How to enforce one-and-only-one concurrent logon per user with Oracle SSO?

Question

OK, the auditors have come knocking and I know one of their standard "exposures" is if your application allows concurrent logons by the same user.

Let's put aside the quantification of that risk for a minute...

The application I'm working with uses Oracle SSO for managing authentication, and as far as I know, it does not have an out-of-the-box solution for this.

I'm looking for advice - either a way that the standard product can be made to support this requirement, or the most maintainable, unintrusive customisation to do the same.

Appreciate any thoughts on the matter...

Answer 1

Ignoring the SSO part, you would add the user to a profile that limits the number of active sessions.

ALTER PROFILE app_user LIMIT SESSIONS_PER_USER 1;

I don't know what SSO adds to this.

Answer 2

You can limit the user via a logon trigger. Have the trigger query the database for sessions belonging to the user. If the user is already login error and log the present session out.