Custom Spring Security Logout Filter

I need to de-authenticate a user (kill their session) within my spring security 3.0.5 web app and then send a redirect to another site to notify them of the logout. Is this possible within spring and if so what is the general approach to performing these tasks? Thanks!

import org.springframework.security.core.Authentication;
import org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler;

import com.dc.api.model.Users;

public class DCSimpleUrlLogoutSuccessHandler extends SimpleUrlLogoutSuccessHandler{

    public void onLogoutSuccess(javax.servlet.http.HttpServletRequest request, 
            javax.servlet.http.HttpServletResponse response,
            Authentication authentication)
     throws java.io.IOException,
            javax.servlet.ServletException{
            Users user=null;
            Object principal = authentication.getPrincipal();
            if (principal instanceof Users) {
                user = (Users) principal;
                if(user.getType().equals(TEST)){
                    response.sendRedirect("LogoutServlet");
                }
            }
            response.sendRedirect("login.html");

}

}

java.lang.IllegalStateException
    org.apache.catalina.c开发者_如何学Pythononnector.ResponseFacade.sendRedirect(ResponseFacade.java:463)
    javax.servlet.http.HttpServletResponseWrapper.sendRedirect(HttpServletResponseWrapper.java:138)
    org.springframework.security.web.context.SaveContextOnUpdateOrErrorResponseWrapper.sendRedirect(SaveContextOnUpdateOrErrorResponseWrapper.java:74)
    com.dc.api.service.impl.DCSimpleUrlLogoutSuccessHandler.onLogoutSuccess(DCSimpleUrlLogoutSuccessHandler.java:24)
    org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:100)
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)
    org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:79)
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)
    org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:169)
    org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:237)
    org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:167)

---

Actually the marked "correct answer" is about setting a custom logout success-handler, but not LogoutFilter , as defining in question.

So, if someone wants to create a custom logout filter, here is a snippet:

<bean id="securityContextLogoutHandler" class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"/>
<bean id="logoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter">
    <property name="filterProcessesUrl" value="/logout"/>
    <constructor-arg index="0" value="/"/>
    <constructor-arg index="1">
        <list>
            <ref bean="securityContextLogoutHandler"/>
            <!--ref bean="myLogoutHandler"/-->
        </list>
    </constructor-arg>
</bean>

This is a default filter class with one default predefined handler (this one invalidate session). If you really need a custom logout filter, then you should change this standard behavior (subclass this or write your own with the same interface). Also don't forget to register it:

    <security:http>
....
        <custom-filter position="LOGOUT_FILTER" ref="logoutFilter"/>
    </security:http>

UPDATE: After reading some spring code, I found, that there is one more default logout handler - RememberMeServices, defined with the interface AbstractRememberMeServices implements LogoutHandler. So if you are using RememberMeServices and want to write a custom filter including RememberMe support, you also need add a reference to your RememberMeServices in list of logout handlers.

---

Subclass SimpleUrlLogoutSuccessHandler and override onLogoutSuccess() to do the redirect.

Configure the logout success handler like:

<http>
  ...
  <logout success-handler-ref="myLogoutSuccessHandler"/>
</http>