How do I tell if a user account is already logged in using ASP.Net Forms Authentication?

Question

Our SSO login process uses Forms Authentication against a custom user store in SQL Server.

One of our new security requirements is to only allow an account to have one active session at a time. So any time a user logs in, we will check to see if the login credentials are already active, and preferably prevent the new user from logging in again until the other session ends. Alternatively we could force the other session to end, if that would be easier to implement.

Is there a simple way to do this with Forms Authentication? We've considered a custom approach where we track each session in the database, but it would be a lot of work and we'd probably have to modify all of our applications to detect the session_end, which I'm hoping to avoid. I figure there has to be something in Forms Auth that handles this.

I've seen the MembershipUser.IsOnline() method, which seems ideal, but we're not using a Membership provider.

UPDATE: Just to be clear, I do not need to check whether the current user is logged in, I need to know if somebody else is already logged in using the same account.

Answer 1

If the HttpContext.Current.User property is not null then they are logged in. And Identity.IsAuthenticated is true.

Answer 2

Try this:

System.Web.HttpContext.Current.User.Identity.IsAuthenticated

Answer 3

If I understood you correct, you would need to store the last activity state based on the user id.
Membership.IsOnline() is implemented by checking the LastActivityDate property persisted in the membership database.
So somewhere, you would need to track user activity.
You could maybe implement a httpmodule that updates a timestamp for user activity.