Auth: Session Concurrency & Lifecycle Control

Overview#

Session Concurrency and Lifecycle Control governs every session on the platform from creation to revocation, applying configurable per-user and per-role policies so that shared credentials, stolen tokens, and abandoned sessions cannot quietly persist as attack surfaces.

When a field operator logs in from a new device while an existing session is still active, the platform decides immediately whether to permit the second session, challenge the user, or terminate the oldest session. Every session carries a device fingerprint and an origin record, enabling administrators to audit exactly which devices were active during any incident window.

Beyond concurrent-login enforcement, the capability governs the full lifetime of a session: idle timeouts that expire inactive sessions after a configurable period of inactivity, absolute timeouts that terminate long-lived sessions regardless of activity, and global revocation that allows an administrator or an automated fraud signal to invalidate every session belonging to a user or an entire organisation simultaneously. Live session state is held in a fast central session store so that revocation takes effect across all serving nodes as soon as it is issued, and a durable record store keeps the authoritative audit trail of every session event.

Key Features#

Concurrent session limits: Administrators configure the maximum number of simultaneous active sessions permitted per user or per role, with policy options to reject the new login, evict the oldest session, or challenge the user with a step-up verification.
Real-time session invalidation: Revocation commands take effect in the central session store as soon as they are issued, ensuring that a compromised or shared token cannot be reused after an administrator or automated rule triggers revocation.
Idle and absolute timeouts: Sessions that remain inactive beyond a configurable idle period are expired automatically; a separate absolute timeout ensures no session can remain valid indefinitely regardless of activity, supporting compliance with access-window requirements.
Device-specific session tracking: Each session is bound to a device fingerprint derived from browser and network characteristics, allowing administrators to identify and terminate sessions originating from unrecognised or anomalous devices without affecting other active sessions.
Global revocation: A single administrative action can terminate all sessions for a user, a group, or an entire organisation, supporting rapid response to credential compromise or insider-threat incidents.
Anomaly-triggered termination: Integration with fraud detection signals allows sessions exhibiting behavioural anomalies such as impossible-travel logins or sudden privilege escalation patterns to be suspended automatically pending re-authentication.
Full session audit trail: Every session lifecycle event, creation, renewal, idle expiry, absolute expiry, and revocation, is written to a tamper-evident audit log with user identity, device fingerprint, timestamp, and the reason for termination.
Organisation-scoped policies: Concurrency and timeout rules are configured independently per organisation and per role, allowing a single deployment to enforce stricter controls for high-privilege operators without affecting standard user workflows.
Step-up recency anchored to genuine login time: Sensitive operations that require a recent login measure recency from the user's actual last authentication, which is stamped at login and carried unchanged across every credential renewal, so a long-stale session can no longer pass a recent-authentication check simply by refreshing; legacy sessions without a stamp fall back safely to their creation time.
Renewal headroom without weakened idle limits: Session credentials carry an extended validity window that gives the silent renewal loop roughly four times its previous headroom, eliminating mid-work sign-outs caused by slow background refreshes; classification-based idle caps are preserved and continue to slide forward with activity, and replay exposure remains bounded by immediate revocation lists and a per-request session liveness check.

Use Cases#

Preventing credential sharing: Enforcing a per-user session limit makes it immediately apparent when a single account is being used from multiple locations simultaneously, deterring password sharing and flagging potential compromise.
Enforcing strict operational access windows: Absolute session timeouts ensure that personnel access is automatically revoked at the end of a shift or exercise period without requiring manual administrator intervention.
Rapid response to account compromise: When a credential-theft incident is detected, global revocation terminates all active sessions for the affected user instantly, limiting the window of unauthorised access to seconds rather than hours.
Regulatory audit readiness: The complete session audit trail provides the evidence base required for access-review audits, demonstrating that dormant and shared sessions were controlled in accordance with policy.
Zero-trust device posture enforcement: Binding sessions to device fingerprints means that a valid token extracted from one device cannot be replayed from a different device, supporting zero-trust access principles without requiring client-side agent software.
Assured re-authentication before high-risk actions: Because the step-up clock is anchored to real login time rather than the latest renewal, operations such as key management, policy changes, and data export reliably demand fresh re-authentication exactly when policy says they should, meeting assurance requirements for re-authentication before sensitive operations.
Uninterrupted long investigation sessions: Analysts working extended sessions, including on slow or intermittent networks, no longer lose in-progress work to surprise logouts caused by tight renewal timing, and this is achieved without relaxing classification-based idle limits.

Integration#

Session Concurrency and Lifecycle Control integrates with the platform's central session store so that revocation propagates to all serving nodes as soon as it is issued, with a durable record store for the authoritative audit record, and with the platform's fraud and anomaly detection pipeline so that behavioural risk signals can trigger automatic session termination. The capability sits behind the platform's zero-trust adaptive access gateway, meaning every session validation occurs after access-policy checks have passed, and it publishes revocation events to the platform's real-time event bus so that connected services such as active WebSocket channels and API gateway authorisation caches are invalidated consistently.

Open Standards#

RFC 6749 and RFC 6750 (OAuth 2.0): Session tokens are issued and validated in accordance with the OAuth 2.0 authorisation framework, with bearer-token handling following RFC 6750 security guidance.
OpenID Connect Core 1.0: Federated sign-in follows OpenID Connect semantics, and sessions established through a federated identity provider are governed by the same concurrency, timeout, and revocation controls as directly authenticated sessions.
RFC 7519 (JSON Web Token): Signed session tokens use the JWT format, enabling stateless validation at edge nodes while the central session store provides the authoritative revocation check.
NIST SP 800-63B (Digital Identity Guidelines): Idle and absolute timeout thresholds, re-authentication triggers, and session binding are designed to align with the session management requirements of NIST authenticator assurance levels AAL2 and AAL3.
ISO/IEC 27001 (Information Security Management): Session lifecycle controls support ISO/IEC 27001 Annex A requirements relating to access control, secure authentication, and audit logging.
eIDAS Regulation (EU 910/2014): Session assurance levels and audit evidence align with eIDAS requirements for electronic identification and trust services used in European public-sector deployments.
OASIS Security Assertion Markup Language (SAML) 2.0: Sessions established through SAML 2.0 single sign-on are subject to the same concurrency, timeout, and revocation controls, with assertion validation hardened against signature-wrapping and replay.

Last Reviewed: 2026-07-16 Last Updated: 2026-07-16