SessionManagement#maximumSessions has no effect when using OIDC

OIDC uses different auth (exchanged tokens) for every login therefore the amount of sessions will never be > 1

Author: AB-xdev

demo/webapp-rest/src/main/java/software/xdev/sse/demo/security/MainWebSecurity.java

@@ -51,9 +51,6 @@ public SecurityFilterChain configure(
 				// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
 				.contentTypeOptions(Customizer.withDefaults())
 				.contentSecurityPolicy(csp -> csp.policyDirectives(cspGenerator.buildCSP())))
-			.sessionManagement(c ->
-				// Limit maximum session per user
-				c.sessionConcurrency(sc -> sc.maximumSessions(5)))
 			.oauth2Login(c -> c.defaultSuccessUrl("/"))
 			// Disable CSRF for REST API for demo purposes
 			.csrf(c -> c.ignoringRequestMatchers("/api/**"))

demo/webapp-vaadin/src/main/java/software/xdev/sse/demo/security/MainWebSecurity.java

@@ -61,9 +61,6 @@ protected void configure(final HttpSecurity http) throws Exception
 				// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
 				.contentTypeOptions(Customizer.withDefaults())
 				.referrerPolicy(p -> p.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.SAME_ORIGIN)))
-			.sessionManagement(c ->
-				// Limit maximum session per user
-				c.sessionConcurrency(sc -> sc.maximumSessions(5)))
 			.oauth2Login(c -> {
 				c.defaultSuccessUrl("/" + MainView.NAV);
 				this.rememberLoginProvider.configureOAuth2Login(c);

vaadin/README.md

@@ -47,7 +47,6 @@ public class MainWebSecurity extends TotalVaadinFlowWebSecurity
                 // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
                 .contentTypeOptions(Customizer.withDefaults())
                 .referrerPolicy(p -> p.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.SAME_ORIGIN)))
-            .sessionManagement(c -> c.sessionConcurrency(sc -> sc.maximumSessions(5)))
             .oauth2Login(c -> {
                 c.defaultSuccessUrl("/" + WorkdayView.NAV);
                 this.rememberLoginProvider.configureOAuth2Login(c);