@Service
@Transactional
public class AccessControlServiceImpl implements AccessControlService {
    @Autowired
    private OnlineUserTracker userTracker;

    public void logoff(String username) {
        userTracker.removeUser(username);
    }
}

public class OnlineUserTracker {
    private List<User> users;

    public OnlineUserTracker() {
        this.users = new ArrayList<>();
    }

    public List<User> getUsers() {
        return users;
    }

    public void setUsers(List<User> users) {
        this.users = users;
    }

    public User getUserFromUsername(String username) {
        for (User user : users) {
            if(user.getUsername().equals(username)) {
                return user;
            }
        }
        return null;
    }

    public void removeUser(String username) {
        User user = getUserFromUsername(username);
        if (user != null) {
            users.remove(user);
        }
    }
}