 <p>I've got the same issue. The cause was I'm using the Spring Java Config for Spring Security using the DSL. Using the current Spring Security 4.0.1, the Configurer will create a SessionRegistry only on demand and (it looks like) not as a registered bean component.</p> <p>I have fixed this with an explicit definition of the SessionRegistry.</p> <pre><code> http .sessionManagement() .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED) .sessionFixation() .migrateSession() .maximumSessions(10) .sessionRegistry(sessionRegistry()) // &lt;&lt; this here! .and() .and() </code></pre> <p>and</p> <pre><code>@Bean public SessionRegistry sessionRegistry() { return new SessionRegistryImpl(); } </code></pre> <p>Unless Hazelcast's <code>WebFilter</code> is used, this is not required since Spring's <code>SessionManagementConfigurer</code> will ensure an instance of <code>SessionRegistry</code> will be created. But it cannot be find using the type <code>SessionRegistry</code>...</p>