Q:

Spring SessionRegistryImpl not getting correct sessionId

I'm trying to do an access log. So far I can successfully log the session's beginning, with this class:
public class CustomAuthenticationProcessingFilter extends J2eePreAuthenticatedProcessingFilter {

    @Autowired
    AccessLogService accessLogService;

    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, Authentication authentication) {

        if (authentication.isAuthenticated()) {

            String authenticatedUser = authentication.getName();
            WebAuthenticationDetails wad = (WebAuthenticationDetails) authentication.getDetails();

            accessLogService.addAccessLog("IP: "  + wad.getRemoteAddress(), authenticatedUser, request.getSession().getId());           

        }
        super.successfulAuthentication(request, response, authentication);
    }
}

That's working fine. I have this class for the logout part:
public class CustomSecurityContextLogoutHandler extends SecurityContextLogoutHandler {

   @Autowired
   private SessionRegistry sessionRegistry;

   @Autowired
   private AccessLogDAO accessLogDAO;

   private boolean deleteLtpaCookies = Boolean.FALSE;

    public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) {

    if (authentication != null && authentication.getPrincipal() != null) {
        List<SessionInformation> sessions = sessionRegistry.getAllSessions(((User) authentication.getPrincipal()), false);
        if (sessions != null) {
            for (SessionInformation sessionInformation : sessions) {
                List<String> sessionsToClose = new ArrayList<String>();
                sessionsToClose.add(sessionInformation.getSessionId());
                accessLogDAO.closeAccessLog(sessionsToClose);

                sessionInformation.expireNow();
            }
        }
    }

}

But when I do
List<SessionInformation> sessions = sessionRegistry.getAllSessions(((User) authentication.getPrincipal()), false)

sessions comes null. When I debugged the SessionRegistryImpl I found that the problem is at getAllSessions's first line:
final Set<String> sessionsUsedByPrincipal = principals.get(principal);

The problem is that sessionsUsedByPrincipal gets a sessionId different from any sessionId stored on DB.
Any ideas why this is happening? I'll appreciate any comments or help.
EDIT
The answer worked great but it's logging twice. 
Here's the more important part of my applicationContext-security
<sec:http auto-config='false' use-expressions="true" authentication-manager-ref="authenticationManager" entry-point-ref="authenticationProcessingFilterEntryPoint">

    <sec:custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter" />
    <sec:custom-filter position="PRE_AUTH_FILTER" ref="preAuthFilter"/>
    <sec:custom-filter position="LOGOUT_FILTER" ref="logoutFilter"/>
    <sec:session-management session-authentication-strategy-ref="sas"/>
</sec:http>

<sec:authentication-manager alias="authenticationManager">
    <sec:authentication-provider ref="preAuthenticatedAuthenticationProvider" />
</sec:authentication-manager>

<bean id="preAuthenticatedAuthenticationProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
    <property name="preAuthenticatedUserDetailsService" ref="preAuthenticatedUserDetailsService"/>
</bean>
<bean id="preAuthenticatedUserDetailsService" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesUserDetailsService"/>

<bean id="concurrencyFilter" class="org.springframework.security.web.session.ConcurrentSessionFilter">
    <property name="sessionRegistry" ref="sessionRegistry" />
    <property name="expiredUrl" value="/login.faces" />
</bean>

<bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl" />

<bean id="sas" class="org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy">
    <constructor-arg name="sessionRegistry" ref="sessionRegistry" />
    <property name="maximumSessions" value="-1" />
    <property name="exceptionIfMaximumExceeded" value="true" />
</bean>

<bean id="simpleAttributes2GrantedAuthoritiesMapper" class="org.springframework.security.core.authority.mapping.SimpleAttributes2GrantedAuthoritiesMapper">
    <property name="convertAttributeToUpperCase" value="true"/>
</bean>

<bean id="webXmlMappableAttributesRetriever" class="org.springframework.security.web.authentication.preauth.j2ee.WebXmlMappableAttributesRetriever"/>

<bean id="j2eeBasedPreAuthenticatedWebAuthenticationDetailsSource" class="org.springframework.security.web.authentication.preauth.j2ee.J2eeBasedPreAuthenticatedWebAuthenticationDetailsSource">
    <property name="mappableRolesRetriever" ref="webXmlMappableAttributesRetriever"/>
    <property name="userRoles2GrantedAuthoritiesMapper" ref="simpleAttributes2GrantedAuthoritiesMapper"/>
</bean>

<bean id="preAuthFilter" class="org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter">
    <property name="authenticationManager" ref="authenticationManager"/>
    <property name="authenticationDetailsSource" ref="j2eeBasedPreAuthenticatedWebAuthenticationDetailsSource"/>
</bean>

<bean id="authenticationProcessingFilterEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
    <constructor-arg value="/login.faces"/>
    <property name="forceHttps" value="false"/>     
</bean>

<bean id="logoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter">
    <constructor-arg value="/login.faces"/>
    <constructor-arg>
        <list>
            <bean class="cr.go.nov.proy.web.util.AccessLogHandler"/>
        </list>
    </constructor-arg>
</bean>

I didn't write it and I don't fully understand it, I just added what I needed . Maybe you can take a look and see if something may be causing this behavior. Thanks for your help.

A:

For starters I suggest creating an ApplicationListener that listens to AuthenticationSuccessEvent and InteractiveAuthenticationSuccessEvent events to start logging your access log. 
To log the logout create a dedicated LogoutHandler instead of extending an existing one. 
The session-id that will be used is part of the WebAuthenticationDetails so I would also suggest using that instead of working around it. Your code will force session creation if there isn't already a session.
public class AccessLogHandler implements ApplicationListener<AbstractAuthenticationEvent>, LogoutHandler {

    @Autowired
    private SessionRegistry sessionRegistry;

    @Autowired
    private AccessLogService accessLogService;

    public void onApplicationEvent(AbstractAuthenticationEvent event) {
        if (event instanceof AuthenticationSuccessEvent || event instanceof InteractiveAuthenticationSuccessEvent) {
            Authentication authentication = event.getAuthentication();
            WebAuthenticationDetails details = (WebAuthenticationDetails) authentication.getDetails();
            accessLogService.addAccessLog("IP: "  + details.getRemoteAddress(), authentication.getName(), details.getSessionId());           
        }
    }

    public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) {
            WebAuthenticationDetails details = (WebAuthenticationDetails) authentication.getDetails();
            accessLogService.closeAccessLog(Collections.singletonList(details.getSessionId());
            SessionInformation si = sessionRegistry.getSessionInformation(details.getSessionId());
            if (si != null) {
                si.expireNow();
            }
    }
}

Something like this should work and you can remove your extended classes, leaving you with a basic configuration. The ApplicationListener is registered automatically, the LogoutHandler you will need to add to the LogoutFilter which you need to explicitly configure I'm afraid. But judging by the fact that you already extended another LogoutHandler this is something you already do.
Your configuration is also quite verbose things like login, session control can be configured with the namespace. The following configuration should do the same as your own configuration (and probably a little more).
<sec:http auto-config='false' use-expressions="true" authentication-manager-ref="authenticationManager" >
    <sec:custom-filter position="PRE_AUTH_FILTER" ref="preAuthFilter"/>
    <sec:custom-filter position="LOGOUT_FILTER" ref="logoutFilter"/>
    <sec:login-form login-page="/login.faces" />
    <sec:session-management>
        <sec:concurrency-control max-sessions="-1" session-registry-alias="sessionRegistry" error-if-maximum-exceeded="true" expired-url="/login.faces"/>
    </sec:session-management>
</sec:http>

<sec:authentication-manager alias="authenticationManager">
    <sec:authentication-provider ref="preAuthenticatedAuthenticationProvider" />
</sec:authentication-manager>

<bean id="preAuthenticatedAuthenticationProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
    <property name="preAuthenticatedUserDetailsService" ref="preAuthenticatedUserDetailsService"/>
</bean>

<bean id="preAuthenticatedUserDetailsService" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesUserDetailsService"/>

<bean id="j2eeBasedPreAuthenticatedWebAuthenticationDetailsSource" class="org.springframework.security.web.authentication.preauth.j2ee.J2eeBasedPreAuthenticatedWebAuthenticationDetailsSource">
    <property name="mappableRolesRetriever">
        <bean class="org.springframework.security.web.authentication.preauth.j2ee.WebXmlMappableAttributesRetriever"/>
    </property>
    <property name="userRoles2GrantedAuthoritiesMapper">
        <bean class="org.springframework.security.core.authority.mapping.SimpleAttributes2GrantedAuthoritiesMapper">
            <property name="convertAttributeToUpperCase" value="true"/>
        </bean>
    </property>
</bean>

<bean id="preAuthFilter" class="org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter">
    <property name="authenticationManager" ref="authenticationManager"/>
    <property name="authenticationDetailsSource" ref="j2eeBasedPreAuthenticatedWebAuthenticationDetailsSource"/>
</bean>

<bean id="logoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter">
    <constructor-arg value="/login.faces"/>
    <constructor-arg>
        <list>
            <bean class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"/>
            <bean class="cr.go.nov.proy.web.util.AccessLogHandler"/>
        </list>
    </constructor-arg>
</bean>

In your configuration you don't register any SessionAuthenticationStrategy which also means no sessions are being registered with the SessionRegistry. As the RegisterSessionAuthenticationStrategy takes care of that. Note - This assumes that you are using Spring Security 3.2!

