Limit number of concurrent OIDC sessions per user #187
Comments
|
Anything is possible ;) I would need to review how the sessions are indexed in redis to see if it’s feasible to iterate and determine which sessions are tied to a given user. |
|
Indexing would require not to encrypt the data in redis - which would be okay for me - I don't require that (but do it since I cannot turn it of) |
|
Right but the server has the keys required to decrypt. I just don't know how sane it would be to iterate everything and check. |
|
My redis stores about 4400 records - since I only have a couple if users, this seems to be pretty much. Does eas delete the records of expired sessions? |
|
Most everything should have a ttl but I think certain configurations will result in entries without ttls as I recall. Can you send over the pattern(s) for the key names that make up the majority of those entries? |
|
|
TTL is set on all entries |
|
Ah ok, must have a relatively lengthy ttl? Or maybe your users are connecting from many devices? |
|
Is the ttl derived from the |
|
As I recall yes, there are a few config options that may impact it but it’s been a while since I dug in. In principle it’s derived from the various session params though yes. |
|
Ok, then we'll leave this issue open. Maybe you'll find the time and fun to implement something like that. Could be a very nice feature. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Is it possible to limit the number of concurrent OIDC sessions per user?
E.g. to 1 - so that when a user creates a second session, the first is destroyed.
Would it be possible to implement that?
The text was updated successfully, but these errors were encountered: