title: Spring Security SessionRegistry java config only
body: <p>Can someone provide real working code snippet on <strong>how to get not empty SessionRegistry object in Spring Security using java config only</strong> (without any XML).</p>
  
  <p>I'm using <strong>Spring Security v4.0.1.RELEASE</strong></p>
  
  <p>And what I'm tried to do:</p>
  
  <ol>
  <li><strong>Implemented hashCode() and equals() methods in UserDetails</strong> with Apache Commons Lang:</li>
  </ol>
  
  <pre><code>
  
      @Override
      public int hashCode() {
          return HashCodeBuilder.reflectionHashCode(this, "password", "id", "role", "description", "registrationDate", "enabled");
      }
  
      @Override
      public boolean equals(Object obj) {
          return EqualsBuilder.reflectionEquals(this, obj, "password", "id", "role", "description", "registrationDate", "enabled");
      }
  
  </code></pre>
  
  <ol start="2">
  <li><strong>Enabled HttpSessionEventPublisher</strong>:</li>
  </ol>
  
  <pre><code>
  
      public class AppSecurityInitializer extends
              AbstractSecurityWebApplicationInitializer {
  
          @Override
          protected boolean enableHttpSessionEventPublisher() {
              return true;
          }
      }
  
  </code></pre>
  
  <ol start="3">
  <li><strong>Defined beans</strong> in security config class:</li>
  </ol>
  
  <pre><code>
  
      @Bean
      public SessionRegistry getSessionRegistry() {
          return new SessionRegistryImpl();
      }
  
      @Bean
      public SessionAuthenticationStrategy getSessionAuthStrategy(SessionRegistry sessionRegistry) {
          ConcurrentSessionControlAuthenticationStrategy controlAuthenticationStrategy =
                  new ConcurrentSessionControlAuthenticationStrategy(sessionRegistry);
  
          return controlAuthenticationStrategy;
      }
  
  </code></pre>
  
  <ol start="4">
  <li><strong>Set http security</strong>:</li>
  </ol>
  
  <pre><code>
      httpSecurity
              .formLogin().loginPage("/login")
              .defaultSuccessUrl("/", true)
              .successHandler(new LoginSuccessHandler())
              .and()
              .sessionManagement()
              .sessionAuthenticationStrategy(sessionAuthenticationStrategy).maximumSessions(1).maxSessionsPreventsLogin(true)
              .and().and()
              .csrf().disable();
      return httpSecurity;
  </code></pre>
  
  <p>Code works, it's prevents me to login under the same user twise, but when I'm getting SessionRegistry in controller class, it's always empty.</p>