Spring Security 4 sessionRegistry doesn't populate Principal list -

i trying implement function admin user can terminate user's session. followed official spring security documentation here: http://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#list-authenticated-principals , started getting logged in users through sessionregistry.getallprincipals(), returned empty list.

i set breakpoint in sessionregistryimpl.registernewsession() , see did indeed invoked , did add userdetails (my own implementation both equals() , hashcode() implemented) hashmap principals. when access sessionregistry bean spring mvc controller, list empty.

my configuration looks pretty same documentation.

how fix this? did sessionregistry work spring security 4? remember made work spring security 3 following these intructions(enter link description here)

ok, fixed issue cleaning spring configuration files, suggested comments. messed web.xml - added reference context xml referenced spring's dispatcherservlet, causing loaded twice. didn't know it, because spring references file implicitly.

p.s. learned lessons, 2 things spring folks better (maybe in spring 5?):

1. there shouldn't implicit context file loading. currently, framework try load application context file named [servlet-name]-servlet.xml located in application's webcontent/web-inf directory. convention on configuration fails in case.
2. there should warning when bean loaded twice, if need override bean definition, must declare explicitly. otherwise take lot of time debug kind of error mistake cause.