web/src/main/java/org/springframework/security/web/authentication/session/ConcurrentSessionControlAuthenticationStrategy.java
protected void allowableSessionsExceeded(List<SessionInformation> sessions,
			int allowableSessions, SessionRegistry registry)
			throws SessionAuthenticationException {
		if (exceptionIfMaximumExceeded || (sessions == null)) {
			throw new SessionAuthenticationException(messages.getMessage(
					"ConcurrentSessionControlAuthenticationStrategy.exceededAllowed",
					new Object[] { Integer.valueOf(allowableSessions) },
					"Maximum sessions of {0} for this principal exceeded"));
		}

		// Determine least recently used session, and mark it for invalidation
		SessionInformation leastRecentlyUsed = null;

		for (SessionInformation session : sessions) {
			if ((leastRecentlyUsed == null)
					|| session.getLastRequest()
							.before(leastRecentlyUsed.getLastRequest())) {
				leastRecentlyUsed = session;
			}
		}

		leastRecentlyUsed.expireNow();
	}
protected void allowableSessionsExceeded(List<SessionInformation> sessions,
			int allowableSessions, SessionRegistry registry)
			throws SessionAuthenticationException {
		if (exceptionIfMaximumExceeded || (sessions == null)) {
			throw new SessionAuthenticationException(messages.getMessage(
					"ConcurrentSessionControlAuthenticationStrategy.exceededAllowed",
					new Object[] { Integer.valueOf(allowableSessions) },
					"Maximum sessions of {0} for this principal exceeded"));
		}

		// Determine least recently used session, and mark it for invalidation
		SessionInformation leastRecentlyUsed = null;

		for (SessionInformation session : sessions) {
			if ((leastRecentlyUsed == null)
					|| session.getLastRequest()
							.before(leastRecentlyUsed.getLastRequest())) {
				leastRecentlyUsed = session;
			}
		}

		leastRecentlyUsed.expireNow();
	}
protected void allowableSessionsExceeded ( List < SessionInformation > sessions , int allowableSessions , SessionRegistry registry ) throws SessionAuthenticationException { if ( exceptionIfMaximumExceeded || ( sessions == null ) ) { throw new SessionAuthenticationException ( messages . getMessage ( "ConcurrentSessionControlAuthenticationStrategy.exceededAllowed" , new Object [ ] { Integer . valueOf ( allowableSessions ) } , "Maximum sessions of {0} for this principal exceeded" ) ) ; } // Determine least recently used session, and mark it for invalidation SessionInformation leastRecentlyUsed = null ; for ( SessionInformation session : sessions ) { if ( ( leastRecentlyUsed == null ) || session . getLastRequest ( ) . before ( leastRecentlyUsed . getLastRequest ( ) ) ) { leastRecentlyUsed = session ; } } leastRecentlyUsed . expireNow ( ) ; }
Allows subclasses to customise behaviour when too many sessions are detected.

@param sessions either <code>null</code> or all unexpired sessions associated with
the principal
@param allowableSessions the number of concurrent sessions the user is allowed to
have
@param registry an instance of the <code>SessionRegistry</code> for subclass use
Allows subclasses to customise behaviour when too many sessions are detected .