Spring-session: Spring Security Max Session Limit Not Working With Spring Session Redis

[ankurpathak]

I am using Spring Boot 2.0.6.RELEASE with Auto Configuration for Spring Security And Spring Session.
I am using following spring setting for max session limit:

.sessionManagement()
     .maximumSessions(2)
     .maxSessionsPreventsLogin(true)
     .sessionRegistry(sessionRegistry)

@Bean
public HttpSessionEventPublisher httpSessionEventPublisher() {
    return new HttpSessionEventPublisher();
}

@Autowired
private final  RedisOperationsSessionRepository sessionRepository;

@Bean
public SpringSessionBackedSessionRegistry sessionRegistry() {
    return new SpringSessionBackedSessionRegistry<>(this.sessionRepository);
}

Enabled key space notification in Redis with:
//config set notify-keyspace-events KEA
//config get notify-keyspace-events

After I am getting HttpSessionEvent fired for Session Created and Destroyed event.

But maximun session allowed limit is not working. With Above configuartion if I try to login three times
in a row, It should reject third login.. But it allows to login 3, 4, 5 , 6 etc times also. Am I missing something here or is it some restriction with Spring Session Redis?

[rwinch]

This looks like it should work. Can you provide a sample that demonstrates the issue?

[ankurpathak]

@rwinch
Here is a sample at git repository at url:
https://github.com/ankurpathak/spring-session-cocurrency
Steps to reproduce are in ReadMe file at:
https://github.com/ankurpathak/spring-session-cocurrency/blob/master/README.md

[rwinch]

The problem is that you are using a custom Authentication Filter which means you need to manually configure it to be aware of concurrency control (i.e. inject the ConcurrentSessionControlAuthenticationStrategy into the custom RestUsernamePasswordAuthenticationFilter). I sent a PR that fixes it https://github.com/ankurpathak/spring-session-cocurrency/pull/1

[ankurpathak]

@rwinch Now its works like a champ!!