SEC-1318: Correct logic for checking combination of session-management attributes.

config/src/test/java/org/springframework/security/config/http/HttpSecurityBeanDefinitionParserTests.java

@@ -729,6 +729,17 @@ public class HttpSecurityBeanDefinitionParserTests {
         checkSessionRegistry();
     }
 
+    @Test
+    public void externalSessionStrategyIsSupported() throws Exception {
+        setContext(
+                "<http auto-config='true'>" +
+                "    <session-management session-authentication-strategy-ref='ss'/>" +
+                "</http>" +
+                "<b:bean id='ss' class='org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy'/>"
+                + AUTH_PROVIDER_XML);
+        //session-authentication-strategy-ref
+    }
+
     @Test
     public void externalSessionRegistryBeanIsConfiguredCorrectly() throws Exception {
         setContext(