Index: lams_tool_leader/src/java/org/lamsfoundation/lams/tool/leaderselection/service/ILeaderselectionService.java
===================================================================
diff -u -r3bb7e0141ae1cc15ccd737c95d90b5762a34ad61 -r5ad13513778d4ef1ced37eaa30fb2286705d22a7
--- lams_tool_leader/src/java/org/lamsfoundation/lams/tool/leaderselection/service/ILeaderselectionService.java	(.../ILeaderselectionService.java)	(revision 3bb7e0141ae1cc15ccd737c95d90b5762a34ad61)
+++ lams_tool_leader/src/java/org/lamsfoundation/lams/tool/leaderselection/service/ILeaderselectionService.java	(.../ILeaderselectionService.java)	(revision 5ad13513778d4ef1ced37eaa30fb2286705d22a7)
@@ -21,20 +21,15 @@
  * ****************************************************************
  */
 
-
 package org.lamsfoundation.lams.tool.leaderselection.service;
 
 import java.io.IOException;
 import java.util.List;
 
-
 import org.lamsfoundation.lams.notebook.model.NotebookEntry;
-import org.lamsfoundation.lams.tool.exception.DataMissingException;
-import org.lamsfoundation.lams.tool.exception.ToolException;
 import org.lamsfoundation.lams.tool.leaderselection.model.Leaderselection;
 import org.lamsfoundation.lams.tool.leaderselection.model.LeaderselectionSession;
 import org.lamsfoundation.lams.tool.leaderselection.model.LeaderselectionUser;
-import org.lamsfoundation.lams.tool.leaderselection.util.LeaderselectionException;
 import org.lamsfoundation.lams.tool.service.ICommonToolService;
 import org.lamsfoundation.lams.usermanagement.dto.UserDTO;
 
@@ -56,9 +51,9 @@
      *
      * @param userId
      * @param toolSessionId
-     * @return 
-     * @throws IOException 
-     * @throws JSONException 
+     * @return
+     * @throws IOException
+     * @throws JSONException
      */
     boolean setGroupLeader(Long userId, Long toolSessionId) throws IOException;
 
@@ -115,6 +110,8 @@
      */
     LeaderselectionUser getUserByUserIdAndSessionId(Long userId, Long toolSessionId);
 
+    LeaderselectionUser getUserByLoginAndSessionId(String login, long toolSessionId);
+
     LeaderselectionUser getUserByUserIdAndContentId(Long userId, Long toolContentId);
 
     /**
@@ -137,7 +134,7 @@
      * @return
      */
     LeaderselectionUser createLeaderselectionUser(UserDTO user, LeaderselectionSession leaderselectionSession);
-    
+
     String finishToolSession(Long toolSessionId, Long userId);
 
     /**
Index: lams_tool_leader/src/java/org/lamsfoundation/lams/tool/leaderselection/service/LeaderselectionService.java
===================================================================
diff -u -r20aa6cbca9fc96d341080e6ad39f82593443f792 -r5ad13513778d4ef1ced37eaa30fb2286705d22a7
--- lams_tool_leader/src/java/org/lamsfoundation/lams/tool/leaderselection/service/LeaderselectionService.java	(.../LeaderselectionService.java)	(revision 20aa6cbca9fc96d341080e6ad39f82593443f792)
+++ lams_tool_leader/src/java/org/lamsfoundation/lams/tool/leaderselection/service/LeaderselectionService.java	(.../LeaderselectionService.java)	(revision 5ad13513778d4ef1ced37eaa30fb2286705d22a7)
@@ -27,7 +27,6 @@
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.List;
-import java.util.Set;
 import java.util.SortedMap;
 
 import org.apache.log4j.Logger;
@@ -154,7 +153,7 @@
     public List<ConfidenceLevelDTO> getConfidenceLevels(Long toolSessionId) {
 	return null;
     }
-    
+
     @Override
     public boolean isUserGroupLeader(Long userId, Long toolSessionId) {
 	return false;
@@ -209,7 +208,7 @@
 	    logger.warn("Can not remove the tool content as it does not exist, ID: " + toolContentId);
 	    return;
 	}
-	for (LeaderselectionSession session : (Set<LeaderselectionSession>) content.getLeaderselectionSessions()) {
+	for (LeaderselectionSession session : content.getLeaderselectionSessions()) {
 	    List<NotebookEntry> entries = coreNotebookService.getEntry(session.getSessionId(),
 		    CoreNotebookConstants.NOTEBOOK_TOOL, LeaderselectionConstants.TOOL_SIGNATURE);
 	    for (NotebookEntry entry : entries) {
@@ -233,7 +232,7 @@
 	    return;
 	}
 
-	for (LeaderselectionSession session : (Set<LeaderselectionSession>) selection.getLeaderselectionSessions()) {
+	for (LeaderselectionSession session : selection.getLeaderselectionSessions()) {
 	    if ((session.getGroupLeader() != null) && session.getGroupLeader().getUserId().equals(userId.longValue())) {
 		session.setGroupLeader(null);
 		leaderselectionSessionDAO.update(session);
@@ -315,7 +314,7 @@
     @Override
     public boolean isReadOnly(Long toolContentId) {
 	Leaderselection selection = leaderselectionDAO.getByContentId(toolContentId);
-	for (LeaderselectionSession session : (Set<LeaderselectionSession>) selection.getLeaderselectionSessions()) {
+	for (LeaderselectionSession session : selection.getLeaderselectionSessions()) {
 	    if (session.getGroupLeader() != null) {
 		return true;
 	    }
@@ -440,7 +439,15 @@
 	return leaderselectionUserDAO.getByUserIdAndSessionId(userId, toolSessionId);
     }
 
+    @SuppressWarnings("unchecked")
     @Override
+    public LeaderselectionUser getUserByLoginAndSessionId(String login, long toolSessionId) {
+	List<User> user = leaderselectionUserDAO.findByProperty(User.class, "login", login);
+	return user.isEmpty() ? null
+		: leaderselectionUserDAO.getByUserIdAndSessionId(user.get(0).getUserId().longValue(), toolSessionId);
+    }
+
+    @Override
     public LeaderselectionUser getUserByUserIdAndContentId(Long userId, Long toolContentId) {
 	return leaderselectionUserDAO.getByUserIdAndContentId(userId, toolContentId);
     }
@@ -471,7 +478,7 @@
 	saveOrUpdateUser(leaderselectionUser);
 	return leaderselectionUser;
     }
-    
+
     @Override
     public String finishToolSession(Long toolSessionId, Long userId) {
 	LeaderselectionUser user = leaderselectionUserDAO.getByUserIdAndSessionId(userId, toolSessionId);
@@ -565,7 +572,7 @@
     public void auditLogStartEditingActivityInMonitor(long toolContentID) {
 	toolService.auditLogStartEditingActivityInMonitor(toolContentID);
     }
-    
+
     @Override
     public boolean isLastActivity(Long toolSessionId) {
 	return toolService.isLastActivity(toolSessionId);
Index: lams_tool_leader/src/java/org/lamsfoundation/lams/tool/leaderselection/web/controller/LearningWebsocketServer.java
===================================================================
diff -u -r18a207719c2aa30f683987fd0bb9176521b704de -r5ad13513778d4ef1ced37eaa30fb2286705d22a7
--- lams_tool_leader/src/java/org/lamsfoundation/lams/tool/leaderselection/web/controller/LearningWebsocketServer.java	(.../LearningWebsocketServer.java)	(revision 18a207719c2aa30f683987fd0bb9176521b704de)
+++ lams_tool_leader/src/java/org/lamsfoundation/lams/tool/leaderselection/web/controller/LearningWebsocketServer.java	(.../LearningWebsocketServer.java)	(revision 5ad13513778d4ef1ced37eaa30fb2286705d22a7)
@@ -15,6 +15,7 @@
 import javax.websocket.server.ServerEndpoint;
 
 import org.apache.log4j.Logger;
+import org.lamsfoundation.lams.tool.leaderselection.model.LeaderselectionUser;
 import org.lamsfoundation.lams.tool.leaderselection.service.ILeaderselectionService;
 import org.lamsfoundation.lams.util.hibernate.HibernateSessionManager;
 import org.lamsfoundation.lams.web.session.SessionManager;
@@ -47,7 +48,7 @@
 		try {
 		    // websocket communication bypasses standard HTTP filters, so Hibernate session needs to be initialised manually
 		    HibernateSessionManager.openSession();
-		    
+
 		    Iterator<Entry<Long, Set<Session>>> entryIterator = LearningWebsocketServer.websockets.entrySet()
 			    .iterator();
 		    // go through activities and update registered learners with reports and vote count
@@ -103,6 +104,14 @@
     public void registerUser(Session websocket) throws IOException {
 	Long toolSessionId = Long
 		.valueOf(websocket.getRequestParameterMap().get(AttributeNames.PARAM_TOOL_SESSION_ID).get(0));
+	String login = websocket.getUserPrincipal().getName();
+	LeaderselectionUser user = LearningWebsocketServer.getLeaderService().getUserByLoginAndSessionId(login,
+		toolSessionId);
+	if (user == null) {
+	    throw new SecurityException("User \"" + login
+		    + "\" is not a participant in Leader Selection activity with tool session ID " + toolSessionId);
+	}
+
 	Set<Session> sessionWebsockets = websockets.get(toolSessionId);
 	if (sessionWebsockets == null) {
 	    sessionWebsockets = ConcurrentHashMap.newKeySet();
@@ -111,8 +120,7 @@
 	sessionWebsockets.add(websocket);
 
 	if (log.isDebugEnabled()) {
-	    log.debug("User " + websocket.getUserPrincipal().getName()
-		    + " entered Leader Selection with toolSessionId: " + toolSessionId);
+	    log.debug("User " + login + " entered Leader Selection with toolSessionId: " + toolSessionId);
 	}
     }