Concurrent Session Management does not fully invalidate OIDC sessions after Back-Channel Logout #19780

actually，I am not sure if this is a bug.
my architecture consists of spring security auth server and oidc client.
when i configured MaximumSession,like this:
@Bean SessionAuthenticationStrategy sessionAuthenticationStrategy( SessionRegistry sessionRegistry, SystemConfigService systemConfigService) { var strategy = new ConcurrentSessionStrategy( sessionRegistry, backChannelLogoutService.getObject()); var sessionLimit = systemConfigService.getSystemConfig().getSessionLimit(); strategy.setMaximumSessions(sessionLimit == null ? -1 : sessionLimit); return new CompositeSessionAuthenticationStrategy(List.of( strategy, new SessionFixationProtectionStrategy(), new RegisterSessionAuthenticationStrategy(sessionRegistry) )); }
this is just works for Idp,so i have to configure this to initiate back channel logout for all oidc client:

/**

• 并发会话控制策略。
  */
  public class ConcurrentSessionStrategy
  extends ConcurrentSessionControlAuthenticationStrategy {
  private final BackChannelLogoutService backChannelLogoutService;

/** 创建并发会话控制策略. */
public ConcurrentSessionStrategy(
SessionRegistry sessionRegistry,
BackChannelLogoutService backChannelLogoutService) {
super(sessionRegistry);
this.backChannelLogoutService = backChannelLogoutService;
}

/** 通知业务应用并淘汰超出限制的会话. */
@OverRide
protected void allowableSessionsExceeded(
List sessions,
int allowableSessions,
SessionRegistry registry) {
super.allowableSessionsExceeded(sessions, allowableSessions, registry);
for (SessionInformation session : sessions) {
if (session.getPrincipal() instanceof UserDetails userDetails) {
backChannelLogoutService.notifyAll(userDetails.getUsername(), session.getSessionId());
}
}
}
}
`

the question is :when i revisit the idp,everything is ok,i will be redirected to the loginpage,but when i revisit the oidc client which redirect to idp login endpoint,it login in automatically.i guess the reason is :Concurrent Session Management only set isExpired = true for this session,but this session still exists,so when i am redirected to idp through oidc client with idp session,the isauthticated method return true.i dont know why,so it assumed i am already loged in.

am i clear?
pls tell me why and offer a viable solution