1. A user session will time out after 30 minutes of inactivity by default.  This is configurable with the <serverSettings> userSessionTimeout attribute.

 

2. Without the pluggable SessionManager, DevForce does not provide a list of current users.   You may be able to accomplish this by intercepting queries and saves, with the EntityServerQueryInterceptor and EntityServerSaveInterceptor, and looking at the Principal provided by those classes, in addition to keeping your own user session table tracked via login/logout.

 

3. No.  There's no way other than by calling Logout (or by the session timing out due to inactivity) to have a user removed from the active user list. 

 

Our setup is as follows. We have a devforce security assembly that is responsible for authentication and user/role management this assembly is used by other programs for security. So a program would have it's own enitymanager that uses the LinkForAuthentication method to login with the security assembly entitymanger.

Now I am thinking of creating a session table to store session data in. When the LogonManager Logon method gets called I can create an entry in the table and when the Logoff is called I can just remove the session information for that user. 

1. How long is a user session valid? Is there some way to set a timeout on the session so that re authentication has to occur after a period of inactivity?

2. How can I get a list of the current active users? For instance I would want to get a list of any users who have performed queries(With the program's entitymanager, not the security assembly enitiymanager) in the last X amount of time.

3. Is there a way to force a user's session to end?