as spring-security-ui 0.2 plugin, and would like to obtain a list of ALL the users that are currently logged in (ie have a currently active session). Users can login either through a login controller (daoAuthenticationProvider) or automatically through a rememberMe cookie.
  I have implemented the code below, using ConcurrentSessionControlStrategy to create a sessionRegistry:</p>
  
  <p>in /conf/spring/resources.groovy:</p>
  
  <pre><code>import org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy
  import org.springframework.security.web.session.ConcurrentSessionFilter
  import org.springframework.security.core.session.SessionRegistryImpl
  import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy
  
  beans = {
  userDetailsService(lablore.MyUserDetailsService)
  
      sessionRegistry(SessionRegistryImpl)
  
      sessionAuthenticationStrategy(ConcurrentSessionControlStrategy, sessionRegistry) {
          maximumSessions = -1
      }
  
      concurrentSessionFilter(ConcurrentSessionFilter){
          sessionRegistry = sessionRegistry
          expiredUrl = '/login/concurrentSession'
      }
  
  }
  </code></pre>
  
  <p>In /plugins/spring-security-core/conf/DefaultSecurityConfig.groovy</p>
  
  <pre><code>useHttpSessionEventPublisher = true
  </code></pre>
  
  <p>In the controller:</p>
  
  <pre><code>controller{
      def sessionRegistry
  
      action(){
          def loggedInUsers = sessionRegistry.getAllPrincipals()
      }
  }
  </code></pre>
  
  <p>It works well for 
  -users that login through the login page
  -users that logout through a 'logout' link
  -users who's session expires
  HOWEVER, it does NOT work for users that authenticate automatically with a rememberMe cookie. It doesn't see that they have a newly created session.
  If I understand correctly, this is because the RememberMeAuthenticationFilter is 'further up' in the filter chain compared to the ConcurrentSessionFilter, which is the one running the sessionRegistry? Or, I messed something up with my configurations....</p>
  
  <p>Any help on how to get this to work would be great !</p>
  
  <p>Thanks!!</p>