title: Unable to stop Concurrent Session in Spring Boot (Keycloak Authentication Server)
body: <p>I am able to implement authentication  functionality using  Spring Security and Keycloak(Working as expected). However, when I tried to stop concurrent login in the Spring Security configuration it is not working. I tried with keycloak configuration also ,however I came to know there is no such in build functionality/configuration to stop concurrent login.</p>
  
  <p><strong>Spring Boot Keycloak Configuration is as follows:</strong></p>
  
  <pre><code>SessionRegistry sesionregistry=new SessionRegistryImpl();
  
  @Autowired
  public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
      KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
      keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());
  
      auth.authenticationProvider(keycloakAuthenticationProvider);
  
  }
  
  @Bean
  @Override
  protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
      return new RegisterSessionAuthenticationStrategy(sesionregistry);
  }
  
  @Bean
  public KeycloakConfigResolver KeycloakConfigResolver() {return new KeycloakSpringBootConfigResolver();}
  
  @Override
  protected void configure(HttpSecurity http) throws Exception
  {
      super.configure(http);
  
      http
              .authorizeRequests()
              .antMatchers("/login").hasRole("user")
              .antMatchers("/app/*").hasRole("user")
              //.antMatchers("/logout").permitAll()
              .anyRequest().permitAll()
              .and()
              .authorizeRequests()
              .antMatchers("/admin*").hasRole("admin")
              .anyRequest().permitAll()
              .and()
              .logout().logoutUrl("/logout")
              .and()
              .sessionManagement().maximumSessions(1)
              .maxSessionsPreventsLogin(true)
  
              ; //for maximum 1 session for any user
  
  }
  </code></pre>
  
  <p>Using this configuration, I am able to login however concurrent login are not disabled.</p>
  
  <p>I tried to print Principal Object for same user different login and found that:
  <strong>Session 1:</strong> </p>
  
  <pre><code>org.keycloak.adapters.springsecurity.token.KeycloakAuthenticationToken@ec24d1c4:Principal: c8827230-1916-4026-923c-642be90d0d38; Credentials: [PROTECTED]; Authenticated: true; Details: org.keycloak.adapters.springsecurity.account.SimpleKeycloakAccount@7f2460bd; Granted Authorities: ROLE_user, ROLE_uma_authorization
  </code></pre>
  
  <p><strong>Session 2:</strong></p>
  
  <pre><code>org.keycloak.adapters.springsecurity.token.KeycloakAuthenticationToken@87138d52: Principal: c8827230-1916-4026-923c-642be90d0d38; Credentials: [PROTECTED]; Authenticated: true; Details: org.keycloak.adapters.springsecurity.account.SimpleKeycloakAccount@1e21cde6; Granted Authorities: ROLE_user, ROLE_uma_authorization
  </code></pre>
  
  <p>Even the hash value to 2 principal object differes:</p>
  
  <pre><code>Session 1: Printing Principal HAsh Value: -1854104148
  Session 2:     Printing Principal HAsh Value: -1904262684
  </code></pre>
  
  <p>I don't know how to solve the concurrent login issue. Any help appreciated.</p>
  
  <p>Thanks</p>