title: Spring security concurrency-control does not work
body: <p>I try to implement concurrency-control in Spring security 3.2.
  I use form-login for auth.
  Here is my security.xml</p>
  
  <pre><code>    &lt;beans:beans xmlns="http://www.springframework.org/schema/security"
      xmlns:beans="http://www.springframework.org/schema/beans"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
            http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd"&gt;
  
  &lt;http access-denied-page="/login.html" create-session="ifRequired"&gt;
  
      &lt;intercept-url pattern="/settings.html" access="ROLE_USER"/&gt;
      &lt;intercept-url pattern="/history.html" access="ROLE_USER"/&gt;
  
      &lt;form-login login-page="/"
                  authentication-failure-url="/error.do"
                  default-target-url="/logged.do"
                  always-use-default-target="true"
                  login-processing-url="/j_spring_security_check"/&gt;
  
      &lt;logout logout-url="/j_spring_security_logout" logout-success-url="/index.html" invalidate-session="true"/&gt;   
  
      &lt;session-management session-authentication-strategy-ref="sas"/&gt;
  
      &lt;custom-filter ref="accessFilter" after="FORM_LOGIN_FILTER" /&gt;
      &lt;custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter" /&gt;
      &lt;custom-filter before="FORM_LOGIN_FILTER" ref="myAuthFilter" /&gt;
  &lt;/http&gt;
  
  &lt;beans:bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl" /&gt;
  
  &lt;beans:bean id="accessFilter" class="ua.com.site.http.filter.PlayerAccessFilter" /&gt;
  
  &lt;beans:bean id="passwordUserDetailService" class="ua.com.site.web.security.cristal.PasswordUserDetailService"&gt;
      &lt;beans:property name="playerDao" ref="playerDao"/&gt;
  &lt;/beans:bean&gt;
  
  &lt;beans:bean id="tokenUserDetailsService" class="ua.com.site.web.security.cristal.TokenUserDetailService"&gt;
      &lt;beans:property name="playerDao" ref="playerDao"/&gt;
  &lt;/beans:bean&gt;
  
  &lt;beans:bean id="passwordAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"&gt;
      &lt;beans:property name="passwordEncoder"&gt;
          &lt;beans:bean class="org.springframework.security.authentication.encoding.Md5PasswordEncoder" /&gt;
      &lt;/beans:property&gt;
      &lt;beans:property name="userDetailsService" ref="passwordUserDetailService" /&gt;
  &lt;/beans:bean&gt;
  
  &lt;beans:bean id="tokenAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"&gt;
      &lt;beans:property name="passwordEncoder"&gt;
          &lt;beans:bean class="org.springframework.security.authentication.encoding.PlaintextPasswordEncoder" /&gt;
      &lt;/beans:property&gt;
      &lt;beans:property name="userDetailsService" ref="tokenUserDetailsService" /&gt;
  &lt;/beans:bean&gt;
  
  &lt;authentication-manager alias="authenticationManager"&gt;
      &lt;authentication-provider ref="passwordAuthenticationProvider" /&gt;
      &lt;authentication-provider ref="tokenAuthenticationProvider" /&gt;
  &lt;/authentication-manager&gt;
  
  &lt;beans:bean id="concurrentSessionController" class="org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy"&gt;
      &lt;beans:constructor-arg name="sessionRegistry" ref="sessionRegistry" /&gt;
      &lt;beans:property name="maximumSessions" value="1" /&gt;
  &lt;/beans:bean&gt;
  
  
  &lt;beans:bean id="concurrencyFilter"
     class="org.springframework.security.web.session.ConcurrentSessionFilter"&gt;
    &lt;beans:property name="sessionRegistry" ref="sessionRegistry" /&gt;
    &lt;beans:property name="expiredUrl" value="/expired.html" /&gt;
  &lt;/beans:bean&gt;
  
  &lt;beans:bean id="myAuthFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"&gt;
    &lt;beans:property name="sessionAuthenticationStrategy" ref="sas" /&gt;
    &lt;beans:property name="authenticationManager" ref="authenticationManager" /&gt;
  &lt;/beans:bean&gt;
  
  &lt;beans:bean id="sas" class="org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy"&gt;
    &lt;beans:constructor-arg&gt;
      &lt;beans:list&gt;
        &lt;beans:bean class="org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy"&gt;
          &lt;beans:constructor-arg ref="sessionRegistry"/&gt;
          &lt;beans:property name="maximumSessions" value="1" /&gt;
          &lt;beans:property name="exceptionIfMaximumExceeded" value="true" /&gt;
        &lt;/beans:bean&gt;
        &lt;beans:bean class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy"&gt;
        &lt;/beans:bean&gt;
        &lt;beans:bean class="org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy"&gt;
          &lt;beans:constructor-arg ref="sessionRegistry"/&gt;
        &lt;/beans:bean&gt;
      &lt;/beans:list&gt;
    &lt;/beans:constructor-arg&gt;
  &lt;/beans:bean&gt;
  </code></pre>
  
  <p></p>
  
  <p>Listener </p>
  
  <pre><code>&lt;listener-class&gt;
  org.springframework.security.web.session.HttpSessionEventPublisher
  &lt;/listener-class&gt;
  </code></pre>
  
  <p>is included to my web.xml.</p>
  
  <p>I strat the app, run it in different browsers, log in in both but I have 2 sessions active. It seems that concurrency control doesn't work.</p>
  
  <p>How to implement concurrency control with using form-login?</p>
  
  <p>In previous versions I just used </p>
  
  <pre><code>&lt;session-management&gt;
          &lt;concurrency-control max-sessions="1" expired-url="/expired.html" error-if-maximum-exceeded="false" session-registry-ref="sessionRegistry" /&gt;
      &lt;/session-management&gt;
  </code></pre>
  
  <p>Thank you for any advice.</p>