[xwiki-users] Concurrent users
Does anyone know of some way to limit concurrent use of a user account? I need to prevent the same user account being used by more than one person at the same time. Thanks -- View this message in context: http://n2.nabble.com/Concurrent-users-tp1477107p1477107.html Sent from the XWiki- Users mailing list archive at Nabble.com.
Hi, On Nov 9, 2008, at 1:05 PM, eggenheimer wrote:
Does anyone know of some way to limit concurrent use of a user account? I need to prevent the same user account being used by more than one person at the same time.
How would you want to do that? I'm asking since HTTP is stateless. You could check the IP address maybe (assuming the concurrent uses are not done on the same machine). I guess you could use a Servlet Session listener for example. Thanks -Vincent
Yes I guess sessions would probably be the best way to distinguish between different computers in this case. I don't know much java or the way xwiki is structured - can anyone point me in the right direction? Thanks On Sun, Nov 9, 2008 at 1:45 PM, vmassol (via Nabble) < [email protected]<ml-user%[email protected]>
wrote:
Hi,
On Nov 9, 2008, at 1:05 PM, eggenheimer wrote:
Does anyone know of some way to limit concurrent use of a user account? I need to prevent the same user account being used by more than one person at the same time.
How would you want to do that? I'm asking since HTTP is stateless. You could check the IP address maybe (assuming the concurrent uses are not done on the same machine).
I guess you could use a Servlet Session listener for example.
Thanks -Vincent
_______________________________________________ users mailing list users@...<http://n2.nabble.com/user/SendEmail.jtp?type=node&node=1477252&i=0> http://lists.xwiki.org/mailman/listinfo/users
------------------------------ This email is a reply to your post @ http://n2.nabble.com/Concurrent-users-tp1477107p1477252.html You can reply by email or by visting the link above.
-- View this message in context: http://n2.nabble.com/Concurrent-users-tp1477107p1480219.html Sent from the XWiki- Users mailing list archive at Nabble.com.
On Mon, Nov 10, 2008 at 4:20 AM, eggenheimer <[email protected]> wrote:
Yes I guess sessions would probably be the best way to distinguish between different computers in this case. I don't know much java or the way xwiki is structured - can anyone point me in the right direction?
And now, for something completely different... For reasons of security/configuration/etc, I typically "front" Java-based web-apps with apache, and then redirect to Java via mod_proxy_ajp w/ "ProxyPass /xwiki/ ajp://127.0.0.1:8009/xwiki/" Given such a configuration, I would consider looking into an external apache authentication and access control module that can provide you with the necessary limitations. One possibility is to use an external login mechanism in apache which generates a random number ID via cookie; for any subsequent accesses to the "protected access" URL, that ID/cookie which must be present before redirecting to xwiki via mod_proxy_ajp. This per-user cookie ID would be cleared if the given user logs out (via associated external login mechanism), and no other logins would be allowed until the 'latest-login-cookie' was cleared. Only incoming requests presenting the specific cookie/ID associated with the user will be passed on to mod_proxy_ajp and in-turn, java and Xwiki. http://www.frogdot.org/mod_auth_mda/ is a good module to accomplish such tasks: -- <http://www.frogdot.org/logintools/pab/scheme1.gif> This approach wouldn't care about IP address per-se. The user could start the transaction on a laptop plugged in to one network, disconnect, and continue on a different one. On the other hand, if the user walked over to a different computer, and didn't logout his last session, he couldn't log back in w/o either going back to his old computer and logging out, or requesting an administrator override. Niels http://nielsmayer.com
participants (3)
-
eggenheimer -
Niels Mayer -
Vincent Massol