Unique user ID

[jcarrallo]

Hello,
I have a web application with the security framework on. It all works fine but I would like to ensure that only 1 (one) user can login using its user name and password.

At present more than one user can login using the same user name and password. Can anyone help?

I went through the A5 documentation but I could not find anything related to this.
Thanks in advanced.
Javier

[Clipper87]

Re: Unique user ID

What you are asking here is to limit a user to have only 1 session active per user.

What you could do upon login is save the user's ID in a table if it does not already exist.

It may be tricky though because users may simply close their browser & then you cannot execute some script to delete the entry in the table. You'd have to think on how you would cope with that.

[Steve Wood]

Re: Unique user ID

Is it a problem of people sharing their login accounts, so that more than the person originally authorized is getting in?

[Clipper87]

Re: Unique user ID

Steve,

I think you are right if I reread Javier's question. In that case 2-factor authentication would be a solution. If we'd have an easy way to integrate Google single sign on into the Alpha security system then that would be great.

[jcarrallo]

Re: Unique user ID

Thanks guys. Yes Steve, it is a problem of people sharing their logins accounts so that more than the person originally authorized is getting in
Javier

[RichCPT]

Re: Unique user ID

Would it be of any use to track the workstation's mac address and only allow login from a certain number addresses? However, getting at the mac address takes an active-x control or something external to Javascript. It can be difficult to retrieve:

http://stackoverflow.com/questions/3...-in-javascript

There is the variable, "request.Remote_Addr", which returns an ip address, but it is the same value for workstations behind a common firewall.

[Clipper87]

Re: Unique user ID

Rich,

That would bind the legitimate user to a particular PC. I think 2-factor is the only way to go; you could send them an email as the 2nd factor upon each login attempt with some code they have to enter to finally login.

[RichCPT]

Re: Unique user ID

Frank,
I was thinking of maintaining a list of approved mac addresses for a particular login ID. That way a user could use multiple computers. For each new mac address a confirmation/activation email would be sent out to the user for 2nd level/factor validation, like you suggested. Although, I don't think using a mac addresses is going to address the original question for the case where two users share the same computer. In that case, the app would probably need to be coded specific to the OS. Under Windows the app would have to get the Windows User ID. If running under a guest or generic OS user ID then there is not much one can do.

[Steve Wood]

Re: Unique user ID

My bank account does similar. If I login from a "previously unknown computer", it requires me to go through a few hoops to connect to my account. They use a 3rd party plug in that sends me an authorization code in a text message to my mobile. I have to enter that code to connect. I know it uses cookies rather than machine name to identify the computer because I routinely purge all of my cookies and it then asks me to re-confirm.

In your case a little legal language might help as well -- something like a $10,000 fine for knowingly sharing their login with someone else, and mention that you "keep track of such activity" and how you aggressively file suit against any violators. This would go in your Terms and Conditions. You can keep track of all logins right on the login.a5w page with something like this (SQL example):

<%a5
'saves login to LastLogin on User Mgmt
if eval_valid("submitbutton")
if eval_valid("userid")
dim cn as SQL::Connection
dim args as sql::arguments
cn.open("::name::conn")
vsql = "INSERT INTO web_stats (userid,lastlogin,ipaddress) VALUES (:userid,:lastlogin,:ipaddress)"
args.add("userid",userid)
args.add("lastlogin",now())
args.add("ipaddress",request.remote_addr)
cn.Execute(vsql,args)
cn.close()
end if
end if
%>

If you put this on the login.a5w dialog, the userid will contain their login username.

That code is from memory so might need some tweaking (but probably not) and error trapping (a little).