Spring Security Concurrent Session : failed to make "max-sessions" field configurable

Question

I have a requirement to allow Concurrent-session control in my web app and make configurable field "max-sessions". My configuration looks like:

<security:session-management>
    <security:concurrency-control max-sessions="${maxConcurrentSessionsCount}" session-registry-ref="sessionRegistry" expired-url="/handleInvalidatedSession.gs4tr"/>
</security:session-management>`

As you can guess, in "services.properties" file there should be "maxConcurrentSessionsCount" field which clients would set by their will. But I'm getting next warning in Intelij:

"attribute 'max-sessions' on element 'security:concurrency-control' is not valid with respect to its type, 'positiveInteger'".

I successfully configure many others things, like "token-validity-seconds" and "remember-me-cookie" in "remember-me", etc. Any idea how to solve a problem? Search couple of days over internet for help, but failed.

EDIT: In "services.properties" is configured: "maxConcurrentSessionsCount=2"

On start application, it throws next error:

No, it doesn't. It throws next ERROR on starting app:

017-09-14 15:46:47,724 ERROR [org.gs4tr.projectdirector.service.context.ContextLoaderListener][localhost-startStop-1][user:] - org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 75 in XML document from class path resource [org/gs4tr/foundation/modules/webmvc/spring/applicationContext-security-default.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 75; columnNumber: 72; cvc-datatype-valid.1.2.1: '${maxConcurrentSessionsCount}' is not a valid value for 'integer'. at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:399) at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:336) at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:304) at org.springframework.beans.factory.support.AbstractBeanDefinitionReader.loadBeanDefinitions(AbstractBeanDefinitionReader.java:181) at org.springframework.beans.factory.support.AbstractBeanDefinitionReader.loadBeanDefinitions(AbstractBeanDefinitionReader.java:217) at org.springframework.beans.factory.support.AbstractBeanDefinitionReader.loadBeanDefinitions(AbstractBeanDefinitionReader.java:188) at org.springframework.web.context.support.XmlWebApplicationContext.loadBeanDefinitions(XmlWebApplicationContext.java:125) at org.springframework.web.context.support.XmlWebApplicationContext.loadBeanDefinitions(XmlWebApplicationContext.java:94) at org.springframework.context.support.AbstractRefreshableApplicationContext.refreshBeanFactory(AbstractRefreshableApplicationContext.java:129) at org.springframework.context.support.AbstractApplicationContext.obtainFreshBeanFactory(AbstractApplicationContext.java:537) at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:452) at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:403) at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:306) at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:106) at org.gs4tr.projectdirector.service.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:73) at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4811) at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5251) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147)

So you're getting a warning, but does it work? Do you have the maxConcurrentSesionsCount parameter defined somewhere? Is IntelliJ IDEA aware of it? — Kayaman

Mostafa Mostafa · Accepted Answer · 2017-12-04T12:59:22

This is the definition of max-session attribute:

<xs:attribute name="max-sessions" type="xs:positiveInteger">
<xs:annotation>
<xs:documentation>
The maximum number of sessions a single authenticated user can have open at the same time. Defaults to "1".
</xs:documentation>
</xs:annotation>
</xs:attribute>

As you can see, the type of the attribute is positiveInteger and you are not allowed to use SpEL.

SpEL (e.g. getting property value) is an string and in some cases you are allowed to use SpEL:

A property or constructor-arg value can be set using expressions as shown below

Spring Security Concurrent Session : failed to make "max-sessions" field configurable

1 Answers