1

We are using Sitecore 10.1.2
The CMS uses both native & Azure AD logins.
A user is able to login to the CMS in multiple simultaneous sessions/browsers/from different IPs.

Is it possible to prevent this by any config setting. If it is a custom implementation, please provide any pointers on where and how to achieve this.

1
  • What if you want to prevent the second login attempt? I think that's the more secure objective here.
    – Securus
    Feb 17, 2023 at 14:02

1 Answer 1

3

Create a new processor to validate a single session on <owin.cookieAuthentication.signedIn> pipeline, if the same username is already logged in on other devices, we kick out the session and then remove the user's ticket from Sitecore TicketManager.

App_Config\Sitecore\Owin.Authentication\Sitecore.Owin.Authentication.config

<configuration>
    <sitecore>
    <pipelines>
    
    <owin.cookieAuthentication.signIn>
        <processor resolve="true" type="your.SIGN-IN.pipeline, YourDLL" patch:after="processor[@type='Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignIn.RemoveTicket, Sitecore.Owin.Authentication']" />
</owin.cookieAuthentication.signIn>
    
    </pipelines>
    </sitecore>
    </configuration>

Create ValidateSingleSession class inherit from SignedInProcessor

using System;
using Sitecore.Abstractions;
using Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignedIn;
using Sitecore.Web.Authentication;
using System.Collections.Generic;


namespace Sitecore.SitecoreExtensions.Owin.Authentication.Pipelines
{
    public class ValidateSingleSession : SignedInProcessor
    {
        protected BaseTicketManager TicketManager { get; }
        public ValidateSingleSession(BaseTicketManager ticketManager)
        {
            this.TicketManager = ticketManager;
        }
        public override void Process(SignedInArgs args)
        {
            if (!string.Equals(args.Site.Name, "shell", StringComparison.Ordinal))
                return;

            var validateSingleSession = Sitecore.Configuration.Settings.GetSetting("Security.ValidateSingleSession");
            if (!bool.Parse(validateSingleSession))
                return;

            List<DomainAccessGuard.Session> userSessionList = DomainAccessGuard.Sessions;

            if (userSessionList != null && userSessionList.Count > 0)
            {
                foreach (DomainAccessGuard.Session userSession in userSessionList.ToArray())
                {
                    if (args.User.UserName == userSession.UserName)
                    {
                        DomainAccessGuard.Kick(userSession.SessionID);
                        Sitecore.Diagnostics.Log.Audit($"Concurrent sessions detected: User {userSession.UserName} is kicked out ", this);
                    }
                }

            }

            //remove ticket 
            var ticketIds = this.TicketManager.GetTicketIDs();
            if (ticketIds != null && ticketIds.Count > 0)
            {
                foreach (var ticketID in ticketIds)
                {
                    var ticket = this.TicketManager.GetTicket(ticketID);
                    if (args.User.UserName == ticket.UserName)
                    {
                        this.TicketManager.RemoveTicket(ticketID);
                    }

                }
            }

        }
    }
}

Also created a field to allow the development team to disable single-session validation by introducing Security.ValidateSingleSession setting in config.

For more detailes visit the link - https://edwenkerk.hashnode.dev/sitecore-10-single-login-session-and-kick-idle-user

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.