Configuring SP to limit each user to one concurrent session

[Cantor, Scott]

On 7/31/13 5:02 PM, "Klumpenaar, Michael (US - Newton)"
<mklumpenaar at deloitte.com> wrote:

> We are also exploring ways of enforcing this constraint at the IdP, but
>believe that an SP solution will be easier to implement and maintain.

I don't think it's easy to do anywhere. Of the two, extending the IdP is
much easier for most people because Java is more understood than C++. But
I can't think of any way to do it at the IdP.

> 
> 
>The sessionHook  attribute looks like it could potentially be used to
>block additional sessions for a user, but I¹m not sure if there is a way
>to determine if other sessions already exist.

There isn't. The only way architecturally to do this today in the SP is
with a lot of custom plugin code in the session cache area. That's not a
path worth taking.

The most direct route is to add application code to do this, and using the
sessionHook might be part of a mechanism, but a fundamental problem is
that the web does not support logout in any meaningful way, and so you
have no way to avoid people getting locked out by sessions that are old.
You can expire them quickly, of course, that's about it.

-- Scott