Spring boot spring安全性：禁用同一用户上的多个会话，使其无法工作

HttpSecurity

对象配置如下：

http.authorizeRequests().antMatchers("/login","/loginPage","/static/login.html","/","/index","/static/authenticationErr.html","/static/duplicatedUserErr.html").permitAll()
    .and()
    .httpBasic()
    .authenticationEntryPoint(customAuthenticationEntryPoint)
    .and()
    .addFilterAt(customAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class)
    .csrf().disable()
    .authorizeRequests()
    .anyRequest().authenticated()
    .and()
    .formLogin()
    .loginProcessingUrl("/login")
    .loginPage("/loginPage")
    .permitAll()
    .and()
    .logout()
    .logoutUrl("/logout")
    .logoutSuccessHandler(customLogoutHandler)
    .permitAll()

    .and()
    .sessionManagement() // not working??
    .maximumSessions(1)
    .maxSessionsPreventsLogin(true)
    .expiredUrl("/static/duplicatedUserErr.html")
    ;

@Bean
public CustomAuthenticationFilter customAuthenticationFilter() throws Exception {
    CustomAuthenticationFilter filter = new CustomAuthenticationFilter("/login");
    filter.setAuthenticationManager(this.authenticationManagerBean());
    filter.setAuthenticationFailureHandler(failureHandler);
    filter.setAuthenticationSuccessHandler(successHandler);
    //If don't set it here, spring will inject a compositeSessionAuthenticationStrategy bean automatically, but looks like it didn't work as expected for me
    filter.setSessionAuthenticationStrategy(compositeSessionAuthenticationStrategy());
    return filter;
}
@Bean
    public ConcurrentSessionControlAuthenticationStrategy sessionControlAuthenticationStrategy() {
        ConcurrentSessionControlAuthenticationStrategy csas = new ConcurrentSessionControlAuthenticationStrategy(sessionRegistry());
        csas.setExceptionIfMaximumExceeded(true);
        return csas;
    }

以下是我所尝试的：通过跟踪上的spring安全性参考和源代码跟踪，我找到了确定这是否是重复登录会话的关键，这部分代码是用类

ConcurrentSessionControlAuthenticationStrategy的方法
onAuthentication
编写的：

final List<SessionInformation> sessions = sessionRegistry.getAllSessions(
            authentication.getPrincipal(), false);

有人能告诉我一点吗？
最后我弄明白了，你必须按照这个引用创建bean，你必须手动将
CompositeSessionAuthenticationStrategy
bean设置为
CustomAuthenticationFilter
，然后在
ConcurrentSessionControlAuthenticationStrategy
bean中，将ExceptionIfMaximumExcepended设置为true，以便在创建同一用户的重复Session时引发SessionAuthenticationException。
我的上述代码如下所示：

http.authorizeRequests().antMatchers("/login","/loginPage","/static/login.html","/","/index","/static/authenticationErr.html","/static/duplicatedUserErr.html").permitAll()
    .and()
    .httpBasic()
    .authenticationEntryPoint(customAuthenticationEntryPoint)
    .and()
    .addFilterAt(customAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class)
    .csrf().disable()
    .authorizeRequests()
    .anyRequest().authenticated()
    .and()
    .formLogin()
    .loginProcessingUrl("/login")
    .loginPage("/loginPage")
    .permitAll()
    .and()
    .logout()
    .logoutUrl("/logout")
    .logoutSuccessHandler(customLogoutHandler)
    .permitAll()

    .and()
    .sessionManagement() // not working??
    .maximumSessions(1)
    .maxSessionsPreventsLogin(true)
    .expiredUrl("/static/duplicatedUserErr.html")
    ;

@Bean
public CustomAuthenticationFilter customAuthenticationFilter() throws Exception {
    CustomAuthenticationFilter filter = new CustomAuthenticationFilter("/login");
    filter.setAuthenticationManager(this.authenticationManagerBean());
    filter.setAuthenticationFailureHandler(failureHandler);
    filter.setAuthenticationSuccessHandler(successHandler);
    //If don't set it here, spring will inject a compositeSessionAuthenticationStrategy bean automatically, but looks like it didn't work as expected for me
    filter.setSessionAuthenticationStrategy(compositeSessionAuthenticationStrategy());
    return filter;
}
@Bean
    public ConcurrentSessionControlAuthenticationStrategy sessionControlAuthenticationStrategy() {
        ConcurrentSessionControlAuthenticationStrategy csas = new ConcurrentSessionControlAuthenticationStrategy(sessionRegistry());
        csas.setExceptionIfMaximumExceeded(true);
        return csas;
    }