[
https://issues.apache.org/jira/browse/ISIS-999?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14263853#comment-14263853
]
Martin Grigorov commented on ISIS-999:
--------------------------------------
org.apache.wicket.Session#onInvalidate() is called for both cases.
When there is a RequestCycle then the user has used SignOut, when there is no
RequestCycle threadlocal then the web container notifies us about timed-out
session.
> Provide a log to administrator of which users logged in and logged out
> ----------------------------------------------------------------------
>
> Key: ISIS-999
> URL: https://issues.apache.org/jira/browse/ISIS-999
> Project: Isis
> Issue Type: New Feature
> Components: Core, Viewer: Wicket
> Affects Versions: viewer-wicket-1.7.0, core-1.7.0
> Reporter: Dan Haywood
> Assignee: Dan Haywood
> Fix For: viewer-wicket-1.9.0, core-1.9.0
>
>
> A log showing the following info (at least) must be available:
> * Account who has been logged.
> * Date/Time the session has been started.
> * Date/Time the session has been ended (by the user or automatically due to
> inactivity, etc.).
> ~~~
> Suggest that this be specified some sort of new optional service defined in
> the applib.
> If present, then on login and logout we can call this new optional service.
> I can imagine there being a requirement to surface this info in the UI, which
> probably means persisting to a database, ie some sort of new audit entity.
> Easiest option is to have the new service could be implemented by isisaddons'
> isis-module-security? Or perhaps a completely new isisaddon service if don't
> want to couple this?
> Not sure how to capture timeouts; is this info available through some sort of
> Wicket callback? Perhaps it should be done through a Quartz scheduler
> service, which can mark sessions as dead if not used for 15 minutes?
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
