Writing aspectd to trap usernames after successful logins and logouts (Spring Security 3.0.X)

I'm writing a pair of aspects. The first is to trap usernames when users successfully authenticate against my web app and the other is to trap when they explicitly logo开发者_高级运维ut. I'm having trouble finding Spring framework methods which are called only once and which will therefore let me capture this information.

We are using a basic Spring Security 3.0 configuration, with our only additions being to provide our own UserDetailsService implementation.

Can anyone help?

---

It turns out that this was completely the wrong way to do this. Spring has a set of baked-in ApplicationEvent classes which you can create ApplicationListeners to catch. Strangely, there seems to be no "LogoutEvent" but there are the very useful AuthenticationSuccessEvent, AbstractAuthenticationFailureEvent, HttpSessionCreationEvent and HttpSessionDestroyedEvent. Most interesting of all is the RequestHandledEvent.

To catch these I created my own bean which implemented

org.springframework.context.ApplicationListener;

and overrode

public void onApplicationEvent(ApplicationEvent appEvent)

In this I just if/else my way through the various appEvent types and take the appropriate actions to track users and sessions.