On 25/02/16 02:54, Mai Zi wrote: For the usecase "kick the first user off" you can create either EventListener (will listen for login events and once user logins, it will destroy the first userSession) or custom Authenticator (which will be last authenticator in the executions chain and will again destroy the first userSession once the second authenticates) This usecase is possible also with the Authenticator (authenticator won't allow login of user "john" if there is existing userSession for this user). In shortcut both usecases are possible. See documentation and see examples in "provider" folder for how to create custom Authenticator or EventListener - we have examples for both. Marek