shibboleth session management

[Peter Schober]

* samir el otmani <elotmani.samir at gmail.com> [2015-02-03 11:54]:
> I need a workaround for this because it is required and important
> feature , is that the user will have only one active session , is
> there anyone who can help me to perfom this workaround.

It being "required" and "important" doesn't really change anything
about your question. The Shibboleth SP only supports one session per
HTTP User Agent at the same time, i.e. a new sessions from the same
user agent would replace any existing *Shibboleth* session. How that
affects the application sessions under your control is, well, under
your control.

If the subject choses to open another HTTP User Agent (or the same one
with "private browsing mode") s/he could esablish more than one Shib
SP session, of course. But since you can evaluate any attributes
recieved you don't need to rely on the Shibboleth SP session to
identify the same subject, you can do that yourself based on a unique
identifier, for example.

So I guess to achieve what you want you'd needed to add a persistence
(or at least caching, as in memcached, for example) layer to your
code, and store the sessions you created per unique identifer. Then
deny the creation of an application session if you determine that the
subject already has a session.
(Sounds like a recipe for annoying users, with potential for false
positives, but YMMV.)
-peter