Index: lams_tool_mindmap/src/java/org/lamsfoundation/lams/tool/mindmap/service/IMindmapService.java
===================================================================
diff -u -r3bb7e0141ae1cc15ccd737c95d90b5762a34ad61 -rf6e7035df9568b17d8f83273fc025fec8f624680
--- lams_tool_mindmap/src/java/org/lamsfoundation/lams/tool/mindmap/service/IMindmapService.java	(.../IMindmapService.java)	(revision 3bb7e0141ae1cc15ccd737c95d90b5762a34ad61)
+++ lams_tool_mindmap/src/java/org/lamsfoundation/lams/tool/mindmap/service/IMindmapService.java	(.../IMindmapService.java)	(revision f6e7035df9568b17d8f83273fc025fec8f624680)
@@ -21,7 +21,6 @@
  * ****************************************************************
  */
 
-
 package org.lamsfoundation.lams.tool.mindmap.service;
 
 import java.util.List;
@@ -62,6 +61,8 @@
 
     public MindmapUser getUserByUserIdAndSessionId(Long userId, Long toolSessionId);
 
+    public MindmapUser getUserByLoginAndSessionId(String login, long toolSessionId);
+
     public MindmapUser getUserByUID(Long uid);
 
     public void saveOrUpdateMindmapUser(MindmapUser mindmapUser);
Index: lams_tool_mindmap/src/java/org/lamsfoundation/lams/tool/mindmap/service/MindmapService.java
===================================================================
diff -u -r20aa6cbca9fc96d341080e6ad39f82593443f792 -rf6e7035df9568b17d8f83273fc025fec8f624680
--- lams_tool_mindmap/src/java/org/lamsfoundation/lams/tool/mindmap/service/MindmapService.java	(.../MindmapService.java)	(revision 20aa6cbca9fc96d341080e6ad39f82593443f792)
+++ lams_tool_mindmap/src/java/org/lamsfoundation/lams/tool/mindmap/service/MindmapService.java	(.../MindmapService.java)	(revision f6e7035df9568b17d8f83273fc025fec8f624680)
@@ -28,7 +28,6 @@
 import java.util.Iterator;
 import java.util.LinkedList;
 import java.util.List;
-import java.util.Set;
 import java.util.SortedMap;
 
 import org.apache.log4j.Logger;
@@ -175,7 +174,7 @@
     public List<ConfidenceLevelDTO> getConfidenceLevels(Long toolSessionId) {
 	return null;
     }
-    
+
     @Override
     public boolean isUserGroupLeader(Long userId, Long toolSessionId) {
 	return false;
@@ -335,19 +334,20 @@
 		}
 
 		int edit;
-		if ( isAuthor ){
-			edit = 1;
-		} else if ( isMonitor || isUserLocked || mindmapUser == null) {
+		if (isAuthor) {
+		    edit = 1;
+		} else if (isMonitor || isUserLocked || mindmapUser == null) {
 		    edit = 0;
-		    } else {
+		} else {
 		    edit = mindmapUser.equals(mindmapNode.getUser()) ? 1 : 0;
-		    }
+		}
 
-		NodeModel nodeModel = new NodeModel(new NodeConceptModel(mindmapNode.getUniqueId(), mindmapNode.getText(),
-			    mindmapNode.getColor(), mindmapUserName, edit));
+		NodeModel nodeModel = new NodeModel(new NodeConceptModel(mindmapNode.getUniqueId(),
+			mindmapNode.getText(), mindmapNode.getColor(), mindmapUserName, edit));
 
 		rootNodeModel.addNode(nodeModel);
-		getMindmapXMLFromDatabase(mindmapNode.getNodeId(), mindmapId, nodeModel, mindmapUser, isMonitor, isAuthor, isUserLocked);
+		getMindmapXMLFromDatabase(mindmapNode.getNodeId(), mindmapId, nodeModel, mindmapUser, isMonitor,
+			isAuthor, isUserLocked);
 	    }
 	}
 
@@ -404,7 +404,7 @@
 	    return;
 	}
 
-	for (MindmapSession session : (Set<MindmapSession>) mindmap.getMindmapSessions()) {
+	for (MindmapSession session : mindmap.getMindmapSessions()) {
 	    List<NotebookEntry> entries = coreNotebookService.getEntry(session.getSessionId(),
 		    CoreNotebookConstants.NOTEBOOK_TOOL, MindmapConstants.TOOL_SIGNATURE);
 	    for (NotebookEntry entry : entries) {
@@ -431,7 +431,7 @@
 	}
 
 	List<MindmapNode> nodesToDelete = new LinkedList<>();
-	for (MindmapSession session : (Set<MindmapSession>) mindmap.getMindmapSessions()) {
+	for (MindmapSession session : mindmap.getMindmapSessions()) {
 	    List<MindmapNode> nodes = mindmapNodeDAO.getMindmapNodesBySessionIdAndUserId(session.getSessionId(),
 		    userId.longValue());
 
@@ -451,7 +451,7 @@
 	    mindmapNodeDAO.delete(node);
 	}
 
-	for (MindmapSession session : (Set<MindmapSession>) mindmap.getMindmapSessions()) {
+	for (MindmapSession session : mindmap.getMindmapSessions()) {
 	    MindmapUser user = mindmapUserDAO.getByUserIdAndSessionId(userId.longValue(), session.getSessionId());
 	    if (user != null) {
 		if (user.getEntryUID() != null) {
@@ -610,8 +610,8 @@
     public boolean isReadOnly(Long toolContentId) {
 	Mindmap mindmap = mindmapDAO.getByContentId(toolContentId);
 
-	for (MindmapSession session : (Set<MindmapSession>) mindmap.getMindmapSessions()) {
-	    for (MindmapUser user : (Set<MindmapUser>) session.getMindmapUsers()) {
+	for (MindmapSession session : mindmap.getMindmapSessions()) {
+	    for (MindmapUser user : session.getMindmapUsers()) {
 		if (!mindmapNodeDAO.getMindmapNodesBySessionIdAndUserId(session.getSessionId(), user.getUserId())
 			.isEmpty()) {
 		    return true;
@@ -718,6 +718,14 @@
 	return mindmapUserDAO.getByUserIdAndSessionId(userId, toolSessionId);
     }
 
+    @SuppressWarnings("unchecked")
+    @Override
+    public MindmapUser getUserByLoginAndSessionId(String login, long toolSessionId) {
+	List<User> user = mindmapUserDAO.findByProperty(User.class, "login", login);
+	return user.isEmpty() ? null
+		: mindmapUserDAO.getByUserIdAndSessionId(user.get(0).getUserId().longValue(), toolSessionId);
+    }
+
     public MindmapUser getUserByLoginNameAndSessionId(String loginName, Long toolSessionId) {
 	return mindmapUserDAO.getByLoginNameAndSessionId(loginName, toolSessionId);
     }
@@ -838,7 +846,7 @@
     public void auditLogStartEditingActivityInMonitor(long toolContentID) {
 	toolService.auditLogStartEditingActivityInMonitor(toolContentID);
     }
-    
+
     @Override
     public boolean isLastActivity(Long toolSessionId) {
 	return toolService.isLastActivity(toolSessionId);
Index: lams_tool_mindmap/src/java/org/lamsfoundation/lams/tool/mindmap/web/controller/LearningWebsocketServer.java
===================================================================
diff -u -r18a207719c2aa30f683987fd0bb9176521b704de -rf6e7035df9568b17d8f83273fc025fec8f624680
--- lams_tool_mindmap/src/java/org/lamsfoundation/lams/tool/mindmap/web/controller/LearningWebsocketServer.java	(.../LearningWebsocketServer.java)	(revision 18a207719c2aa30f683987fd0bb9176521b704de)
+++ lams_tool_mindmap/src/java/org/lamsfoundation/lams/tool/mindmap/web/controller/LearningWebsocketServer.java	(.../LearningWebsocketServer.java)	(revision f6e7035df9568b17d8f83273fc025fec8f624680)
@@ -56,7 +56,7 @@
 		try {
 		    // websocket communication bypasses standard HTTP filters, so Hibernate session needs to be initialised manually
 		    HibernateSessionManager.openSession();
-		    
+
 		    Iterator<Entry<Long, Set<Session>>> entryIterator = LearningWebsocketServer.websockets.entrySet()
 			    .iterator();
 		    // go through activities and update registered learners with reports and vote count
@@ -223,6 +223,13 @@
     public void registerUser(Session websocket) throws IOException {
 	Long toolSessionId = Long
 		.valueOf(websocket.getRequestParameterMap().get(AttributeNames.PARAM_TOOL_SESSION_ID).get(0));
+	String login = websocket.getUserPrincipal().getName();
+	MindmapUser user = LearningWebsocketServer.getMindmapService().getUserByLoginAndSessionId(login, toolSessionId);
+	if (user == null) {
+	    throw new SecurityException("User \"" + login
+		    + "\" is not a participant in Mindmap activity with tool session ID " + toolSessionId);
+	}
+
 	Long lastActionId = Long.valueOf(websocket.getRequestParameterMap().get("lastActionId").get(0));
 	Set<Session> sessionWebsockets = LearningWebsocketServer.websockets.get(toolSessionId);
 	if (sessionWebsockets == null) {
@@ -232,8 +239,8 @@
 	sessionWebsockets.add(websocket);
 
 	if (LearningWebsocketServer.log.isDebugEnabled()) {
-	    LearningWebsocketServer.log.debug("User " + websocket.getUserPrincipal().getName()
-		    + " entered Mindmap with toolSessionId: " + toolSessionId + " lastActionId: " + lastActionId);
+	    LearningWebsocketServer.log.debug("User " + login + " entered Mindmap with toolSessionId: " + toolSessionId
+		    + " lastActionId: " + lastActionId);
 	}
 
 	new Thread(() -> {