title: Spring Security SessionRegistry returning empty list
body: <p>Friends I have search a lot and try every solution available on the internet, but my problem not solved.</p>
  
  <p>I want check (in Spring Boot web application) currently user logged in with the credentials specify in the login page, if there is a session with username currently, then invalidate that first a login again for the request. </p>
  
  <p>I want to ensure there will be one session for the user, if session exist then invalidate and login forcefully.</p>
  
  <p>I am trying to get all the principle from the <code>SessionRegistry</code>, but it always returning <code>[]</code> empty list even after multiple user logged in the system.</p>
  
  <p><strong>Here is my spring security config</strong></p>
  
  <pre><code>...
  @Autowired private CustomUserDetailsService customUserDetailsService;
      @Autowired private CustomUrlAuthenticationSuccessHandler customUrlAuthenticationSuccessHandler;
      @Autowired private PasswordEncoder passwordEncoder;
  
  @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
          auth.authenticationProvider(authProvider());
      }
  
  @Bean
      JCaptchaAuthenticationFilter jCaptchaAuthenticationFilter() throws Exception {
          JCaptchaAuthenticationFilter jCaptchaAuthenticationFilter = new JCaptchaAuthenticationFilter();
          jCaptchaAuthenticationFilter.setAuthenticationManager(authenticationManager());
          jCaptchaAuthenticationFilter.setAuthenticationFailureHandler(customLoginFailureHandler());
          jCaptchaAuthenticationFilter.setAuthenticationSuccessHandler(customUrlAuthenticationSuccessHandler);
          return jCaptchaAuthenticationFilter;
      }
  @Bean
      public DaoAuthenticationProvider authProvider() {
          DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
          authProvider.setUserDetailsService(customUserDetailsService);
          authProvider.setPasswordEncoder(passwordEncoder);
          return authProvider;
      }
  @Bean
      public CustomLoginFailureHandler customLoginFailureHandler() {
          CustomLoginFailureHandler customLoginFailureHandler = new CustomLoginFailureHandler("/login");
          return customLoginFailureHandler;
      }
  
  @Override
      protected void configure(HttpSecurity http) throws Exception {// @formatter:off
          http.authorizeRequests().antMatchers("/js/**", "/fonts/**", "/css/**", "/images/**", "/favicon.ico").permitAll()
          .antMatchers("/", "/register/**", "/email/**", "/captcha.png/**").permitAll().antMatchers("/login/**")
          .permitAll()// Basically I'm allowing parameters for login so
          // .antMatchers("/services/**").permitAll()
          .antMatchers("/forgot/password/**", "/user/verify/**").permitAll().antMatchers("/user/resetPassword*")
          .hasAuthority("CHANGE_PASSWORD_PRIVILEGE").anyRequest().authenticated().and()
          .addFilterBefore(jCaptchaAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class).formLogin()
          .loginPage("/login").permitAll().and()
          .csrf().disable()
          .sessionManagement().invalidSessionUrl("/invalidSession")
          .maximumSessions(1)
          .maxSessionsPreventsLogin(true)
          .sessionRegistry(sessionRegistry()).and()
          .sessionFixation().newSession().and()
          .logout()
          .logoutRequestMatcher(new AntPathRequestMatcher("/logout")).logoutSuccessUrl("/")
          .invalidateHttpSession(false).deleteCookies("JSESSIONID").permitAll();
          http.headers().frameOptions().sameOrigin();
  
      }
  ....
  @Bean
  SessionRegistry sessionRegistry() {         
      return new SessionRegistryImpl();
  }
  
  @Bean
  public HttpSessionEventPublisher httpSessionEventPublisher() {
      return new HttpSessionEventPublisher();
  }
  </code></pre>
  
  <p><strong>Here is i am getting sessions list</strong></p>
  
  <pre><code>List&lt;String&gt; userList = sessionRegistry.getAllPrincipals().stream()
            .filter(u -&gt; !sessionRegistry.getAllSessions(u, true).isEmpty())
            .map(Object::toString)
            .collect(Collectors.toList());
  </code></pre>
  
  <p>But above code always return empty list. I have checked is there any double sessionRegistry loading by disabling sessionRepositry, but spring throw exception that bean not found.</p>
  
  <p>Please help friends. </p>