I am implementing an application where there is a mechanic for each machine in the company using the application. I'm trying to implement a user policy whereby if user is in a role "Mechanic" -- with username Machine1, and is logged in for that machine, only one user can be logged at at the same time with the Machine1 username for the company. If someone else tries to login with the same username, it should be blocked and informed that there is already logged in user. When the session timeout expires i should log out the logged in user and free the login to be used. The same happens when the user logouts by himself. I'm trying to build this on asp.net MVC 4 application.
I've thought of using the SessionId, UserId and IsLoggedIn boolean in the database. But in this case i need to change the logged in flag on session timeout in the MVC app to write in the database, which seems overkill if many users are logged in.
What would the implementation be like? What methods or attributes should I be using to handle the session management in the database ?
FYI
I have made my own method where i check if the user is logged in, here it is:
public static bool ValidateUser(string username, string password, string companyName)
{
int? companyId = myRepository.GetCompanyId(companyName);
int? userId = companyId == 0 ? null : myRepository.GetUserId(username, companyId);
if (userId.HasValue && userId.Value != 0)
{
var userKey = Security.GenerateUserKey(username, companyName);
return WebSecurity.Login(userKey, password);
}
else
{
return false;
}
}
Here in this method i can check somehow if the session id is the same as in the database.