SSP: Limiting Concurrent Sessions for Users and user groups.

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

Limit concurrent sessions to SSP and Console to a maximum of 2 sessions per user at any given time.

 

• Multiple Sessions Per User: Users may have more than two active sessions on the same account, which could potentially lead to security risks, resource overload, or user confusion

• Inconsistent Session Management: Users might encounter issues related to session overlaps, unexpected logouts, or problems accessing resources from different sessions.

• Security Concerns: Unrestricted concurrent sessions could expose users to risks such as unauthorized access or account hijacking if sessions are left open across multiple platforms.

 

Environment

SSP 5.0 ( Security software platform)

Cause

The cause of the issue stems from the current behavior in Authelia, where there is no built-in limitation on the number of concurrent sessions per user. This allows users to log in multiple times across different devices or browsers without restriction.

This enhancement request proposes introducing a mechanism that enforces a cap on the number of active sessions a user can have at the same time (a maximum of two)

Resolution

The feature to limit concurrent sessions will be available in a future release of Authelia. This will allow administrators to configure the maximum number of concurrent sessions per user, which will provide better control over session management, enhance security, and improve resource allocation.