Metadata-Version: 2.0
Name: Products.NoDuplicateLogin
Version: 2.0
Summary: Products.NoDuplicateLogin
Home-page: http://svn.plone.org/svn/collective/PASPlugins/Products.NoDuplicateLogin
Author: Daniel Nouri
Author-email: daniel.nouri@gmail.com
License: UNKNOWN
Platform: UNKNOWN
Requires-Dist: setuptools
Requires-Dist: collective.autopermission
Provides-Extra: tests
Requires-Dist: plone.app.testing; extra == 'tests'

Introduction
============

This PAS plugin will reject multiple logins with the same user at the same
time. It ensures that only one browser may be logged with the same userid at
one time.

Implementation
--------------

The implementation works like this: Suppose that Anna and Karl are two people
who share a login annaandkarl in our site. Anna logs in, authenticating for
the first time. We generate a cookie with a unique id for Anna and remember
the id ourselves. For every subsequent authentication (i.e. for every
request), we will make sure that Anna's browser has the cookie.

Now Karl decides to log in into the site with the same login annaandkarl, the
one that Anna uses to surf the site right now. The plugin sees that Karl's
browser doesn't have our cookie yet, so it generates one with a unique id for
Karl's browser, remembers it and forgets about Anna's cookie.

What happens when Anna clicks on a link on the site? The plugin sees that Anna
has our cookie but that it differs from the cookie value that it remembered
(Karl's browser has that cookie value). Anna is logged out but the plugin and
sees the message "Someone else logged in under your name".

Usage
-----

This product, when active, will automatically prevent users from staying logged
in if they attempt to open a second session. This works well for all
authentication schemes that have a concept of ``credential reset``, but for
users logged in with Basic Auth this will not work as expected, and both
sessions will interfere with eachother without one being permanently ended.
This is a limitation of the Basic Auth technology, so we recommend not using
this plugin in combination with Basic Auth sites.

This plugin also provides a ``revoke_session`` view on itself, which can be
accessed by visiting
``http://www.example.com/acl_users/no_duplicate_login/revoke_session``, which
can be used by site administrators to manually invoke the forced logout
mechanism.

Installation
------------

Add ``Products.NoDuplicateLogin`` to the eggs parameter of your ``plone.recipe.zope2instance``
section::

    [plone]
    recipe = plone.recipe.zope2instance
    eggs =
        Plone
        ...
        Products.NoDuplicateLogin

Now run buildout and restart Plone. Once Plone has started, login and browse to
``Site Setup -> Zope Management Interface -> acl_users`` and add a ``No
Duplicate Login Plugin`` from the drop down menu in the upper right.

After that, click on the ``No Duplicate Login Plugin`` object in the acl_users
folder listing. For each of the ``Authentication``, ``Credential Update`` and
``Reset Credentials`` objects in the ``No Duplicate Login Plugin`` folder
listing, click, then move the ``no_duplicate_login`` plugin from the
``Available Plugins`` display widget on the left to the ``Active Plugins``
display widget on the right using the arrow buttons in the middle.

It you will also need to "arrow up" the ``no_duplicate_login`` plugin in the
``Active Plugins`` display listing for both ``Authentication`` and ``Reset
Credentials``.

If you are using a policy product to install this as part of your deployment
you can perform these actions by including an empty ``noduplicatelogin.xml``
file in your profile directory.


History
-------

2.0 (2014-11-25)
~~~~~~~~~~~~~~~~~~

* Security and performance improvements [matthewwilkes]
* Remove reimplementation of plone.session [matthewwilkes]
* Change internal data structures to avoid unnecessary object stores [matthewwilkes]
* Add tests to test harness [matthewwilkes]
* Fix pure Zope compatibility [matthewwilkes]

1.0a2 (02/18/2011)
~~~~~~~~~~~~~~~~~~

* Add more installation instructions

1.0a1 (12/17/2010)
~~~~~~~~~~~~~~~~~~

* Add test harness [aclark]
* Rip out "experimental" session storage, too many ZODB conflicts. [aclark]
* Plone 4 compat [aclark]
* Re-package as egg [aclark]

1.0 svn/dev
~~~~~~~~~~~

* Plone 3 compat [perrito]
* Original implementation [nouri]


