SEC-2137: Allow disabling session fixation and enable concurrency control

docs/manual/src/docbook/appendix-namespace.xml

@@ -1208,7 +1208,7 @@
             <para> Adds support for concurrent session control, allowing limits to be placed on the
                 number of active sessions a user can have. A
                 <classname>ConcurrentSessionFilter</classname> will be created, and a
-                <classname>ConcurrentSessionControlStrategy</classname> will be used with the
+                <classname>ConcurrentSessionControlAuthenticationStrategy</classname> will be used with the
                 <classname>SessionManagementFilter</classname>. If a <literal>form-login</literal>
                 element has been declared, the strategy object will also be injected into the
                 created authentication filter. An instance of
@@ -1242,7 +1242,7 @@
                 <section xml:id="nsa-concurrency-control-max-sessions">
                     <title><literal>max-sessions</literal></title>
                     <para>Maps to the <literal>maximumSessions</literal> property of
-                        <classname>ConcurrentSessionControlStrategy</classname>.</para>
+                        <classname>ConcurrentSessionControlAuthenticationStrategy</classname>.</para>
                 </section>
                 <section xml:id="nsa-concurrency-control-session-registry-alias">
                     <title><literal>session-registry-alias</literal></title>

docs/manual/src/docbook/session-mgmt.xml

@@ -80,7 +80,7 @@
             though. </para>
         <para>The implementation uses a specialized version of
             <interfacename>SessionAuthenticationStrategy</interfacename>, called
-            <classname>ConcurrentSessionControlStrategy</classname>. <note>
+            <classname>ConcurrentSessionControlAuthenticationStrategy</classname>. <note>
             <para>Previously the concurrent authentication check was made by the
                 <classname>ProviderManager</classname>, which could be injected with a
                 <literal>ConcurrentSessionController</literal>. The latter would check if the user
@@ -126,10 +126,21 @@
   <beans:property name="authenticationManager" ref="authenticationManager" />
 </beans:bean>
 
-<beans:bean id="sas" class=
- "org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy">
-  <beans:constructor-arg name="sessionRegistry" ref="sessionRegistry" />
-  <beans:property name="maximumSessions" value="1" />
+<beans:bean id="sas" class="org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy">
+  <beans:constructor-arg>
+    <beans:list>
+      <beans:bean class="org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy">
+        <beans:constructor-arg ref="sessionRegistry"/>
+        <beans:property name="maximumSessions" value="1" />
+        <beans:property name="exceptionIfMaximumExceeded" value="true" />
+      </beans:bean>
+      <beans:bean class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy">
+      </beans:bean>
+      <beans:bean class="org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy">
+        <beans:constructor-arg ref="sessionRegistry"/>
+      </beans:bean>
+    </beans:list>
+  </beans:constructor-arg>
 </beans:bean>
 
 <beans:bean id="sessionRegistry"