Spring Security Max Login Session

Question

Hi. I have a problem with my j2ee application using spring security. I set max-sessions in concurrent-session-control to 1. Now it works fine when I try to Login the second time it will stop me. But when I logout the other one and try to login again I still get this same message.

Your login attempt was not successful, try again. Reason: Maximum sessions of 1 for this principal exceeded

I have this in my http security

 <security:logout logout-url="/logout.do"
  invalidate-session="true" logout-success-url="/logoutSuccess.do" />
 <security:concurrent-session-control
  max-sessions="1" exception-if-maximum-exceeded="true" expired-url="/loginform.do" />

Answer 1

Hi, please check that the error page is not cached (press F5) and look in the logs to see if the logout is working fine.

Answer 2

1. Make sure your Spring Security Filters run before your Struts Filter.
2. Set a break point at Spring Security's LogoutFilter.doFilterHttp method. Make sure that part runs properly.

Answer 3

It's been quite a while since you posted this, but if anyone else is having this problem I believe this behavior will occur if you don't add org.springframework.security.web.session.HttpSessionEventPublisher as a listener in your web.xml.

See here:

Adding the listener to web.xml causes an ApplicationEvent to be published to the Spring ApplicationContext every time a HttpSession commences or terminates. This is critical, as it allows the SessionRegistryImpl to be notified when a session ends. Without it, a user will never be able to log back in again once they have exceeded their session allowance, even if they log out of another session or it times out.