title: spring security - is there an way to get session registry inside my application (without explicilty customizing the concurrentFilter)
body: <p>I was referring to <a href="http://forum.springsource.org/showthread.php?110686-SessionRegistry-getAllPrincipals">this</a> thread, and in the second last post by <code>Rob Winch</code> (Spring Security Lead), he mentions that we can have access to the sessionRegisty :</p>
  
  <pre><code>&lt;session-management&gt;
    &lt;concurrency-control session-registry-alias="sessionRegistry"/&gt;
  &lt;/session-management&gt;
  </code></pre>
  
  <p>Therefore, I register the <code>HttpSessionEventPublisher</code> filter in <code>web.xml</code> and specify the above setting in my <code>&lt;http&gt;</code> section. I <strong>DON'T</strong> add this :</p>
  
  <pre><code>&lt;beans:bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl" /&gt;
  </code></pre>
  
  <p>and in my class, I inject an instance of sessionRegistry like this :</p>
  
  <pre><code>@Autowired
  private SessionRegistry sessionRegistry
  </code></pre>
  
  <p>This is how I am trying to find out the sessions for a user:</p>
  
  <pre><code>List&lt;SessionInformation&gt; userSessions = sessionRegistry.getAllSessions(username,false);
          for (SessionInformation userSession : userSessions){
              userSession.expireNow();
          }
  </code></pre>
  
  <p>The principal is the username of the user. Upon debugging, the <code>sessionRegistry</code> variable's <code>principals</code> and <code>sessionids</code> variables are empty.
  Am I doing anything wrong here, or are the steps mentioned by <a href="http://krams915.blogspot.in/2010/12/spring-security-mvc-querying.html">krams's blog</a>, the only way to do this ?</p>