...(생략)

@Configuration
@EnableWebSecurity
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.sessionManagement()
                .maximumSessions(1)
                .maxSessionsPreventsLogin(true)
                .expiredUrl("/duplicated-login")
                .sessionRegistry(sessionRegistry);
    }

    @Bean
    public SessionRegistry sessionRegistry() {
        return new SessionRegistryImpl();
    }

    ...(생략)
}

...(생략)
import org.springframework.security.web.session.HttpSessionEventPublisher;

@Configuration
@EnableWebSecurity
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {

    ...(생략)

    @Bean
    public ServletListenerRegistrationBean<HttpSessionEventPublisher> httpSessionEventPublisher() {
        return new ServletListenerRegistrationBean<HttpSessionEventPublisher>(new HttpSessionEventPublisher());
    }
}

import io.dveamer.sample.common.scope.Attribute;
import io.dveamer.sample.models.User;

import javax.servlet.http.*;
import java.util.Collections;
import java.util.HashMap;
import java.util.Map;

public class CustomHttpSessionListener implements HttpSessionListener, HttpSessionAttributeListener {

    private static Map<Long, HttpSession> map = Collections.synchronizedMap(new HashMap<>());

    public static boolean isAlreadyLogedIn(Long userId, String sessionId) {
        HttpSession session = map.get(userId);

        if(session.getId().equals(sessionId)){
            return true;
        }

        return false;
    }

    public static HttpSession getSession(Long userId){
        return map.get(userId);
    }

    @Override
    public void sessionDestroyed(HttpSessionEvent se) {
        HttpSession session = se.getSession();

        try{  
            Attribute attribute = (Attribute) session.getAttribute(Attribute.KEY);
            User user = attribute.getUser();

            map.remove(user.getId());
        }catch(Exception ex){
            // 로그인 된 session 은 user를 포함한 attribute 를 가짐
        }
    }

    @Override
    public void attributeAdded(HttpSessionBindingEvent se) {
        HttpSession session = se.getSession();

        try{
            Attribute attribute = (Attribute) session.getAttribute(Attribute.KEY);
            User user = attribute.getUser();

            map.put(user.getId(), session);
        }catch(Exception ex){
            // 로그인 된 session 은 user를 포함한 attribute 를 가짐
        }
    }

    @Override
    public void sessionCreated(HttpSessionEvent se) {
        // do nothing.
    }

    @Override
    public void attributeRemoved(HttpSessionBindingEvent se) {
        // do nothing.
    }

    @Override
    public void attributeReplaced(HttpSessionBindingEvent se) {
        // do nothing.
    }

}

@Service
@Transactional(rollbackFor=Exception.class, propagation= Propagation.REQUIRED)
public class AuthService {

    Logger logger = LoggerFactory.getLogger(getClass());

    @Autowired
    AuthenticationRepository authenticationRepository;

    @Autowired
    UserRepository userRepository;


    ...(생략)

    public Authentication login(Authentication auth) {

        logger.debug("This user is trying to log-in : {}", auth);

        User user = userRepository.findByUserName(auth.getUser().getUserName());
        logger.debug("Found user information from DB : {}", user);
        if(user==null || !user.getPswd().equals(auth.getUser().getPswd())){
            return new Authentication();
        }

        auth.setId(user.getId());
        auth.setLoggedIn(true);

        removeDuplicatedUserSession(auth);

        authenticationRepository.save(auth);

        Attribute attr = new Attribute();
        attr.setUser(user);
        SessionScopeUtil.setAttribute(attr);

        logger.debug("Success to log-in : {}", auth);

        return auth;
    }

    ...(생략)

    private void removeDuplicatedUserSession(Authentication auth) {

        if(!authenticationRepository.existsById(auth.getId())){
            return;
        }

        Authentication prevAuth = authenticationRepository.getOne(auth.getId());

        if(prevAuth.getSessionId().equals(auth.getSessionId())){
            return;
        }

        logger.info("Found a duplicated session : {}", prevAuth);

        HttpHeaders headers = new HttpHeaders();
        headers.add("Cookie", String.format("JSESSIONID=%s; Path=/;", prevAuth.getSessionId()));

        HttpEntity<String> entity = new HttpEntity<>("", headers);

        ResponseEntity<Authentication> res = restTemplate.postForEntity(urlLogout, entity, Authentication.class);

        if(res.getStatusCode()== HttpStatus.OK && !res.getBody().isLoggedIn()){
            logger.info("Resolved. The current status of duplicated session : {}", res.getBody());
            return;
        }

        logger.info("Failed to resolve the duplicated session problem.");
    }

}