public void onAuthentication(Authentication authentication,
			HttpServletRequest request, HttpServletResponse response) {

		final List<SessionInformation> sessions = sessionRegistry.getAllSessions(
				authentication.getPrincipal(), false);

		int sessionCount = sessions.size();
		int allowedSessions = getMaximumSessionsForThisUser(authentication);

		if (sessionCount < allowedSessions) {
			// They haven't got too many login sessions running at present
			return;
		}

		if (allowedSessions == -1) {
			// We permit unlimited logins
			return;
		}

		if (sessionCount == allowedSessions) {
			HttpSession session = request.getSession(false);

			if (session != null) {
				// Only permit it though if this request is associated with one of the
				// already registered sessions
				for (SessionInformation si : sessions) {
					if (si.getSessionId().equals(session.getId())) {
						return;
					}
				}
			}
			// If the session is null, a new one will be created by the parent class,
			// exceeding the allowed number
		}

		allowableSessionsExceeded(sessions, allowedSessions, sessionRegistry);
	}
public void onAuthentication ( Authentication authentication , HttpServletRequest request , HttpServletResponse response ) { final List < SessionInformation > sessions = sessionRegistry . getAllSessions ( authentication . getPrincipal ( ) , false ) ; int sessionCount = sessions . size ( ) ; int allowedSessions = getMaximumSessionsForThisUser ( authentication ) ; if ( sessionCount < allowedSessions ) { return ; } if ( allowedSessions == - 1 ) { return ; } if ( sessionCount == allowedSessions ) { HttpSession session = request . getSession ( false ) ; if ( session != null ) { for ( SessionInformation si : sessions ) { if ( si . getSessionId ( ) . equals ( session . getId ( ) ) ) { return ; } } } } allowableSessionsExceeded ( sessions , allowedSessions , sessionRegistry ) ; }
In addition to the steps from the superclass, the sessionRegistry will be updated
with the new session information.