Obtaining Information About The Current User In Spring Security

The details of the principal currently interacting with the application is stored inside SecurityContextHolder. Spring Security uses an Authentication object to represent this information. Use the following code block -from anywhere in your application- to obtain the name and the password of the currently authenticated user:

Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
UserDetails principal = (UserDetails) authentication.getPrincipal();
String username = principal.getUsername();
String password = principal.getPassword();

How To Disable Corcurrent Logins in Spring-Security

Add the following listener to your web.xml file to keep Spring Security updated about session lifecycle events:

<listener>
<listener-class> org.springframework.security.ui.session.HttpSessionEventPublisher </listener-class>
</listener>


Then add the following line to your application context file:

<http>
...
<concurrent-session-control max-sessions="1" />
</http>


This prevents concurrent logins. A second login will cause the first to be invalidated. To prevent a second login, use following configuration:

<http>
...
<concurrent-session-control max-sessions="1" exception-if-maximum-exceeded="true"/>
</http>


The second login will then be rejected.