title: spring security concurrent session not working
body: <p>I am using Spring 4 and Hibernate 4 I have implemented the Spring security and its working fine but, I do not want to allow concurrent logins using same credentials. 
  1. I have added the Listener "HttpSessionEventPublisher" to web.xml and used the "Session management" tag in spring security to implement the concurrency control but it is not working Following is the complete Code:</p>
  
  <p>web.xml:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"&gt;
  
  &lt;listener&gt;
      &lt;listener-class&gt;
          org.springframework.security.web.session.HttpSessionEventPublisher
      &lt;/listener-class&gt;
  &lt;/listener&gt;
  
  &lt;servlet&gt;
      &lt;servlet-name&gt;appServlet&lt;/servlet-name&gt;
      &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;/WEB-INF/spring/appServlet/servlet-context.xml&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
  &lt;/servlet&gt;
  
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;appServlet&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  
  &lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt; 
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p></p>
  
  <p>spring-security.xml</p>
  
  <pre><code>&lt;beans:beans xmlns="http://www.springframework.org/schema/security"
  xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.springframework.org/schema/beans
                      http://www.springframework.org/schema/beans/spring-beans.xsd    
                      http://www.springframework.org/schema/security
                      http://www.springframework.org/schema/security/spring-security.xsd"&gt;
  
  
  &lt;http auto-config="true" use-expressions="true"&gt;
      &lt;intercept-url pattern="/login" access="permitAll()" /&gt;
      &lt;intercept-url pattern="/loginError" access="isAnonymous()" /&gt;
      &lt;intercept-url pattern="/sessionTimeout" access="isAnonymous()" /&gt;
      &lt;intercept-url pattern="/forgotPassword" access="isAnonymous()" /&gt;
      &lt;intercept-url pattern="/requestNewPassword" access="isAnonymous()" /&gt;
      &lt;intercept-url pattern="/assets/**" access="permitAll()" /&gt;
  
      &lt;intercept-url pattern="/sessionExpired" access="isAnonymous()" /&gt;
      &lt;intercept-url pattern="/error" access="isAnonymous()" /&gt;
  
  
      &lt;form-login  login-page="/login"
                   username-parameter="userId"
                   password-parameter="password"
                   authentication-success-handler-ref="cdatSuccessHandler"
                   authentication-failure-url="/loginError" /&gt;
  
      &lt;!-- &lt;session-management session-fixation-protection="newSession" invalid-session-url="/sessionTimeout"&gt;
      &lt;/session-management&gt; --&gt;
  
      &lt;session-management&gt;
          &lt;concurrency-control max-sessions="1" expired-url="/sessionTimeout" /&gt;
      &lt;/session-management&gt;
  
      &lt;intercept-url pattern="/**" access="isAuthenticated()"/&gt;
  
      &lt;csrf/&gt;
  
      &lt;!-- &lt;access-denied-handler error-page="/sessionExpired"/&gt;  --&gt;
  
      &lt;headers&gt;
          &lt;xss-protection enabled="true" block="true"/&gt;
      &lt;/headers&gt;
  
  &lt;/http&gt;
  
  &lt;authentication-manager erase-credentials="true"&gt;
      &lt;authentication-provider ref="cdatAuthenticationProvider"&gt; &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  </code></pre>
  
  <p></p>
  
  <p>Authentication provider class</p>
  
  <pre><code>package com.component.cdat.security.configuration;
  
  import java.util.ArrayList;
  import java.util.Collection;
  import java.util.List;
  
  import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.security.authentication.AuthenticationProvider;
  import     org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  import org.springframework.security.core.Authentication;
  import org.springframework.security.core.AuthenticationException;
  import org.springframework.security.core.GrantedAuthority;
  import org.springframework.security.core.authority.SimpleGrantedAuthority;
  import org.springframework.stereotype.Component;
  
  import com.component.cdat.project.bean.MappProjectUser;
  import com.component.cdat.user.bean.User;
  import com.component.cdat.user.services.UserService;
  
  @Component("cdatAuthenticationProvider")
  public class CDATAuthenticationProvider implements AuthenticationProvider{
  
  @Autowired
  UserService userService;
  
  @Override
  public Authentication authenticate(Authentication authentication) throws AuthenticationException {
  
      String loginId = authentication.getName().trim();
      String password = (String) authentication.getCredentials();
  
      if(loginId == null || password == null || loginId.isEmpty() || password.isEmpty()){
          // throw exception
          System.out.println("username or password is empty!!");
          throw new NullPointerException();
      }
  
      User user = userService.getUserByUserName(loginId);
  
      if(user == null || !loginId.equalsIgnoreCase(user.getUserName())){
          System.out.println("User Not Found!!");
          throw new NullPointerException();
      }
  
      if(!password.equalsIgnoreCase(user.getPassword())){
          System.out.println("Pasword is incorrect!!");
          throw new NullPointerException();
      }
  
      Collection&lt;? extends GrantedAuthority&gt; authorities = getAuthorities(user);
  
      return new UsernamePasswordAuthenticationToken(user, password, authorities);
  }
  
  private Collection&lt;? extends GrantedAuthority&gt; getAuthorities(User user){
  
      List&lt;GrantedAuthority&gt; authorities = new ArrayList&lt;GrantedAuthority&gt;();
      List&lt;MappProjectUser&gt; userAuthorityList = userService.getUserRole(user.getUserId());
  
      for(MappProjectUser userAuthority : userAuthorityList){
          authorities.add(new SimpleGrantedAuthority("ROLE_" + userAuthority.getUserType().getShortDesc()));
      }
      return authorities;
  }
  
  @Override
  public boolean supports(Class&lt;?&gt; arg0) {
      return true;
  }
  }
  </code></pre>