весеннее время ожидания сеанса для удаления sessionInformation из sessionRegistry

Question

У меня есть приложение Grails 3.3.5 с плагином безопасности Spring (org.grails.plugins: spring-security-core: 3.2.2).

Я хотел бы удалить информацию о сеансе по истечении времени ожидания сеанса?

я пытался добавить CustomSecurityContextLogoutHandler , но он не получал триггер после истечения времени ожидания сеанса.

ресурсы.groovy

beans = {
    sessionRegistry(SessionRegistryImpl)
    customSessionLogoutHandler(CustomSessionLogoutHandler, ref('sessionRegistry'))
    customSecurityContextLogoutHandler(CustomSecurityContextLogoutHandler, ref('sessionRegistry'))

    sessionFixationProtectionStrategy(SessionFixationProtectionStrategy) {
        migrateSessionAttributes = true
        alwaysCreateSession = true
    }

    concurrentSingleSessionAuthenticationStrategy(ConcurrentSingleSessionAuthenticationStrategy,ref('sessionRegistry'))

    registerSessionAuthenticationStrategy(RegisterSessionAuthenticationStrategy, ref('sessionRegistry'))
    sessionAuthenticationStrategy(CompositeSessionAuthenticationStrategy, [ref('concurrentSingleSessionAuthenticationStrategy'), ref('sessionFixationProtectionStrategy'), ref('registerSessionAuthenticationStrategy')])
    concurrentSessionFilter(ConcurrentSessionFilter, ref('sessionRegistry'))

application.groovy

grails.plugin.springsecurity.logout.handlerNames = ['customSessionLogoutHandler', 'customSecurityContextLogoutHandler']

CustomSecurityContextLogoutHandler.groovy

package com.test

import org.springframework.security.core.session.SessionRegistry
import org.springframework.security.web.authentication.logout.LogoutHandler

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.util.Assert;

public class CustomSecurityContextLogoutHandler implements LogoutHandler {
    protected final Log logger = LogFactory.getLog(this.getClass());

    private final SessionRegistry sessionRegistry;
    private boolean invalidateHttpSession = true;
    private boolean clearAuthentication = true;

    public CustomSecurityContextLogoutHandler(SessionRegistry sessionRegistry) {
        Assert.notNull(sessionRegistry, "sessionRegistry cannot be null");
        this.sessionRegistry = sessionRegistry;
    }

    public void logout(HttpServletRequest request, HttpServletResponse response,
                       Authentication authentication) {
        Assert.notNull(request, "HttpServletRequest required");
        if (invalidateHttpSession) {
            HttpSession session = request.getSession(false);
            if (session != null) {
                println "Invalidating session: " + session.getId()
                logger.info("Invalidating session: " + session.getId())
                this.sessionRegistry.removeSessionInformation(session.getId());
                session.invalidate();
            }
        }

        if (clearAuthentication) {
            SecurityContext context = SecurityContextHolder.getContext();
            context.setAuthentication(null);
        }

        SecurityContextHolder.clearContext();
    }
}

CustomSecurityContextLogoutHandler.groovy

package com.test

import org.springframework.security.core.session.SessionRegistry
import org.springframework.security.web.authentication.logout.LogoutHandler

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.util.Assert;

public class CustomSecurityContextLogoutHandler implements LogoutHandler {
    protected final Log logger = LogFactory.getLog(this.getClass());

    private final SessionRegistry sessionRegistry;
    private boolean invalidateHttpSession = true;
    private boolean clearAuthentication = true;

    public CustomSecurityContextLogoutHandler(SessionRegistry sessionRegistry) {
        Assert.notNull(sessionRegistry, "sessionRegistry cannot be null");
        this.sessionRegistry = sessionRegistry;
    }

    public void logout(HttpServletRequest request, HttpServletResponse response,
                       Authentication authentication) {
        Assert.notNull(request, "HttpServletRequest required");
        if (invalidateHttpSession) {
            HttpSession session = request.getSession(false);
            if (session != null) {
                println "Invalidating session: " + session.getId()
                logger.info("Invalidating session: " + session.getId())
                this.sessionRegistry.removeSessionInformation(session.getId());
                session.invalidate();
            }
        }

        if (clearAuthentication) {
            SecurityContext context = SecurityContextHolder.getContext();
            context.setAuthentication(null);
        }

        SecurityContextHolder.clearContext();
    }
}

я ожидаювывод для удаления информации о сеансе из реестра сеансов по истечении времени ожидания / аннулирования