title: Spring mvc sessionRegistry returns empty list of principals
body: <p>In order to change the authorities for authenticated users I need to retrieve all of these users, so I used SessionRegistry as shown in this <a href="https://www.baeldung.com/spring-security-track-logged-in-users#alternative-method-using-sessionregistry" rel="nofollow noreferrer">link</a>.</p>
  <p>But the <code>sessionRegistry.getAllPrincipals()</code> method returns an empty list.</p>
  <p>The configuration of my project is as follows :</p>
  <p>Web.xml :</p>
  <pre><code>&lt;web-app xmlns:xsi=&quot;http://www.w3.org/2001/XMLSchema-instance&quot;
      xmlns=&quot;http://java.sun.com/xml/ns/javaee&quot;
      xsi:schemaLocation=&quot;http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd&quot;
      version=&quot;3.0&quot;&gt;
      &lt;display-name&gt;loyfeey&lt;/display-name&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;/WEB-INF/spring-servlet.xml&lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;!-- &lt;context-param&gt; &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt; &lt;param-value&gt;com.mkyong.web.config&lt;/param-value&gt; 
          &lt;/context-param&gt; --&gt;
      &lt;listener&gt;
          &lt;listener-class&gt;
              org.springframework.security.web.session.HttpSessionEventPublisher&lt;/listener-class&gt;
      &lt;/listener&gt;
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
      &lt;/listener&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;spring&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;throwExceptionIfNoHandlerFound&lt;/param-name&gt;
              &lt;param-value&gt;true&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;spring&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
      &lt;filter&gt;
          &lt;filter-name&gt;encodingFilter&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.CharacterEncodingFilter&lt;/filter-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;encoding&lt;/param-name&gt;
              &lt;param-value&gt;UTF-8&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;forceEncoding&lt;/param-name&gt;
              &lt;param-value&gt;true&lt;/param-value&gt;
          &lt;/init-param&gt;
      &lt;/filter&gt;
  
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;encodingFilter&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
      &lt;error-page&gt;
          &lt;location&gt;/errors&lt;/location&gt;
      &lt;/error-page&gt;
  
      &lt;session-config&gt;
          &lt;session-timeout&gt;30&lt;/session-timeout&gt;
          &lt;cookie-config&gt;
              &lt;!-- if true then browser script won't be able to access the cookie --&gt;
              &lt;http-only&gt;false&lt;/http-only&gt;
              &lt;!--!if true then the cookie will be sent only over HTTPS connection --&gt;
              &lt;secure&gt;false&lt;/secure&gt;
          &lt;/cookie-config&gt;
          &lt;tracking-mode&gt;COOKIE&lt;/tracking-mode&gt;
      &lt;/session-config&gt;
  &lt;/web-app&gt; 
  </code></pre>
  <p>WebSecurityConfigurerAdapter</p>
  <pre><code>@Configuration
  @EnableWebSecurity
  @Transactional
  @Service
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private CompteDetailsService compteDetailsService;
  
      @Autowired
      private IMatcherService matcherDetailsService;
  
      @Autowired
      private CustomLogoutSuccessHandler logoutSuccessHandler;
  
      @Bean
      public SessionRegistry sessionRegistry() {
          return new SessionRegistryImpl();
      }
  
      @Bean
      public PasswordEncoder passwordEncoder() {
          return new BCryptPasswordEncoder();
      }
  
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
  
          auth.userDetailsService(compteDetailsService).passwordEncoder(passwordEncoder());
      }
  
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
  
  
          http.csrf().disable();
  
          http.authorizeRequests().antMatchers(/*some paths*/).permitAll();
  
          http.authorizeRequests().antMatchers(&quot;/**&quot;).access(&quot;hasRole('ROLE_ADMIN')&quot;);
          
      
          List&lt;Matcher&gt; matchers = matcherDetailsService.getMatchersConfig();
  
          for (Matcher matcher : matchers) {
              http.authorizeRequests()//
                      .antMatchers(&quot;/&quot; + matcher.getPath())//
                      .hasAnyAuthority(matcher.getPermission().toString());
  
          }
          http.authorizeRequests().anyRequest().denyAll();
  
  
          http.authorizeRequests().and().formLogin()
                  .loginProcessingUrl(&quot;/login&quot;) 
                  .loginPage(&quot;/&quot;)
                  .defaultSuccessUrl(&quot;/authentification/successful&quot;)
                  .failureUrl(&quot;/?error=true&quot;)
                  .usernameParameter(&quot;login&quot;)
                  .passwordParameter(&quot;password&quot;);
  
          
          http.authorizeRequests().and().logout()
                  .logoutUrl(&quot;/authentification/logout&quot;)
                   .logoutSuccessUrl(&quot;/&quot;);
                  .logoutSuccessHandler(logoutSuccessHandler);
           
      
     http.authorizeRequests().and().exceptionHandling().accessDeniedPage(&quot;/authentification/accessDenied&quot;);
          SessionRegistry sr = sessionRegistry();
  
          http.sessionManagement().maximumSessions(1).sessionRegistry(sessionRegistry());
      }
  }
  
  </code></pre>
  <p>If anyone can help me find out what I'm missing</p>