Prevent Multiple Logins

[TL56]

We would like to limit the number of times a user can login into our portal.
Thus, if the user is currently logged in and he/she attempts to login again we
want to prevent them from logging in hence limit one login per user. Does anyone know how to do this? It has to be done at the server level.

 

[RhythmAce]

It has to be done at the server level.

No it doesn't. The user's credentials and login status are not known at the server level. It sounds like you have a very poorly written script. It should keep track of sessions. It should also not allow them to login unless they have cookies enabled. Anything at the server level would involve allowing or blocking ip addreses or using authentication, generally with .htaccess.

 

[TL56]

Thanks for replying.
Currently we use an LDAP to authenticate users, but it doesn't have the capability to restrict the number of logins. Are you stating that we can utilize .htaccess to solve this issue?

 

[RhythmAce]

No I was saying that you can use system level authentication using it. I'm not quite clear on what you mean by multiple logins. Do you mean once and only once in a life time or only one at any given time?

 

[TL56]

What I mean is the user logs in on one machine then goes to another machine and logs in again while the other session is still active. I need to make it so when the second login attempt is made it is denied since there is already an active connection with that username and password.

 

[feherke]

Hi

I need to make it so when the second login attempt is made it is denied since there is already an active connection with that username and password.

That usually is done in the other way : the second login succeeds but the first is invalidated. This is how big portals usually do and is recommended because it is much user friendly.

Feherke.

http://rootshell.be/~feherke/

 

[TL56]

How is it done the other way where the second login succeeds but the first is invalidated.

 

[feherke]

Hi

How is it done the other way where the second login succeeds but the first is invalidated.

If your user's list would be in a database, is very simple
[ol]
[li]in the user table add a field of type character and lets call it session[/li]
[li]in the login script add an SQL command to [tt]update[/tt] the value of the session field with the current session identifier[/li]
[li]in every other page check if the current session identifier is the same as in the session field[/li]
[/ol]
While you are using LDAP, I have no idea how to adapt the above for your needs.

Feherke.

http://rootshell.be/~feherke/