Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (athena.apache.org: domain of cjderham@gmail.com designates
 209.85.215.45 as permitted sender)
MIME-Version: 1.0
Reply-To: chris@derham.me.uk
Sender: cjderham@gmail.com
In-Reply-To: <4F0FE08B.1030503@ice-sa.com>
References: 
 <9AC7CB8C92B3AB47B6F02319FB5577D30CC046@EAGE-ERFPMBX26.ERF.thomson.com>
 <4F0FE08B.1030503@ice-sa.com>
From: chris derham <chris@derham.me.uk>
Date: Fri, 13 Jan 2012 22:09:44 +1300
Message-ID: 
 <CAG6aRdU_HYKcbY+A1Ug==vQx7f1Z0T1t-6ZxxZ_ABeiDDaDNmg@mail.gmail.com>
Subject: Re: Strategy to prohibit concurrent users authenticated through
 Tomcat
To: Tomcat Users List <users@tomcat.apache.org>
Content-Type: multipart/alternative; boundary=e0cb4efe325419783304b6653b43

--e0cb4efe325419783304b6653b43
Content-Type: text/plain; charset=ISO-8859-1

>
> I am using Tomcat 7.0.11 and use Form Authentication (via
>> j_security_check) to authenticate through the Tomcat server.
>> Currently, two users with the same username can log into my application
>> from two different computers and concurrently access the app.
>> Is there a way to prohibit a user from authenticating if a user with the
>> same username has previously authenticated and still has an active session?
>>
>> We use spring security in a web app that is deployed in tomcat. It has
built in support for this - you can configure to either disallow subsequent
sessions, or kill the first session and allow subsequent sessions. This
should explain it better than I can
http://static.springsource.org/spring-security/site/docs/3.0.x/reference/session-mgmt.html.
Don't know how big a task it would be for you to move to this, but it works
really well for us

If you provide a bit more information about what you are trying/need to do,
> someone my come up with a better idea.
> For example, what is the real problem - in your application - when two
> people at different computers login with the same user-id ?
>
> +1

Chris

--e0cb4efe325419783304b6653b43--