Fix session concurrency for OAuth2/OIDC authentication

core/src/main/java/org/springframework/security/core/session/SessionRegistryImpl.java

@@ -32,6 +32,7 @@
 
 import org.springframework.context.ApplicationListener;
 import org.springframework.core.log.LogMessage;
+import org.springframework.security.core.Authentication;
 import org.springframework.util.Assert;
 
 /**
@@ -69,14 +70,22 @@ public SessionRegistryImpl(ConcurrentMap<Object, Set<String>> principals,
 		this.sessionIds = sessionIds;
 	}
 
+	private Object getPrincipalKey(Object principal) {
+		if (principal instanceof Authentication authentication) {
+			return authentication.getName();
+		}
+		return principal;
+	}
+
 	@Override
 	public List<Object> getAllPrincipals() {
 		return new ArrayList<>(this.principals.keySet());
 	}
 
 	@Override
 	public List<SessionInformation> getAllSessions(Object principal, boolean includeExpiredSessions) {
-		Set<String> sessionsUsedByPrincipal = this.principals.get(principal);
+		Object key = getPrincipalKey(principal);
+		Set<String> sessionsUsedByPrincipal = this.principals.get(key);
 		if (sessionsUsedByPrincipal == null) {
 			return Collections.emptyList();
 		}
@@ -135,7 +144,8 @@ public void registerNewSession(String sessionId, Object principal) {
 			this.logger.debug(LogMessage.format("Registering session %s, for principal %s", sessionId, principal));
 		}
 		this.sessionIds.put(sessionId, new SessionInformation(principal, sessionId, new Date()));
-		this.principals.compute(principal, (key, sessionsUsedByPrincipal) -> {
+		Object key = getPrincipalKey(principal);
+		this.principals.compute(key, (k, sessionsUsedByPrincipal) -> {
 			if (sessionsUsedByPrincipal == null) {
 				sessionsUsedByPrincipal = new CopyOnWriteArraySet<>();
 			}
@@ -156,7 +166,8 @@ public void removeSessionInformation(String sessionId) {
 			this.logger.debug("Removing session " + sessionId + " from set of registered sessions");
 		}
 		this.sessionIds.remove(sessionId);
-		this.principals.computeIfPresent(info.getPrincipal(), (key, sessionsUsedByPrincipal) -> {
+		Object key = getPrincipalKey(info.getPrincipal());
+		this.principals.computeIfPresent(key, (k, sessionsUsedByPrincipal) -> {
 			this.logger
 				.debug(LogMessage.format("Removing session %s from principal's set of registered sessions", sessionId));
 			sessionsUsedByPrincipal.remove(sessionId);

core/src/test/java/org/springframework/security/core/session/SessionRegistryImplTests.java

@@ -16,12 +16,16 @@
 
 package org.springframework.security.core.session;
 
+import java.util.Collection;
+import java.util.Collections;
 import java.util.Date;
 import java.util.List;
 
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.context.SecurityContext;
 
 import static org.assertj.core.api.Assertions.assertThat;
@@ -62,6 +66,63 @@ public List<SecurityContext> getSecurityContexts() {
 		assertThat(this.sessionRegistry.getSessionInformation(sessionId)).isNull();
 	}
 
+	private Authentication authentication(String name) {
+		return new Authentication() {
+
+			@Override
+			public String getName() {
+				return name;
+			}
+
+			@Override
+			public Object getPrincipal() {
+				return this;
+			}
+
+			@Override
+			public Object getCredentials() {
+				return null;
+			}
+
+			@Override
+			public Object getDetails() {
+				return null;
+			}
+
+			@Override
+			public Collection<? extends GrantedAuthority> getAuthorities() {
+				return Collections.emptyList();
+			}
+
+			@Override
+			public boolean isAuthenticated() {
+				return true;
+			}
+
+			@Override
+			public void setAuthenticated(boolean isAuthenticated) {
+			}
+		};
+	}
+
+	@Test
+	public void authenticationPrincipalUsesNameAsSessionKey() {
+		String sessionId = "session-1";
+
+		Authentication auth1 = authentication("user-123");
+		Authentication auth2 = authentication("user-123");
+
+		// Sanity check
+		assertThat(auth1).isNotSameAs(auth2);
+		this.sessionRegistry.registerNewSession(sessionId, auth1);
+		// Lookup using a different Authentication instance
+		List<SessionInformation> sessions =
+				this.sessionRegistry.getAllSessions(auth2, false);
+
+		assertThat(sessions).hasSize(1);
+		assertThat(sessions.get(0).getSessionId()).isEqualTo(sessionId);
+	}
+
 	@Test
 	public void sessionIdChangedEventRemovesOldSessionAndAddsANewSession() {
 		Object principal = "Some principal object";