ConcurrentSessionControlStrategy in spring security 3.2.4
java, spring, spring-mvc, spring-security
Solution
Seems I'm late with the answer, but any way..
The functionality of `ConcurrentSessionControlStrategy` is exactly split between three Strategies now - `ConcurrentSessionControlAuthenticationStrategy`, `SessionFixationProtectionStrategy` and `RegisterSessionAuthenticationStrategy`.
To have a right substitute, you should use `CompositeSessionAuthenticationStrategy` adding these three delegates in mentioned order.
So, afraid, `ConcurrentSessionControlAuthenticationStrategy` is wrongly mentioned in deprecation comment as a substitute of `ConcurrentSessionControlStrategy`. It at least requires availability of `RegisterSessionAuthenticationStrategy` to maintain `SessionRegistry`. Otherwise, `SessionRegistry` remains empty, and the "substitute" always reports "ok".
I guess, the approach is changed to make it more flexible having several handlers as delegates instead of one (using `CompositeSessionAuthenticationStrategy`, you can have any number of `SessionAuthenticationStrategy`'s doing independent :) things).
Problem
I had a working configuration with ConcurrentSessionControlStrategy and my own sessionRegistry implementation. I upgraded to spring security 3.2.4 and had to change ConcurrentSessionControlStrategy to ConcurrentSessionControlAuthenticationStrategy. and now it seems that the sessionRegistry isn't connected meaning ConcurrentSessionControlAuthenticationStrategy.onAuthenticaton doesn't enter the sessionRegistry.registerNewSession. What to de? my configuration xml: ``` <security:http use-expressions="true" auto-config="false" entry-point-ref="loginUrlAuthenticationEntryPoint"> <security:intercept-url pattern="/**" access="isAuthenticated()" /> <security:custom-filter position="FORM_LOGIN_FILTER" ref="twoFactorAuthenticationFilter" /> <security:logout logout-url="/player/logout" logout-success-url="/demo/player/logoutSuccess" /> <security:session-management> <security:concurrency-control max-sessions="1" session-registry-ref="clusteredSessionRegistryImpl" error-if-maximum-exceeded="false" /> </security:session-management> </security:http> <bean class="org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy"> <constructor-arg ref="clusteredSessionRegistryImpl" /> <property name="maximumSessions" value="1" /> </bean> <bean id="loginUrlAuthenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"> <property name="loginFormUrl" value="/demo/player/login?login_error=true" /> </bean> <bean id="twoFactorAuthenticationFilter" class="com.XXX.filter.TwoFactorAuthenticationFilter"> <property name="authenticationManager" ref="authenticationManager" /> <property name="authenticationFailureHandler" ref="failureHandler" /> <property name="authenticationSuccessHandler" ref="playerAuthenticationSuccessHandler" /> <property name="postOnly" value="true" /> </bean> <bean id="failureHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"> <property name="defaultFailureUrl" value="/login?login_error=true" /> </bean> <bean id="bCryptPasswordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder" /> <security:authentication-manager alias="authenticationManager"> <security:authentication-provider ref="authenticationProvider"> </security:authentication-provider> </security:authentication-manager> </beans> ```