title: SessionRegistry.getAllPrincipals() return empty list
body: <p>I have config my spring security as follow:</p>
  
  <p>root-context</p>
  
  <pre><code>        &lt;import resource="classpath:springConfig.xml" /&gt;
      &lt;import resource="appServlet/servlet-context.xml" /&gt;
      &lt;import resource="appServlet/spring-security.xml" /&gt;
  
      &lt;bean id="InitializationService"
          class="kh.com.gfam.rsos.businesslogic.initialization.impl.InitializationServiceImpl"&gt;
      &lt;/bean&gt;
  
  
  
      &lt;bean id="messageSource"
          class="org.springframework.context.support.ReloadableResourceBundleMessageSource"&gt;
          &lt;property name="basename" value="classpath:messages_en"&gt;&lt;/property&gt;
          &lt;property name="defaultEncoding" value="UTF-8"&gt;&lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;!-- Custom Spring Security --&gt;
  
      &lt;bean id="companyIdUsernamePasswordAuthenticationProvider"
          class="kh.com.gfam.rsos.common.security.RsosAuthenticationProvider" /&gt;
  
      &lt;bean id="companyIdUsernamePasswordAuthenticationFilter"
          class="kh.com.gfam.rsos.common.security.RsosUsernamePasswordAuthenticationFilter"&gt;
          &lt;property name="authenticationManager" ref="authenticationManager" /&gt;
          &lt;property name="sessionAuthenticationStrategy" ref="sas" /&gt;
          &lt;property name="authenticationFailureHandler" ref="authenticationFailureHandler" /&gt;
          &lt;property name="authenticationSuccessHandler" ref="authenticationSuccessHandler" /&gt;
          &lt;property name="filterProcessesUrl" value="/Authenticate" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="loginUrlAuthenticationEntryPoint"
          class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"&gt;
          &lt;constructor-arg value="/Login" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="authenticationFailureHandler"
          class="org.springframework.security.web.authentication.ExceptionMappingAuthenticationFailureHandler"&gt;
          &lt;property name="defaultFailureUrl" value="/Login/defaultError" /&gt;
          &lt;property name="exceptionMappings"&gt;
              &lt;props&gt;
                  &lt;prop
                      key="org.springframework.security.authentication.BadCredentialsException"&gt;
                      /Login/badCredentials
                  &lt;/prop&gt;
                  &lt;prop
                      key="org.springframework.security.core.userdetails.UsernameNotFoundException"&gt;
                      /Login/userNotFound
                  &lt;/prop&gt;
                  &lt;prop
                      key="org.springframework.security.authentication.DisabledException"&gt;
                      /Login/disabled
                  &lt;/prop&gt;
                  &lt;prop
                      key="org.springframework.security.authentication.ProviderNotFoundException"&gt;
                      /Login/providerNotFound
                  &lt;/prop&gt;
                  &lt;prop
                      key="org.springframework.security.authentication.AuthenticationServiceException"&gt;
                      /Login/authenticationService
                  &lt;/prop&gt;
              &lt;/props&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;bean id="authenticationSuccessHandler"
          class="kh.com.gfam.rsos.common.security.RsosAuthenticationSuccessHandler"&gt;
      &lt;/bean&gt;
  
      &lt;bean id="RsosLogoutSuccessHandler"
          class="kh.com.gfam.rsos.common.security.RsosLogoutSucessHandler"&gt;&lt;/bean&gt;
  
      &lt;bean id="concurrencyFilter"
          class="org.springframework.security.web.session.ConcurrentSessionFilter"&gt;
          &lt;constructor-arg name="sessionRegistry" ref="sessionRegistry" /&gt;
          &lt;constructor-arg name="expiredUrl" value="/session-expired.jsp" /&gt;
  
      &lt;/bean&gt;
  
      &lt;bean id="sessionRegistry"
          class="org.springframework.security.core.session.SessionRegistryImpl" /&gt;
  
      &lt;bean id="sas"
          class="org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy"&gt;
          &lt;constructor-arg&gt;
              &lt;list&gt;
                  &lt;bean
                      class="org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy"&gt;
                      &lt;constructor-arg ref="sessionRegistry" /&gt;
                      &lt;property name="maximumSessions" value="1" /&gt;
                      &lt;property name="exceptionIfMaximumExceeded" value="true" /&gt;
                  &lt;/bean&gt;
                  &lt;bean
                      class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy" /&gt;
                  &lt;bean
                      class="org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy"&gt;
                      &lt;constructor-arg ref="sessionRegistry" /&gt;
                  &lt;/bean&gt;
              &lt;/list&gt;
          &lt;/constructor-arg&gt;
      &lt;/bean&gt;
  </code></pre>
  
  <p>spring-security.xml</p>
  
  <pre><code>&lt;http auto-config="false" use-expressions="true"
          entry-point-ref="loginUrlAuthenticationEntryPoint"&gt;  
          &lt;intercept-url pattern="/Admin/**" access="hasRole('ROLE_ADMIN')" /&gt;
          &lt;intercept-url pattern="/Concierge/**" access="hasRole('ROLE_USER')" /&gt;
          &lt;intercept-url pattern="/**" access="permitAll" /&gt;
          &lt;custom-filter position="FORM_LOGIN_FILTER"
              ref="companyIdUsernamePasswordAuthenticationFilter" /&gt;  
          &lt;custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter" /&gt;
          &lt;logout logout-url="/Logout" delete-cookies="true"
              invalidate-session="true" success-handler-ref="RsosLogoutSuccessHandler" /&gt;
          &lt;csrf disabled="true" /&gt;
          &lt;session-management invalid-session-url="/Login"
              session-authentication-strategy-ref="sas" /&gt;
  
          &lt;access-denied-handler error-page="/accessDenied" /&gt;
      &lt;/http&gt;
  
      &lt;global-method-security secured-annotations="enabled" /&gt;
  
      &lt;authentication-manager alias="authenticationManager"&gt;
          &lt;authentication-provider
              ref="companyIdUsernamePasswordAuthenticationProvider" /&gt;  
      &lt;/authentication-manager&gt;
  </code></pre>
  
  <p>web.xml</p>
  
  <pre><code>&lt;context-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;/WEB-INF/spring/root-context.xml&lt;/param-value&gt;
      &lt;/context-param&gt;
  
      &lt;context-param&gt;
          &lt;param-name&gt;webAppRootKey&lt;/param-name&gt;
          &lt;param-value&gt;webapp.root&lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;log4jExposeWebAppRoot&lt;/param-name&gt;
          &lt;param-value&gt;true&lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;log4jConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;/WEB-INF/classes/log4j.properties&lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.util.WebAppRootListener&lt;/listener-class&gt;
      &lt;/listener&gt;
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.util.Log4jConfigListener&lt;/listener-class&gt;
      &lt;/listener&gt; 
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
      &lt;/listener&gt;
  
      &lt;listener&gt;
          &lt;listener-class&gt;kh.com.gfam.rsos.listener.InitializeApplicationListner&lt;/listener-class&gt;
      &lt;/listener&gt;
  
      &lt;servlet&gt;
          &lt;servlet-name&gt;appServlet&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
              &lt;param-value&gt;/WEB-INF/spring/appServlet/servlet-context.xml&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;multipart-config&gt;
              &lt;max-file-size&gt;10485760&lt;/max-file-size&gt;
              &lt;max-request-size&gt;104857600&lt;/max-request-size&gt;
              &lt;file-size-threshold&gt;20971520&lt;/file-size-threshold&gt;
          &lt;/multipart-config&gt;
      &lt;/servlet&gt;
  
  
  
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;appServlet&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;default&lt;/servlet-name&gt;
          &lt;url-pattern&gt;*.css&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;default&lt;/servlet-name&gt;
          &lt;url-pattern&gt;*.js&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;default&lt;/servlet-name&gt;
          &lt;url-pattern&gt;*.png&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;default&lt;/servlet-name&gt;
          &lt;url-pattern&gt;*.jpg&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
      &lt;servlet&gt;
          &lt;description&gt;&lt;/description&gt;
          &lt;display-name&gt;GetImageController&lt;/display-name&gt;
          &lt;servlet-name&gt;GetImageController&lt;/servlet-name&gt;
          &lt;servlet-class&gt;kh.com.gfam.rsos.presentation.controller.GetImage.GetImageController&lt;/servlet-class&gt;
      &lt;/servlet&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;GetImageController&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/GetImageController&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  
      &lt;filter&gt;
          &lt;filter-name&gt;CharacterEncodingFilter&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.CharacterEncodingFilter&lt;/filter-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;encoding&lt;/param-name&gt;
              &lt;param-value&gt;UTF-8&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;forceEncoding&lt;/param-name&gt;
              &lt;param-value&gt;true&lt;/param-value&gt;
          &lt;/init-param&gt;
      &lt;/filter&gt;
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;CharacterEncodingFilter&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  
      &lt;filter&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
      &lt;/filter&gt;
  
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  
      &lt;listener&gt;
          &lt;listener-class&gt;
              org.springframework.security.web.session.HttpSessionEventPublisher
          &lt;/listener-class&gt;
      &lt;/listener&gt;
  
      &lt;session-config&gt;
          &lt;session-timeout&gt;30&lt;/session-timeout&gt;
      &lt;/session-config&gt;
  
      &lt;error-page&gt;
          &lt;error-code&gt;404&lt;/error-code&gt;
          &lt;location&gt;/WEB-INF/views/error_pages/404.jsp&lt;/location&gt;
      &lt;/error-page&gt;
  
      &lt;error-page&gt;
          &lt;error-code&gt;405&lt;/error-code&gt;
          &lt;location&gt;/WEB-INF/views/error_pages/405.jsp&lt;/location&gt;
      &lt;/error-page&gt;
  
      &lt;error-page&gt;
          &lt;error-code&gt;500&lt;/error-code&gt;
          &lt;location&gt;/WEB-INF/views/error_pages/500.jsp&lt;/location&gt;
      &lt;/error-page&gt;
  
      &lt;error-page&gt;
          &lt;error-code&gt;400&lt;/error-code&gt;
          &lt;location&gt;/WEB-INF/views/error_pages/400.jsp&lt;/location&gt;
      &lt;/error-page&gt;
  
      &lt;error-page&gt;
          &lt;exception-type&gt;java.lang.Throwable&lt;/exception-type&gt;
          &lt;location&gt;/WEB-INF/views/error_pages/system_error.jsp&lt;/location&gt;
      &lt;/error-page&gt;
  </code></pre>
  
  <p>spring-config.xml</p>
  
  <pre><code>&lt;mvc:annotation-driven /&gt;
      &lt;mybatis-spring:scan base-package="kh.com.gfam.rsos.dataaccess.dao.**" /&gt;
  
      &lt;bean id="dataSource"
          class="org.springframework.jdbc.datasource.DriverManagerDataSource"&gt;
          &lt;property name="driverClassName" value="com.mysql.jdbc.Driver"&gt;
          &lt;/property&gt;
          &lt;property name="url" value="jdbc:mysql://localhost:3306/rsosdb"&gt;
          &lt;/property&gt;
          &lt;property name="username" value="admin"&gt;&lt;/property&gt;
          &lt;property name="password" value="gfam"&gt;&lt;/property&gt;
      &lt;/bean&gt;
      &lt;bean id="propertyConfigurer"
          class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer"&gt;
          &lt;property name="systemPropertiesModeName" value="SYSTEM_PROPERTIES_MODE_OVERRIDE" /&gt;
          &lt;property name="searchSystemEnvironment" value="true" /&gt;
          &lt;property name="locations"&gt;
              &lt;list&gt;
                  &lt;value&gt;classpath:application.properties&lt;/value&gt;
                  &lt;value&gt;classpath:messages_en.properties&lt;/value&gt;
                  &lt;value&gt;classpath:email.properties&lt;/value&gt;
                  &lt;value&gt;classpath:emailtemplate.properties&lt;/value&gt;
              &lt;/list&gt;
          &lt;/property&gt;
          &lt;/bean&gt;
      &lt;bean id="sqlSessionFactory" class="org.mybatis.spring.SqlSessionFactoryBean"&gt;
          &lt;property name="dataSource" ref="dataSource"&gt;&lt;/property&gt;
          &lt;property name="configLocation" value="classpath:mybatisConfig.xml"&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;bean id="sqlSession" class="org.mybatis.spring.SqlSessionTemplate"&gt;
          &lt;constructor-arg index="0" ref="sqlSessionFactory" /&gt;
      &lt;/bean&gt;
  
      &lt;bean class="org.mybatis.spring.mapper.MapperScannerConfigurer"&gt;
          &lt;property name="basePackage" value="com.sivalabs.mybatisdemo.mappers" /&gt;
      &lt;/bean&gt;
  
      &lt;tx:annotation-driven transaction-manager="transactionManager" /&gt;
  
      &lt;bean id="transactionManager"
          class="org.springframework.jdbc.datasource.DataSourceTransactionManager"&gt;
          &lt;property name="dataSource" ref="dataSource" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="multipartResolver"
          class="org.springframework.web.multipart.support.StandardServletMultipartResolver"&gt;
      &lt;/bean&gt;
  
      &lt;bean id="localeResolver"
          class="org.springframework.web.servlet.i18n.CookieLocaleResolver"&gt;
          &lt;property name="defaultLocale" value="en" /&gt;
          &lt;property name="cookieName" value="myAppLocaleCookie"&gt;&lt;/property&gt;
          &lt;property name="cookieMaxAge" value="3600"&gt;&lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;!-- mail configuration --&gt;
       &lt;bean class="org.springframework.mail.javamail.JavaMailSenderImpl"
          id="mailSender"&gt;
          &lt;property name="host" value="${email.host}" /&gt;
          &lt;property name="protocol" value="${email.protocol}" /&gt;
          &lt;property name="port" value="${email.port}" /&gt;
          &lt;property name="username" value="${email.username}" /&gt;
          &lt;property name="password" value="${email.password}" /&gt;
          &lt;property name="javaMailProperties"&gt;
              &lt;props&gt;
                  &lt;prop key="mail.smtp.auth"&gt;true&lt;/prop&gt;
                  &lt;prop key="mail.smtp.starttls.enable"&gt;true&lt;/prop&gt;
                  &lt;prop key="mail.smtp.ssl.trust"&gt;${email.host}&lt;/prop&gt;
              &lt;/props&gt;
          &lt;/property&gt;
      &lt;/bean&gt; 
  
      &lt;bean class="org.springframework.mail.SimpleMailMessage" id="orderRequestReceivedTemplate"&gt;
          &lt;property name="subject" value="${email.subject.request.received}" /&gt;
          &lt;property name="text" value="${email.text.request.received}" /&gt;
      &lt;/bean&gt;
  
      &lt;bean class="org.springframework.mail.SimpleMailMessage" id="cancelRequestRecievedTemplate"&gt;
          &lt;property name="subject" value="${email.subject.request.canceled}" /&gt;
          &lt;property name="text" value="${email.subject.request.canceled}" /&gt;
      &lt;/bean&gt;
      &lt;bean
          class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver"&gt;
          &lt;property name="warnLogCategory" value="apperror" /&gt;
          &lt;property name="exceptionMappings"&gt;
              &lt;props&gt;
                  &lt;prop key="java.lang.Exception"&gt;error&lt;/prop&gt;
              &lt;/props&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  </code></pre>
  
  <p>servlet-context</p>
  
  <pre><code>&lt;!-- Enables the Spring MVC @Controller programming model --&gt;
      &lt;annotation-driven /&gt;
  
      &lt;!-- Handles HTTP GET requests for /resources/** by efficiently serving 
          up static resources in the ${webappRoot}/resources directory --&gt;
      &lt;resources mapping="/resources/**" location="/resources/" /&gt;
  
      &lt;!-- Resolves views selected for rendering by @Controllers to .jsp resources 
          in the /WEB-INF/views directory --&gt;
      &lt;beans:bean
          class="org.springframework.web.servlet.view.InternalResourceViewResolver"&gt;
          &lt;beans:property name="prefix" value="/WEB-INF/views/" /&gt;
          &lt;beans:property name="suffix" value=".jsp" /&gt;
      &lt;/beans:bean&gt;
      &lt;context:property-placeholder location="classpath:application.properties"
          order="1" ignore-unresolvable="true" /&gt;
  
      &lt;context:component-scan base-package="kh.com.gfam.rsos" /&gt;
      &lt;context:component-scan
          base-package="kh.com.gfam.rsos.businesslogic.initialization.impl" /&gt;
      &lt;context:component-scan
          base-package="kh.com.gfam.rsos.businesslogic.displaymenuservice.impl" /&gt;
      &lt;context:component-scan base-package="kh.com.gfam.rsos.common.util" /&gt;
      &lt;context:component-scan base-package="kh.com.gfam.rsos.common.security" /&gt;
      &lt;context:component-scan base-package="kh.com.gfam.rsos.presentation.controller" /&gt;
  </code></pre>
  
  <p>code in controller</p>
  
  <pre><code>    List&lt;Object&gt; allPrincipals = sessionRegistry.getAllPrincipals();
  
      for(Object principal : allPrincipals) {
          if(principal instanceof UserDTO) {
              final UserDTO user = (UserDTO) principal;
  
              // Do something with user
              System.out.println(user);
          }
      }
  </code></pre>
  
  <p>When I tried to call sessionRegistry.getAllPrincipals() in my controller it always return the empty list, and I have already autowired the SessionRegistry and have override the method equal() and hashCode() in my UserDTO class which is implemented from UserDetail too.</p>
  
  <p>What am I doing wrong here?  </p>