Restrict user concurrent web logins to 1

HCL Domino Domino Forum
1

Hello,

Are there any new features in R6 that will allow me to restrict a user to only one login at a time on a web server? For instance, it would work kind of like Instant messaging. If you login at another PC and you’re already logged in somewhere else, it will log you off the other session before allowing you access on your current session.

I’ve searched both forums pretty well and saw this question asked, but no definite work-arounds.

Any suggestions would be helpful!

TIA,

Carol

2

Subject: restrict user concurrent web logins to 1

Enabling session authentication will you get a bit closer, although what you want is not exactly part of the out-of-the-box feature set. You could accomplish this in 2 different ways:- Use an DASPI filter DLL which enforces this (you’d need to have someone write this .dll for you or buy an existing solution)

  • Use browser cookies. You could set a special cookie in the users browser and check for it. If that user logs on from a different PC or address, the cookie wouldn’t exist there or be different.

Thomas - IBM

3

Subject: How To Extend Domino Authentication For Websites, Single Sign-on and Persistent Sessions

This post should help to restrict users from concurrent web logins.

Response=Session.SendConsoleCommand( serverName$, “show inetusers”)

http://blog.agileware.net/index.php/archives/2005/10/23/how-to-extend-domino-authentication-for-websites-single-sign-on-and-persistent-sessions/

Use servlet to “hold” credentials until a “show inetusers” is shown to be null

HttpSessionListener. (http://forum.java.sun.com/thread.jspa?threadID=651128&messageID=3837686)

4

Subject: restrict user concurrent web logins to 1

HTTP is sessionless. There would be no way to know if the user logged out. The only way to do it would be to force the user to come in through a specific web page and ‘register’ that they are logged in and then force them to log out. If they accidentally closed their web browser, you would not know they logged and now they would be locked out. You’d have to automatically assume that, after a certain amount of time, they had logged out. Or you could write all applications to work with the central database to constantly monitor all users. That would create a huge load on the server.

I am not sure of the value of this, many people have multiple web browsers open to make life easier. If you are trying to restrict on a specific application, you would be better off to write some agents to enforce that on the specific application.

5

Subject: RE: restrict user concurrent web logins to 1

Thanks for your suggestion.

We’re trying to restrict users to a single login so that if a username and password is compromised (published on a bulletin board, shared among lots of unauthorized users, etc.) it’ll be more difficult to use it. I think I’m going to look into setting up some kind of monitor to get track user activity.

Regards,

Carol