1

We got a front-end website, where users can register and log in (and an extranet user is being created in Sitecore for that). We noticed, that on password change on one browser, the user stays logged in on all other browsers they were logged in. So the requirement is to log them out of all their sessions on password change.

I am trying to find a way to get all the sessions of the specific user and invalidate their logged in session. Is there a way in Sitecore to get all active sessions of an user? Or is there a totally different approach I could take to achieve my goal?

5
  • Does it help? sitecore.stackexchange.com/questions/33979/… Commented Mar 13 at 8:53
  • I did try this out but it didn't work. In my case, when an user is resetting their password, they are not logged in on that specific browser, so it seems like there's nothing to log-out.
    – Linas
    Commented Mar 13 at 9:16
  • 1
    you can check this option: stackoverflow.com/questions/8854176/… But OOTB there's no way to get list of all active extranet sessions. But you can try to introduce some user property 'Password Guid' and set it just to random guid for new users and change it when password is changed. also during login you should add cookie with the value of this field, and then in some processor check if cookie is not the same, as field from profile - force user logout. Commented Mar 13 at 12:25
  • is your front end website ASP.NET MVC or is this headless?
    – Richard Seal
    Commented Mar 13 at 15:43
  • @RichardSeal it's ASP.NET MVC
    – Linas
    Commented Mar 15 at 13:07

1 Answer 1

2

When a user registers, you can create a new custom field in user profile. Below are the steps:

  1. Select the Core database.
  2. Open the Template Manager and select the User item. You can find it in the following path: templates/System/Security/User.
  3. Edit the template, adding the fields you need. Sections can also be added.
  4. SAVE the changes.
  5. Select Master database and verify the new field is displayed on the User Manager/Edit User page.

As Igor said, in that custom field you can save value and for another user's login session you can check that value if it matches or not. If not then you can log out.

You can save custom values like the below code:

UserProfile customProfile = SitecoreUser.Profile;
using (new SecurityDisabler())
{
    customProfile[fieldName] = stringValue;
}
customProfile.Save();

And get custom value like the below code:

var customField = currentUser.Profile.GetCustomProperty("custom");

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.