springSecurity错误IllegalArgumentException: SessionIdentifierAware did not return

remeberService和concurrent控制同时使用时报如下错误：

Got a problem with the latest Acegi from CVS - it seems that the first time a user logs in via a cookie, they are missing session details from their RememberMeAuthenticationToken. This causes assertions to fail for me.



Unknown Error = java.lang.IllegalArgumentException: SessionIdentifierAware did not return a Session ID (org.acegisecurity.ui.WebAuthenticationDetails@fff fc434: RemoteIpAddress: 10.6.17.53; SessionId: null)
java.lang.IllegalArgumentException: SessionIdentifierAware did not return a Session ID (org.acegisecurity.ui.WebAuthenticationDetails@fff fc434: RemoteIpAddress: 10.6.17.53; SessionId: null)
at org.springframework.util.Assert.hasText(Assert.jav a:169)
at org.acegisecurity.concurrent.SessionRegistryUtils. obtainSessionIdFromAuthentication(SessionRegistryU tils.java:53)
at org.acegisecurity.concurrent.ConcurrentSessionCont rollerImpl.checkAuthenticationAllowed(ConcurrentSe ssionControllerImpl.java:100)

 

解决方式为：

https://jira.springsource.org/browse/SEC-183

 

The anonymous and remember-me authentication mechanisms have been amended to not force session creation. Those using concurrent session support with either (or both) of these authentication mechanisms will be required to set HttpSessionContextIntegrationFilter.forceEagerSessionCreation = true.