ConcurrentSessionFilter should be able to pass the request downstream (after doLogout), such that all authentication redirects can be handled by ExceptionTranslationFilter.

This issue was initially discussed here.

We use Keycloak for SSO.
When Keycloak sends a logout request to our client application, it includes the sessionId of the session to invalidate.
However, invalidating a session by id is not supported by the servlet spec (I think).
As such, the way we accomplish this session invalidation is by expiring the corresponding org.springframework.security.core.session.SessionInformation object.
A custom javax.servlet.http.HttpFilter invalidates the corresponding HttpSession on the next incoming request for that session, and passes the request downstream:

public class InvalidateExpiredSessionsFilter extends HttpFilter {
    private final SessionRegistry sessionRegistry;

    public InvalidateExpiredSessionsFilter(SessionRegistry sessionRegistry) {
        this.sessionRegistry = sessionRegistry;
    }

    @Override
    protected void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpSession session = request.getSession(false);
        if (session != null) {
            SessionInformation sessionInformation = this.sessionRegistry.getSessionInformation(session.getId());
            if (sessionInformation != null && sessionInformation.isExpired()) {
                session.invalidate();
            }
        }
        super.doFilter(request, response, chain);
    }
}

This way, invalidated sessions & non-existing/timed-out sessions are both handled by ExceptionTranslationFilter using authenticationEntryPoint (after an AccessDeniedException is thrown).

Rather than defining a custom javax.servlet.http.HttpFilter , we'd love to reuse org.springframework.security.web.session.ConcurrentSessionFilter.
This filter comes out-of-the-box and serves a similar purpose.
However, we currently cannot use this filter as there's no option to pass the request downstream (after doLogout(request, response)), because SessionInformationExpiredStrategy has no access to the FilterChain.

Start by reading ConcurrentSessionFilter, SessionInformationExpiredStrategy, and the doLogout(request, response) flow, then compare how ExceptionTranslationFilter handles downstream requests. Determine how an expired session can continue through the FilterChain after logout so authenticationEntryPoint redirects remain centralized, and verify that existing expiration behavior is preserved.