title: Unable to restrict multiple login in different browsers
body: <p>i am trying to restrict a user logging into 2 different browsers, with the same loginid at the same time. this is the security context. I am not sure what I am doing wrong here.</p>
  
  <p>Can somebody help. Thanks.</p>
  
  <pre><code>&lt;security:http auto-config="false" lowercase-comparisons="false" entry-point-ref="loginUrlAuthenticationEntryPoint"&gt;
      &lt;security:custom-filter position="FORM_LOGIN_FILTER" ref="formLoginFilter" /&gt;
      &lt;security:custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter" /&gt;
  
      &lt;security:intercept-url pattern="/login.jsp" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
      &lt;security:intercept-url pattern="/invalidlogin.jsp" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
      &lt;security:intercept-url pattern="/accessdenied.jsp" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
      &lt;security:intercept-url pattern="/logout.jsp" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
      &lt;security:intercept-url pattern="/**.jsp" access="ROLE_GENERIC,ROLE_USER,ROLE_ADMIN" /&gt;
      &lt;security:intercept-url pattern="/**.html" access="ROLE_GENERIC,ROLE_USER,ROLE_ADMIN" /&gt;
      &lt;security:intercept-url pattern="/**.do" access="ROLE_GENERIC,ROLE_USER,ROLE_ADMIN" /&gt;
      &lt;security:intercept-url pattern="/**" filters="none" /&gt;
  
      &lt;security:logout logout-success-url="/logout.jsp" invalidate-session="true" /&gt;
  
      &lt;security:session-management&gt;
          &lt;security:concurrency-control max-sessions="1" error-if-maximum-exceeded="true" /&gt;
      &lt;/security:session-management&gt;
  &lt;/security:http&gt;
  
  &lt;bean id="loginUrlAuthenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"&gt;
      &lt;property name="loginFormUrl" value="/login.jsp" /&gt;
  &lt;/bean&gt;
  
  &lt;security:authentication-manager alias="authenticationManager"&gt;
      &lt;security:authentication-provider ref="myAuthenticationProvider" /&gt;
  &lt;/security:authentication-manager&gt;
  
  &lt;bean id="formLoginFilter" class="com.company.security.myMapUsernamePasswordAuthenticationFilter"&gt;
      &lt;property name="authenticationManager" ref="authenticationManager" /&gt;
      &lt;property name="authenticationSuccessHandler" ref="authenticationSuccessHandler" /&gt;
      &lt;property name="authenticationFailureHandler" ref="authenticationFailureHandler" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="authenticationSuccessHandler" class="com.company.security.AuthenticationSuccessHandlerImpl"&gt;
      &lt;property name="defaultTargetUrl" value="/main.do" /&gt;
      &lt;property name="alwaysUseDefaultTargetUrl" value="true" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="authenticationFailureHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"&gt;
      &lt;property name="defaultFailureUrl" value="/invalidlogin.jsp" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="myAuthenticationProvider" class="com.company.security.CustomUserDetailsService"&gt;
  &lt;/bean&gt;
  
  &lt;bean id="concurrencyFilter" class="org.springframework.security.web.session.ConcurrentSessionFilter"&gt;
      &lt;property name="sessionRegistry" ref="sessionRegistry" /&gt;
      &lt;property name="expiredUrl" value="/sessionexpired.jsp" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl" /&gt;
  </code></pre>
  
  <p></p>