Spring Security Concurrent Session Control Problem

[Júlio Adrian M Van Helden]

Hi guys, i am trying to setup the concurrent session control feature provided by Spring Security Framework. Whilst Spring Security context goes up without any error, i think that the concurrent session control isn´t work. My ideia was prevent a user from logging in multiple times. But when i open two browsers and try to log in in both with the same user Spring permits without any problem.

My web.xml and applicationContext-security you can find attached to this thread.

I appreciate any help.
Best Regards,
Julio Helden

[RayKrueger]

I believe the default configuration logs out the first user who logged in. Log in as Batman then log in as Batman again through a different session. The first Batman session should be logged out now.

Can you try that and see that it's working?

[J Ball]

I am having the same problem with the same entries in my web.xml and applicationContext-security.xml. I followed the security documentation. Any resolution to this?

I have debugged through HttpSecurityBeanDefinitionParser and see that that "sessionControlEnabled" is set to true, do it is reading my

<concurrent-session-control max-sessions="1" exception-if-maximum-exceeded="true" session-registry-ref='sessionRegistry'/>

It's as if the listener in my web.xml is not being triggered:

	<listener>
		<listener-class>org.springframework.security.ui.session.HttpSessionEventPublisher</listener-class>
	</listener>

[J Ball]

It's as if the listener in my web.xml is not being triggered:

	<listener>
		<listener-class>org.springframework.security.ui.session.HttpSessionEventPublisher</listener-class>
	</listener>

The listener is triggered as seen when I initially arrive at the login page (prior to login) and when I logout. Can someone suggest where to debug why the concurrent session max is ignored?

[J Ball]

I am using Spring on Tomcat if that makes any difference. Are there Tomcat configuration steps I need to take?

[gregd]

I believe the default configuration logs out the first user who logged in. Log in as Batman then log in as Batman again through a different session. The first Batman session should be logged out now.

Can you try that and see that it's working?

Correct. This is how it works