Starts in:
1 DAY
16 HRS
36 MIN
35 SEC
Starts in:
1 D
16 H
36 M
35 S

Add sessions management feature. #17056

We can start implementing the blazor and angular UI if the MVC UI if no problem.


  1. The IdentitySessionClaimsPrincipalContributor will generate a random GUID as a sessionid to add the ClaimsPrincipal, This usually happens when logging in to get the user's claims.
  2. The OnSignedIn event of Identity and ProcessSignIn event of openiddict will get this sessionid and store it in the database(IdentitySession table)
  3. The dynamic claims system's IdentitySessionDynamicClaimsPrincipalContributor will ensure the sessionid exists or sign out.
  4. The IdentitySessionChecker will check the sessionid that exists and update the LastAccessed and IpAddress to the cache.
  5. The IdentitySessionManager is used to get one or a list of sessions and update the LastAccessed and IpAddress from the cache to the database.
  6. We will remove the session when logging out.
  7. The IdentitySessionCleanupBackgroundWorker will remove the inactive sessions.
  8. Once a new session has been created, we will remove the other sessions based on the PreventConcurrentLogin setting:
public enum IdentityProPreventConcurrentLoginBehaviour
{
    Disabled = 0, // We will not remove other sessions
    LogoutFromSameTypeDevices = 1, // We will remove all same Device's sessions.
    LogoutFromAllDevices = 2 // Only one session can exist
}

The device type


Web: web applications based on cookies(identity) authentication,
Oauth: Web applications using OIDC authentication. Tiered app.
Mobile: Developers can customize the mapping of `Client_Id` to `Mobile` or any other type of application. See `ClientIdToDeviceMap` of `AbpAccountOpenIddictOptions`.

Resolve #12952
https://github.com/abpframework/abp/pull/18242

Setting:
image

Account:
image

Identity:

image