New Posts New Posts RSS Feed: User session management
  FAQ FAQ  Forum Search   Calendar   Register Register  Login Login

User session management
 Post Reply Post Reply
Author
  Share Topic Share Topic  Topic Search Topic Search  Topic Options Topic Options
tersiusk View Drop Down
Newbie
Newbie
Avatar

Joined: 03-Nov-2010
Posts: 20 		Post Options Post Options   Quote tersiusk Quote  Post ReplyReply Direct Link To This Post Topic: User session management
    Posted: 07-Feb-2011 at 11:45pm
I want to extend the security to include administrator session management. This feature would allow an admin to view the current logged in users force a certain user to be logged off etc.

Our setup is as follows. We have a devforce security assembly that is responsible for authentication and user/role management this assembly is used by other programs for security. So a program would have it's own enitymanager that uses the LinkForAuthentication method to login with the security assembly entitymanger.

Now I am thinking of creating a session table to store session data in. When the LogonManager Logon method gets called I can create an entry in the table and when the Logoff is called I can just remove the session information for that user. 

1. How long is a user session valid? Is there some way to set a timeout on the session so that re authentication has to occur after a period of inactivity?

2. How can I get a list of the current active users? For instance I would want to get a list of any users who have performed queries(With the program's entitymanager, not the security assembly enitiymanager) in the last X amount of time.

3. Is there a way to force a user's session to end?
Back to Top
kimj View Drop Down
IdeaBlade
IdeaBlade
Avatar

Joined: 09-May-2007
Posts: 1391 		Post Options Post Options   Quote kimj Quote  Post ReplyReply Direct Link To This Post Posted: 09-Feb-2011 at 9:51am
We've had a long-standing feature request to provide a pluggable "SessionManager".  This is the piece of DevForce which tracks user logins and logouts (and calls the IEntityLoginManager) and keeps a list of logged in users.  Unfortunately, we haven't yet implemented this feature, and the SessionManager capabilities are still mostly closed.
 
1. A user session will time out after 30 minutes of inactivity by default.  This is configurable with the <serverSettings> userSessionTimeout attribute.
 
2. Without the pluggable SessionManager, DevForce does not provide a list of current users.   You may be able to accomplish this by intercepting queries and saves, with the EntityServerQueryInterceptor and EntityServerSaveInterceptor, and looking at the Principal provided by those classes, in addition to keeping your own user session table tracked via login/logout.
 
3. No.  There's no way other than by calling Logout (or by the session timing out due to inactivity) to have a user removed from the active user list. 
 
Back to Top
 Post Reply Post Reply

Forum Jump Forum Permissions View Drop Down