Issue with remember-me persistent token - spring-security

Question

I have a issue when implement spring security remember-me persistent token.
Already successful implement remember-me persistent token, but issue occurs when user logout of system.
Here are implementation:
spring-security.xml
<global-method-security pre-post-annotations="enabled"/>
<http auto-config="true" use-expressions="true" >
...some url parten
<form-login login-page="/login.html"
authentication-failure-url="/loginfailed.html"
authentication-success-handler-ref="customAuthenticationHandler"/>
<logout logout-success-url="/logout.html" delete-cookies='JSESSIONID' />
<remember-me services-ref="pfRememberMeServices"
key="pf_token_key"/>
</http>
<beans:bean id="pfRememberMeServices"
class="org.springframework.security.web.authentication.rememberme.PersistentTokenBasedRememberMeServices">
<beans:property name="tokenRepository" ref="pfTokenRepository" />
<beans:property name="userDetailsService" ref="userDetailsService" />
<beans:property name="tokenValiditySeconds" value="86400"/> <!-- alive in 1 day -->
<beans:property name="key" value="pf_token_key" />
<beans:property name="cookieName" value="mycookie" />
<beans:property name="alwaysRemember" value="true" />
</beans:bean>
<authentication-manager alias="authenticationManager">
<authentication-provider user-service-ref="userDetailsService" />
</authentication-manager>
<beans:bean id="userDetailsService"
class="com.platform.authenticate.model.UserDetailsServiceImpl" >
</beans:bean>.
Token repository:
#Override
public void removeUserTokens(String userid) {
// TODO Auto-generated method stub
tokenDao.removeUserTokens(userid);
}
TokenDao:
#Transactional
public void removeUserTokens(final String username) {
//Session session = getSessionFactory().getCurrentSession();
Session session = HibernateUtil.getSessionFactory().openSession();
Transaction tx = null;
try {
tx = session.beginTransaction();
Token token =
(Token) session.createCriteria(Token.class)
.add(Restrictions.eq("username", username)).uniqueResult();
if (token != null) {
session.delete(token);
}
tx.commit();
} catch (RuntimeException e) {
tx.rollback();
throw e; // or display error message
} finally {
session.close();
}
}
When I login with the same user on two browsers, or two clients, there are two records in persistent_logins table as following:
"2JLIh8E8vifKOdlaidCIog==";"user12";"OKjbqqIAhx74JpmPsNQHaw==";"2013-07-03 16:19:05.12"
"gQ2EDtl87ZC6XSjV6cTYrA==";"user12";"iYrG7dlnjPyKxUz/hwQMdQ==";"2013-07-03 15:47:24.011"
Is my implementation is right when there are two record for the same user?
Then, when I logout from one browser, or one client, the removeUserTokens() function is fired, but:
Token token =
(Token) session.createCriteria(Token.class)
.add(Restrictions.eq("username", username)).uniqueResult();
with above code, I could not remove token for logout user by username, when there are 2 records of user12, it is not unique result.
If I force delete all user12, then all session/token for all clients will be deleted. It is not right?
So how could I remove session/token info for logout user only, but keep session/token for same user on others client?
I have already ask mr google but my issue is seem to be unique, could not find any same one out there.
If my implementation is wrong, please let me know.
Update:
Here are stack trace when I send j_spring_security_logout from one client:
exception
org.hibernate.NonUniqueResultException: query did not return a unique
result: 2
org.hibernate.impl.AbstractQueryImpl.uniqueElement(AbstractQueryImpl.java:899)
org.hibernate.impl.CriteriaImpl.uniqueResult(CriteriaImpl.java:369)

Answer 1

I got same implementation - i got same problem.
But no i decide to delete all tokens, because to look up token for definitely
List<Token> tokens = sessionFactory.getCurrentSession().createCriteria(Token.class)
.add(Restrictions.eq("username", username)).list();
if (tokens.size() > 0) {
for (Token token : tokens) {
sessionFactory.getCurrentSession().delete(token);
}
}