Centralized Session Control for Distributed Enterprise Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In large distributed enterprise computing environments, de-provisioning user accounts to terminate access to applications is inefficient due to the lack of centralized control, leaving active sessions unaffected by de-provisioning operations, which poses security risks, especially during sensitive employee terminations.
Innovation Solution
A centralized data processing system that receives requests to control application sessions across multiple application servers, identifying affected instances and transmitting control requests to session control clients to manage and monitor user access, enabling real-time termination and modification of sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If de-provisioning user accounts is performed in a distributed computing environment without centralized control, then user access to applications can be revoked, but active application sessions remain unaffected and continue to grant access
Solution Approach 1:
A session control client is introduced as an intermediary component deployed on each application server. This client receives de-provisioning requests from the distributed system and automatically terminates associated application sessions, acting as a mediator between the user account management system and the application session infrastructure.
Solution Approach 2:
The session control functionality is segmented and distributed across multiple application servers through deployment of session control clients on each server. This allows localized session termination capabilities while maintaining overall system-wide session management consistency.
2Extent of automation
If de-provisioning operations are propagated across all portions of the distributed computing environment, then centralized session control can be achieved, but system complexity and propagation time increase
Solution Approach 1:
Session control clients are pre-deployed and configured on all application servers before de-provisioning operations are needed. This preliminary setup ensures that when de-provisioning requests occur, the infrastructure is already in place to immediately terminate sessions without requiring time-consuming propagation or configuration steps.
Solution Approach 2:
Each session control client operates autonomously on its respective application server, independently receiving and processing de-provisioning requests. This self-service architecture allows parallel processing of session terminations across multiple servers simultaneously, reducing overall propagation time compared to sequential centralized control.
Data Source
AI summary
Mechanisms are provided for performing centralized control of application sessions across a distributed computing environment comprising a plurality of application servers. A request to perform an application session control operation to control the application sessions associated with a specified user account identifier across the plurality of application servers in the distributed computing environment is received. A plurality of application instances upon which to perform the requested application session control operation are identified. An application session control request is transmitted to a plurality of session control clients associated with the application instances on the plurality of application servers of the distributed computing environment. The application session control request causes each session control client to control a user's ability to use the application sessions of application instances, associated with the session control client, that are associated with the specified user account identifier, to access the associated application instances.