You try to override the binding for the "identity-session" tag, I don't know if this works that way, but even if it does, you are still using the object tag to configure your identity session so the binding is for sure not used and the setSession method probably never called.