EPrints Technical Mailing List Archive

See the EPrints wiki for instructions on how to join this mailing list and related information.

Message: #10417

< Previous (by date) | Next (by date) > | < Previous (in thread) | Next (in thread) > | Messages - Most Recent First | Threads - Most Recent First

Re: [EP-tech] Forcing users to logout / closing active sessions

Hi Robin,

The quick and slightly dirty way to log out all users is to empty out the loginticket database table.  Any browser cookies shouldn't have any implications here.

While at the same time blocking any new logins, by returning early from your login routine.

$c->{check_user_password} = sub { return 0 }


The new repository sounds great, I look forward to admiring it. :). Please share it when it’s ready.

      Justin

-- 
Professor Justin Bradley
Director, EPrints Services – digital repository solutions
Enterprise Software Services – hosted, supported, reliable
School of Electronics and Computer Science
University of Southampton
justin@soton.ac.uk / B32 1023


From: eprints-tech-request@ecs.soton.ac.uk <eprints-tech-request@ecs.soton.ac.uk> on behalf of Robin Sylvestre <robin.sylvestre@polymtl.ca>
Date: Friday, 28 August 2026 at 20:55
To: eprints-tech@ecs.soton.ac.uk <eprints-tech@ecs.soton.ac.uk>
Subject: [EP-tech] Forcing users to logout / closing active sessions

CAUTION: This e-mail originated outside the University of Southampton.
CAUTION: This e-mail originated outside the University of Southampton.

Hi!

 

Running a 3.4.1 repository that will soon be upgraded to 3.4.7.

Since generating views, abstracts, reindexing, etc. after importing the database on the new server will likely take well over 24 hours (possibly 48 hours), we would like to minimise the impact on users by keeping the old server online and available for browsing, while preventing any further changes to the database.

 

Ideally, users would still be able to browse the repository, but would be unable to log in, and any existing authenticated sessions would be terminated so that no new deposits, edits, or workflow actions can occur while the migration is in progress. This would allow the new server to ingest and process the archive over the weekend without the risk of changes being made on the source system.

In EPrints 3.4.1, what is the supported way to invalidate all active sessions and force all users to re-authenticate? Does removing the session store invalidate both active and persistent cookie-based sessions, or is there another session/cache mechanism that also needs to be cleared?

I've read that EPrints 3.4.7 includes functionality to forcibly log out all users, but that functionality does not appear to exist in 3.4.1. Has anyone tried backporting or using that mechanism on an older 3.4.1 installation?

 

Our repository uses LDAP authentication through the standard EPrints authentication hooks and Apache::Session. I'm therefore particularly interested in understanding whether clearing session data alone is sufficient to force all users out, including those authenticated via persistent cookies.

 

Thank you for your input!

 

I'm looking forward to showing you our new version. I've put a lot of work into it, and I'm quite proud of the result! I humbly believe it will be the most beautiful EPrints repository in the world! 😄 Going live in October! 🎉 🤩

 

Robin

 

 

ROBIN SYLVESTRE

Technicien des systèmes informatisés

Bibliothèque
514-340-4711 | poste 5973

 

Polytechnique Montréal

2500, chemin de Polytechnique

Montréal, Québec, H3T 1J4