// We only care about session destroyed events
if (!Session.SESSION_DESTROYED_EVENT.equals(event.getType()))
return;
// Look up the single session id associated with this session (if any)
Session session = event.getSession();
if (LOG.isTraceEnabled())
LOG.trace("Process session destroyed on " + session);
String ssoId = null;
synchronized (reverse)
{
ssoId = reverse.get(session);
}
if (ssoId == null)
{
if (LOG.isTraceEnabled())
LOG.trace("ignoring as SSO is already closed for session " + session);
return;
}
try
{
// Was the session destroyed as the result of a timeout or
// the undeployment of the containing webapp?
// If so, we'll just remove the expired session from the
// SSO. If the session was logged out, we'll log out
// of all sessions associated with the SSO.
boolean timedOut;
boolean stopped = false;
if ( (timedOut = isSessionTimedOut(session)) || (stopped=isManagerStopped(session)))
{
if (LOG.isTraceEnabled())
LOG.trace(
"remove session " + session + " from SSO " + ssoId +
", isSessionTimedOut=" + timedOut +
", isManagerStopped=" + stopped
);
removeSession(ssoId, session);
// Quite poor. We hijack the caller thread (the Tomcat background thread)
// to do our cleanup of expired sessions
processExpires();
}
else
{
if (LOG.isTraceEnabled())
LOG.trace("user logged out of SSO " + ssoId);
// The session was logged out.
logout(ssoId);
}
}
catch (Exception e)
{
// Don't propagate back to the webapp; we don't want to disrupt
// the session expiration process
LOG.error("Caught exception updating SSO " + ssoId +
" following destruction of session " +
session.getIdInternal(), e);
}
}