I am using Spring Security 3.0 in my project and I am restricting user to have maximum one session. Configuration is given below :
expired-url should be what you require. In the configuration for spring security
also add following listener in web.xml.
org.springframework.security.web.session.HttpSessionEventPublisher