@Override
    public AuthenticationPolicyExecutionResult isSatisfiedBy(final Authentication authentication,
                                                             final Set<AuthenticationHandler> authenticationHandlers,
                                                             final ConfigurableApplicationContext applicationContext,
                                                             final Map<String, ? extends Serializable> context) throws Throwable {
        val request = HttpRequestUtils.getHttpServletRequestFromRequestAttributes();
        val ssoRequest = SingleSignOnParticipationRequest.builder()
            .httpServletRequest(request)
            .build();
        val strategy = singleSignOnParticipationStrategy.getObject();
        val ssoParticipation = strategy.supports(ssoRequest) && strategy.isParticipating(ssoRequest);
        if (!context.containsKey(Assertion.class.getName()) && ssoParticipation) {
            val authPrincipal = authentication.getPrincipal();
            val count = ticketRegistry.countSessionsFor(authPrincipal.getId());
            if (count > properties.getMaximumAllowedSessions()) {
                LOGGER.warn("[{}] cannot be satisfied for [{}]; [{}] sessions currently exist",
                    getName(), authPrincipal.getId(), count);
                throw new UniquePrincipalRequiredException();
            }
        }
        return AuthenticationPolicyExecutionResult.success();
    }
This is {@link UniquePrincipalAuthenticationPolicy}
that prevents authentication if the same principal id
is found more than one in the registry. This effectively forces
each user to have a single and unique SSO session, disallowing
multiple logins.

@author Misagh Moayyed
@since 5.2.0
core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/policy/UniquePrincipalAuthenticationPolicy.java