Hi,

I think there are several solutions depending on your actual
requirements. Can you explain more?

For example, what services are the users going to access after
authentication? You mean an application deployed on Tomcat?

And, what do you actually mean for cancelling the login request? What
is the purpose and target that you expect to meet?

Harry

On 4月30日, 上午5時50分, Jamie.Osbor...@googlemail.com wrote:

I am not sure how you store information about the already logged in user
etc. In one the web applications I worked earlier (wasn't J2EE), we had
a separate table which stored session information of all the logged-in
users (thing like, user id, session id, initial time and last activity
time etc). Then if user logs out, we used to delete that particular row
from this table.

Now to check whether the same user has logged-in already you can just
check against this session table.

The disadvantage of this method is that in case of orphaned
sessions(browser closed or user did not log out), user has to wait for
the last session to expire before logging back in. But I guess you can
implement number of different solutions for this.

I think the best way is to:
- use a SessionListener to keep track of who is logged in
- use a custom realm for login that rejects users already
  logged in

Will require a bit of coding.

Arne

have you ever gotten a response to this?
thanks.