title: How to get serialized tomcat HttpSession to repopulate spring SessionRegistry
body: <p>I do the following: </p>
  
  <ol>
  <li>login to my spring application (e.g. as user 'admin')</li>
  <li>stop tomcat </li>
  <li>Now I see the session being serialized into <strong>sessions.ser</strong> file </li>
  <li>I restart tomcat</li>
  <li>the sessions.ser file disappears (I guess it is being deserialized during server start?) </li>
  <li>Now I send a request which requires a logged-in user (as done
  in step 1, i.e. I hit F5 in the browser where I was already logged-in before, so I guess the request sends along the jSessionId etc.)</li>
  <li>When debugging, I can observe how spring successfully loads the SecurityContext in</li>
  </ol>
  
  <p><code>HttpSessionSecurityContextRepository.readSecurityContextFromSession</code></p>
  
  <p>with the stored Session-Information (it is a UsernamePasswordAuthenticationToken containing an Authentication object containing the Principal etc. thus getting the custom User object seems possible)</p>
  
  <ol start="8">
  <li>Spring accepts the request, i.e. there is no need to re-login and the appropiate response is sent</li>
  </ol>
  
  <p>However, when trying to list the logged-in users using the <code>SessionRegistry</code> via</p>
  
  <pre><code>for (Object principal : sessionRegistry.getAllPrincipals()) {
              MyCustomUser myCustomUser = (MyCustomUser) principal;
              ClientQueryDetails client = clientQuery.getDetails(myCustomUser 
                      .getClientId()).get();
              List&lt;SessionInformation&gt; sessions = sessionRegistry.getAllSessions(
                      principal, false);
              for (SessionInformation sessionInformation : sessions) {
                  result.add(new SessionInfo(client.getName(), myCustomUser 
                          .getUsername(), sessionInformation.getSessionId(),
                          sessionInformation.getLastRequest()));
              }
          }
  </code></pre>
  
  <p>as I normally do to visualize the users/sessions currently active, it is <strong>empty</strong>.</p>
  
  <p>Why does Spring not add those Principals to the SessionRegistry in this moment?
  Can/Should I do it somehow manually?</p>
  
  <p>I've read <a href="https://github.com/spring-projects/spring-security/issues/2062" rel="nofollow noreferrer">https://github.com/spring-projects/spring-security/issues/2062</a> which sounds like doing so would be a bad idea. </p>
  
  <p>Also related seems <a href="https://stackoverflow.com/questions/18271727/getting-logged-in-users-with-sessionregistry-not-work-when-manually-authenticate">Getting logged in users with sessionRegistry not work when manually authenticate</a> </p>
  
  <p>I've also found <a href="http://forum.spring.io/forum/spring-projects/web/71503-spring-not-restoring-persistent-sessions-to-session-registry" rel="nofollow noreferrer">http://forum.spring.io/forum/spring-projects/web/71503-spring-not-restoring-persistent-sessions-to-session-registry</a></p>
  
  <p>So to summarize my questions:</p>
  
  <ol>
  <li>Why doesn't spring re-add the serialized session informations to the <code>SessionRegistry</code>?</li>
  <li>Is querying the <code>SessionRegistry</code> in order to display all active Sessions to the user (i.e. the logged-in users) the correct way to do so?
  <strong>EDIT</strong>
  Yes, this is definitely the purpose of the SessionRegisty: <a href="https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#list-authenticated-principals" rel="nofollow noreferrer">https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#list-authenticated-principals</a> </li>
  <li><p>Should I add the <code>Principal</code>s manually to the SessionRegistry?
  <strong>EDIT</strong> 
  <a href="https://github.com/spring-projects/spring-security/issues/2062" rel="nofollow noreferrer">https://github.com/spring-projects/spring-security/issues/2062</a> provides different ways of manually readding sessions to the SessionRegistry, however it seems there are some caveats in doing so.</p></li>
  <li><p>Where and how exactely is the Session from <strong>sessions.ser</strong> being deserialized into and where does spring obtain it? Or in other words, how does the session-information get from the sessions.ser file into the <code>SecurityContext</code> of spring? Especially how is it "handed over" from tomcat to spring?</p></li>
  </ol>