[FIXED] Spring Security - multiple logged users

Issue

I have a problem with Spring Security configuration.

When I log in on one computer as a user1 and then I will log in as a user2 on another computer, the first computer after refresh sees everything as a user2.

In other words, it is impossible to have two sessions with different users at the same time.

Configuration:

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser("user1").password("user1").roles("USER");
        auth.inMemoryAuthentication().withUser("user2").password("user2").roles("USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        CharacterEncodingFilter filter = new CharacterEncodingFilter();
        filter.setEncoding("UTF-8");
        filter.setForceEncoding(true);
        http.addFilterBefore(filter,CsrfFilter.class);

        http.csrf().disable();

        http.authorizeRequests()
                .antMatchers("/", "/login").permitAll()
                .antMatchers("/questions/**").access("hasRole('USER')")
                .and().formLogin().loginPage("/login").defaultSuccessUrl("/questions")
                .usernameParameter("ssoId").passwordParameter("password");
    }

Spring Security version: 4.0.1.RELEASE

Spring version: 4.1.6.RELEASE

Login request in controller:

@RequestMapping(value = { "/", "/login" }, method = RequestMethod.GET)
public String homePage() {
    return "login";
}

Solution

@Autowired
public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {
    auth.inMemoryAuthentication().withUser("user1").password("user1").roles("USER");
    auth.inMemoryAuthentication().withUser("user2").password("user2").roles("USER");
}

With that, you are saying that is the user 2 on the session

@Autowired
public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {
    auth.inMemoryAuthentication().withUser(getUser()).password(getPassword()).roles("USER");
}

Answered By - William R
Answer Checked By - Mildred Charles (JavaFixing Admin)