Spring Oauth2 duplicate logins

I'm using Spring Oauth2 with a custom provider and Mongo session.

When a user who is already logged in navigates to the authorization endpoint, Spring creates a new session for the user. I can see multiple duplicate sessions on mongoDB for the user.

Is there a way to prevent this?
i.e. If the user is already logged in, use the current Principal and session instead of creating a new one.

Configuration:

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .csrf().disable()
                .cors()
                .and()
                .authorizeRequests()
                .antMatchers("/auth/**", "/oauth2/**", "/v1/**")
                .permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .oauth2Login()
                .authorizationEndpoint()
                .baseUri("/oauth2/authorize")
                .and()
                .redirectionEndpoint()
                .baseUri("/auth/callback/*");


    }

You have to disable or control the session in this case.

always – a session will always be created if one 
doesn't already exist

ifRequired – a session will be created only if 
required (default)

never – the framework will never create a 
session itself but it will use one if it already 
exists

stateless – no session will be created or used 
by Spring Security

Java configuration:

@Override
protected void configure(HttpSecurity http) 
throws Exception {
   http.sessionManagement()
     .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
}

4. Concurrent Session Control--

When a user that is already authenticated tries to authenticate again, the application can deal with that event in one of a few ways. It can either invalidate the active session of the user and authenticate the user again with a new session, or allow both sessions to exist concurrently.

The first step in enabling the concurrent session-control support is to add the following listener in the web.xml:

<listener>
 <listener-class>
   org.springframework.security.web.session.HttpSessionEventPublisher
 </listener-class>
</listener>

Or define it as a Bean – as follows:

@Bean
public HttpSessionEventPublisher httpSessionEventPublisher() {
   return new HttpSessionEventPublisher();
}

This is essential to make sure that the Spring Security session registry is notified when the session is destroyed.

To enable the scenario which allows multiple concurrent sessions for the same user the <session-management> element should be used in the XML configuration:

<http ...>
 <session-management>
    <concurrency-control max-sessions="2" />
 </session-management>
</http>

Or, via Java configuration:

@Override
protected void configure(HttpSecurity http) throws Exception {
 http.sessionManagement().maximumSessions(2)
}

Please have a look the following link --
https://www.baeldung.com/spring-security-session

After some research I found out that this behavior is due to Spring's session fixation attack protection.

By default Spring migrates sessions on reauthentication, which makes Spring create a new session for the user by copying the existing attributes from the previous session.

When this happens however, spring-session-data-mongodb does not delete the old, invalidated session for some reason. I am not sure why spring-session-data-mongodb does not remove the old session, so if anyone has any idea on how to change this please let me know.

However, if you want to change this behavior, you can change the session fixation settings to the following to make spring use the existing session ID on reauthentication:

@Override
protected void configure(HttpSecurity http) throws Exception {
 http.sessionManagement().sessionFixation().none()
}