Determine logged-in status of users

Question

We are trying to determine logged-in status of our users as part of an automated lead-routing process (we only want to route to logged-in users), but we are seeing some inconsistencies.

We currently have a scheduled apex job running every 15 minutes executing this query: SELECT Id, UsersId FROM AuthSession WHERE SessionType = 'UI'

If a record exists we are assuming that the user is logged in.

However, it seems that some -but not all- AuthSession entries are never deleted, even when the user is no longer logged in, causing them to appear logged-in according to our process.

What could be causing this?

Could it be because some users are actively logging out using the logout button while others aren't? (In order to try and remedy this, we have now turned on the 'Force logout on session timeout' in the Session Settings).

We were wondering if we could use the isCurrent field on the AuthSession object, but it is false for all users at all times.

FYI, we are using SSO.

Answer 1

isCurrent flag on AuthSession will only be true for only 1 entry amongst all . It will be your own user's who ran the querry.

If there is an entry in AuthSession then it means user is logged in. A user can be logged in via API, phone etc. But you only want to target user who are logged in via browser. Thus your querry will be.

SELECT CreatedDate,Id,IsCurrent,LastModifiedDate,LoginGeoId,LoginHistoryId,LoginType,LogoutUrl,NumSecondsValid,ParentId,SessionSecurityLevel,SessionType,SourceIp,UsersId,UserType FROM AuthSession where LoginType = 'Application' and  SessionType = 'UI' order by IsCurrent desc

One user can have multiple AuthSession entries as they can log in in different browser at same time.

Src: https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_authsession.htm

Answer 2

I was thinking about this the whole night, This problem seemed genuine and should have a solution in Salesforce.

While researching I stumbled upon Create Logout Event Triggers (Beta). which allows you to capture when user has clicked logged out. It also works when "Force logout on session timeout" is enabled. The Only limitation is you should keep the browser open at all time.

You can write trigger on LogoutEventStream which captures logout event, Capture that event and make isCurrent field on your user as false.

trigger LogoutEventTrigger on LogoutEventStream (after insert) { 
  LogoutEventStream event = Trigger.new[0];
  update new User(Id=event.UserId,isCurrent__c=false);
}

//

You can create Login Flows that allows you to update isCurrent__c field on User when he logs in. Login flow works even with SSO. https://developer.salesforce.com/docs/atlas.en-us.securityImplGuide.meta/securityImplGuide/security_login_flow_examples.htm

This probably not the worlds most beautiful way to so, But I feel its only one SF provides and we can use.

Answer 3

I realize I'm late to the party here, but I thought I'd post for anyone still struggling with this as I was recently in that category. I learned from SF developer support that AuthSession is not intended to capture logout info per se, so the data can be misleading when a user has logged out.

What you need to do is use the LogoutEventStream object to capture this data in a custom object (as the standard object can't be queried), which can then be measured against AuthSession info to ultimately determine if a user is logged in.

Details can be found here: https://www.sfdcpanther.com/how-to-capture-salesforce-user-logout-activity-logouteventstream/

See also:

https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_logouteventstream.htm

https://help.salesforce.com/articleView?id=security_auth_create_logout_event_trigger.htm&type=5