SEC-2950: Concurrent login not redirecting to URL

Steven Rowney (Migrated from SEC-2950) said:

Apologies if this has been raised before but here is my problem:

I have an application using spring security 4.0.1 and I have configured my application to forward to a URL with a parameter when two people use the same login. The system detects when this happens, but the URL that is returned is the failed login page, as opposed to the configured page for concurrent login detection that I would like the user to see.

Security XML configuration:

<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:sec="http://www.springframework.org/schema/security"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/security
        http://www.springframework.org/schema/security/spring-security.xsd">

    <import resource="classpath:/META-INF/configuration/beans/security-beans.xml" />

    <sec:http use-expressions="true" entry-point-ref="ajaxAwareLoginUrlAuthenticationEntryPoint">

        <sec:form-login
            login-page="/"
            authentication-failure-url="/?error=true"
            authentication-success-handler-ref="userRoleRedirectAuthSuccessHandler"
            username-parameter="username"
            password-parameter="password"
            login-processing-url="/authenticate"
        />

        <sec:logout
            logout-url="/logout"
            logout-success-url="/"
        />

        <!-- cache to stop back button after logout -->
        <sec:headers>
            <sec:cache-control />
            <sec:content-type-options />
            <sec:hsts include-subdomains="true" max-age-seconds="31536000" />
            <sec:xss-protection block="false" />
            <sec:frame-options policy="SAMEORIGIN" />
            <sec:header name="X-Content-Security-Policy" value="default-src 'self'"/>
            <sec:header name="X-WebKit-CSP" value="default-src 'self'"/>
        </sec:headers>

        <sec:csrf disabled="true" />

        <!-- Concurrency management -->
        <sec:session-management session-authentication-error-url="/?dld=true" invalid-session-url="/?logout=true">
            <sec:concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />
        </sec:session-management>

    </sec:http>

    <sec:authentication-manager alias="authenticationManager">
        <sec:authentication-provider user-service-ref="localUserDetailsService" >
            <sec:password-encoder ref="passwordEncoder" />
        </sec:authentication-provider>
    </sec:authentication-manager>

</beans>

And my bean configuration:

<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans.xsd">

    <bean id="userRoleRedirectAuthSuccessHandler" class="uk.co.protomed.biodose.pharmacy.connect.service.security.UserRoleRedirectAuthSuccessHandler"/>

    <bean id="localUserDetailsService" class="uk.somecompany.blah.service.security.LocalUserDetailsService" />

    <bean id="passwordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder">
        <constructor-arg name="strength" value="11" />
    </bean>

    <bean id="ajaxAwareLoginUrlAuthenticationEntryPoint" class="uk.somecompany.blah.service.security.AjaxAwareLoginUrlAuthenticationEntryPoint">
        <constructor-arg value="/?login=true" />
    </bean>

</beans>

As you can see, my authentication failure URL is set to this:

authentication-failure-url="/?error=true"

And the session authentication error url is set to this:

<!-- Concurrency management -->
        <sec:session-management session-authentication-error-url="/?dld=true" invalid-session-url="/?logout=true">
            <sec:concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />
        </sec:session-management>

Please let me know if you need any more information or there are workarounds available.

No source files or tests are named. Start by reproducing the concurrent-login case with the shown Spring Security XML, comparing authentication-failure-url with session-authentication-error-url. Done means a second login redirects to the configured concurrent-session error URL rather than the failed-login URL.