6

Has anyone fielded a request to prevent a username from logging into multiple sessions at once?

The problem is that currently Salesforce does not have declarative way of preventing logins, of the same username, from multiple sessions. The idea of checking a username out and back in when it is in an active session would help curve, but not eliminate, folks sharing usernames and passwords.

Has anyone discovered a workaround?

Improve this question
3
  • 1
    Can you delegate this problem to a single-sign-on authentication provider?
    – Born2BeMild
    Commented Oct 30, 2012 at 17:15
  • Good question - I can only speculate that some implementation of SSO could solve this. But I hope the ultimate solution for my customers is not simply to recommend they implement SSO for the use of a single application.
    – Justin J Carlson
    Commented Oct 30, 2012 at 17:26
  • Not sure about mobile, but multiple browser sessions could be curbed by having a custom landing page (with no header or sidebar), which redirects to the application only if there isnt another recent login history for the user from a different ip(check using select id, userid, LoginTime, SourceIp from loginhistory). Else redirects to display permission denied landing page
    – techtrekker
    Commented Oct 30, 2012 at 23:14

2 Answers 2

Reset to default
1

I'm not aware of a proactive way of doing this. However you could build a report over the login history object and look for multiple concurrent sessions from different IP Addresses.

However if you have users that access Salesforce via the API or using the mobile apps then there may well be valid reasons why they appear to have multiple concurrent sessions. The source of the login should be indicated in the report to help identify these scenarios.

You could use the 'Users Logged in This Week' standard administrative report as a starting point

Improve this answer
3
  • The issue is not really logging in from multiple IP addresses - it is more about being logged in concurrently. e.g. I am logged into my mobile device therefore I cannot be logged into my desktop or visa-versa.
    – Justin J Carlson
    Commented Oct 30, 2012 at 16:37
  • Assuming that the mobile device and desktop access the internet via a separate network and therefore present a different IP address this would distinguish between them. If they both accessed via the same IP then you could distinguish it using the Client Type field on the login history.
    – Born2BeMild
    Commented Oct 30, 2012 at 16:40
  • Yeah this would be an acceptable measure for an audit, but as you said, not proactive. This may not fly for IT security teams in highly regulated industries. Thanks
    – Justin J Carlson
    Commented Oct 30, 2012 at 16:45
0

A sample Implementation using Login Flow is provided in Salesforce Security Guide. It is also available as an unmanaged package which can be installed directly and configured.The solution essentially retrieves the number of concurrent sessions for a user. If the login attempt exceeds the concurrent session limit, the flow blocks it.

Link for the implementation - https://developer.salesforce.com/docs/atlas.en-us.232.0.securityImplGuide.meta/securityImplGuide/security_login_flow_limit_concurrent_sessions.htm

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .