SessionManagementConfigurer does not allow to add a custom SessionAuthenticationStrategy to default CompositeSessionAuthenticationStrategy

Hi,

I want to use default delegateStrategies included as CompositeSessionAuthenticationStrategy by SessionManagementConfigurer but I need to add a new custom strategy.
Currently this is not allowed by using Http Object to access SessionManagerConfigurer, like this:

http.sessionManagement().addSessionAuthenticationStrategy(....)

because addSessionAuthenticationStrategy(..) method has default (package) visibility and so it cannot be called from http object.

The thing is that I want to use all default setup (all this is OK for me, for instance to implement session change id) but I need to add a custom behaviour.
Having to setup explicitly all the setup that Spring Security applies for us (thankfully!) is just error prone when the only thing I need is just to apply an extra custom SessionAuthenticationStrategy.

I probably could post-process the SessionManagementConfigurer bean once initialized but even if this is possible I would rather not to do it.
Am I missing something here? Is there another way to add (easily without having to rewrite all the default setup spring does (adding risk of making mistakes)) just a custom SessionAuthenticationStrategy to the "delegated strategies" that CompositeSessionAuthenticationStrategy object holds?

You might be wondering why I want to add a custom SessionAuthenticationStrategy to the default "chain". In fact, this probably does not matter but I guess in this case is justified.
In cases of regular logout (triggered by calling logout endpoint) and session expiration because of inactivity I need to capture both events and I have to do custom processing related to my particular logout use case. However, in cases where autentication entry point is called twice, where the default strategy for the servlet specification I am using is to change the session ID, the aforementioned "session deleted" event is called (I use Spring-Session Redis backed up implementation) and I cannot distinguish between the case of a regular logout or a session migration. My custom processing should be different as if I take all the custom actions I take for regular logout also for the case of session fixation attack this would not work.
Basically what I want to do is to add a custom SessionAuthenticationStrategy that adds a mark to the former session (when changing the id) so later when I receive the 'session deleted' event I can know this session was deleted just because of the session fixation attack protection and do an specific treatment for the event.
This old JIRA issue basically is about the same particular scenario and the suggested solution is to implement exactly what I described above:
https://github.com/spring-projects/spring-security/issues/1634

I would appreciate if @rwinch or anybody could give me hand with this, both comming up with a solution to add a custom SessionAuthenticationStrategy to the composite or providing a better idea to implement my custom use case.

Thanks and Regards,

Miguel

Start by reading SessionManagementConfigurer, its addSessionAuthenticationStrategy method, and CompositeSessionAuthenticationStrategy to understand how the default delegate strategies are assembled. Compare the requested extension with the linked issue 1634 and define a supported way to add a custom strategy without replacing the defaults; done means the custom strategy participates in the existing chain.