3

We are trying to determine logged-in status of our users as part of an automated lead-routing process (we only want to route to logged-in users), but we are seeing some inconsistencies.

We currently have a scheduled apex job running every 15 minutes executing this query: SELECT Id, UsersId FROM AuthSession WHERE SessionType = 'UI'

If a record exists we are assuming that the user is logged in.

However, it seems that some -but not all- AuthSession entries are never deleted, even when the user is no longer logged in, causing them to appear logged-in according to our process.

What could be causing this?

Could it be because some users are actively logging out using the logout button while others aren't? (In order to try and remedy this, we have now turned on the 'Force logout on session timeout' in the Session Settings).

We were wondering if we could use the isCurrent field on the AuthSession object, but it is false for all users at all times.

FYI, we are using SSO.

1

isCurrent flag on AuthSession will only be true for only 1 entry amongst all . It will be your own user's who ran the querry.

If there is an entry in AuthSession then it means user is logged in. A user can be logged in via API, phone etc. But you only want to target user who are logged in via browser. Thus your querry will be.

SELECT CreatedDate,Id,IsCurrent,LastModifiedDate,LoginGeoId,LoginHistoryId,LoginType,LogoutUrl,NumSecondsValid,ParentId,SessionSecurityLevel,SessionType,SourceIp,UsersId,UserType FROM AuthSession where LoginType = 'Application' and  SessionType = 'UI' order by IsCurrent desc

One user can have multiple AuthSession entries as they can log in in different browser at same time.

Src: https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_authsession.htm

  • Thanks for the response. I was assuming that if there is an entry in the AuthSession it means the user is logged in. That's exactly the problem, though. There are entries for users we know are not logged in. Also, since we are using SSO, LoginType is always 'SAML Sfdc Initiated SSO' and not 'Application'. – Jesper Bjerrum May 4 '18 at 16:54
  • Who are not logged in and dont have session timed out? – Pranay Jaiswal May 4 '18 at 17:11
  • Who last logged in 4 days ago. We have session timeout after 1 hour. – Jesper Bjerrum May 4 '18 at 17:14
0

I was thinking about this the whole night, This problem seemed genuine and should have a solution in Salesforce.

While researching I stumbled upon Create Logout Event Triggers (Beta). which allows you to capture when user has clicked logged out. It also works when "Force logout on session timeout" is enabled. The Only limitation is you should keep the browser open at all time.

You can write trigger on LogoutEventStream which captures logout event, Capture that event and make isCurrent field on your user as false.

trigger LogoutEventTrigger on LogoutEventStream (after insert) { 
  LogoutEventStream event = Trigger.new[0];
  update new User(Id=event.UserId,isCurrent__c=false);
}

//

You can create Login Flows that allows you to update isCurrent__c field on User when he logs in. Login flow works even with SSO. https://developer.salesforce.com/docs/atlas.en-us.securityImplGuide.meta/securityImplGuide/security_login_flow_examples.htm

This probably not the worlds most beautiful way to so, But I feel its only one SF provides and we can use.

  • Thanks for the LogoutEventStream suggestion. That's pretty cool. However, I suspect at least some of our users do close their browser windows rather than logging out, so was hoping for something a little more reliable. Would there be any serious problems with running a job during the night and simply deleting AuthSession entries? – Jesper Bjerrum May 8 '18 at 14:11
  • I have never tried deleting AuthSession entries, but if you can, it looks like an elegant solution. – Pranay Jaiswal May 8 '18 at 14:14
0

I realize I'm late to the party here, but I thought I'd post for anyone still struggling with this as I was recently in that category. I learned from SF developer support that AuthSession is not intended to capture logout info per se, so the data can be misleading when a user has logged out.

What you need to do is use the LogoutEventStream object to capture this data in a custom object (as the standard object can't be queried), which can then be measured against AuthSession info to ultimately determine if a user is logged in.

Details can be found here: https://www.sfdcpanther.com/how-to-capture-salesforce-user-logout-activity-logouteventstream/

See also:

https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_logouteventstream.htm

https://help.salesforce.com/articleView?id=security_auth_create_logout_event_trigger.htm&type=5

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.