Support global browser session limits for SSO

Currently, Enable exclusive signin is scoped to a single Casdoor application.

When a user signs in again through the same application, Casdoor invalidates existing sessions and OAuth tokens for that user in that application. Sessions and tokens created through other applications are not affected.

This behavior is appropriate when applications are expected to have independent session lifecycles. However, in some SSO deployments, this application-level isolation does not fully align with the centralized nature of SSO, where multiple applications rely on the same identity provider and shared authentication context. In such cases, session limits may need to be enforced for the user across applications rather than independently within each application.

For example, an organization may want to allow only one active session per user across all OAuth/OIDC applications. In other cases, it may be useful to allow a configurable number of concurrent sessions instead of enforcing a strict single-session policy.

Casdoor already supports user-wide session and token invalidation in flows such as logout from all sessions and user block, while Enable exclusive signin performs session and token invalidation only within the application involved in the login.

Expected behavior

It would be useful to support user-level session limits across OAuth/OIDC applications.

Instead of only having a boolean Enable exclusive signin option, Casdoor could allow configuring the maximum number of concurrent sessions for a user.

The policy could support different scopes:

• application-level, preserving the current behavior;
• cross-application user-level, where the limit applies across all OAuth/OIDC applications.

For example, setting the maximum number of concurrent sessions to 1 at the cross-application user level would provide semantics similar to the current exclusive sign-in behavior, but across the entire SSO environment rather than within a single application.

When the configured limit is exceeded, Casdoor could invalidate older active sessions as necessary to enforce the configured limit, together with the corresponding OAuth credentials.

This would make the mechanism more flexible than a simple exclusive sign-in flag while allowing the current behavior to remain the default.

Question

Is cross-application user-level session management something that is planned for Casdoor?

Would it make sense to generalize Enable exclusive signin into a configurable concurrent session limit, with support for both the current application-level scope and an optional cross-application user-level scope?