Disabling multiple logins

[kobelb]

Some users would like a way to disable multiple logins to Kibana as a security feature, and alert users when a login attempt occurs on another computer.

This feels like a feature that an IdM/IdP would implement, and not something that we should be adding to Kibana. We've generally pushed back on similar features being added to ES, so we might want to take a similar stance here.

I'm opening this issue to discuss further, and gauge interest in a feature like this. There are likely users taking advantage of the current behavior, so this isn't something that we'd likely want to opt-into by default.

[elasticmachine]

Pinging @elastic/kibana-security

[bpcvdhelm]

It would be great that all open kibana sessions get a message when a new session is started under the same userid. Another wish is to make this configurable with on/off.

[kobelb]

@bpcvdhelm are you all using the native realm to auth in ES/Kibana?

[bpcvdhelm]

@kobelb: We are using the ldap realm to authenticate users.

[gulnadaf]

Any updates on this thread?

[kobelb]

@gulnadaf no update at the moment, is it safe to assume that this is something that you too would like to take advantage of and you're using the native realm as well?

[kobelb]

Closing in favor of #18162