Spring Security在会话TimeOut上获取身份验证：身份验证对象在会话超时时返回NULL

Question

我正在使用spring / spring-security 3.1并希望在会话超时时取决于ATHENTICATION对象中的权限。在会话超时时，AUTHENTICATION对象为空。

以下是供参考的文件：

安全配置：                                                                                      

    <logout invalidate-session="true" logout-url="/j_spring_security_logout"  success-handler-ref="logoutSuccessHandler"/>

    <!-- Custom filter to deny unwanted users even though registered -->
    <custom-filter ref="blacklistFilter" before="FILTER_SECURITY_INTERCEPTOR" />

    <!-- Custom filter for username, password and domain. The real customization is  done in the customAuthenticationManager -->
    <custom-filter ref="authenticationFilter" position="FORM_LOGIN_FILTER" />

</http>

注意：尝试使用“invalidate-session =”false“”。

和我的自定义LogoutSuccessHandler：

公共类EnterpriseLogoutSuccessHandler扩展SimpleUrlLogoutSuccessHandler {

@Override
public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
    for(GrantedAuthority authority: authentication.getAuthorities()){
        if(authority.getAuthority()!=null)
            logger.debug("THE CURRENT AUTHORITY FOR THE SESSION IS : {} ",authority.getAuthority().toString());
        else
            logger.debug("THE CURRENT AUTHORITY FOR THE SESSION IS authority.getAuthority(): NULL ");

        if(authority.getAuthority()!=null && authority.getAuthority().equalsIgnoreCase(Operational.SPRING_SECURITY.LOGIN_SOURCE_BEACON)){
            loginSource = authority.getAuthority().toString();
            break;
        }
    }
}
}

因此，有一个问题是如何在会话超时时获取Authentication对象。

有些人可以帮我找出解决上述问题的方法。

提前致谢。