Limit the number of concurrent user sessions

[elasticmachine]

Problem statement: Allow admins to define a maximum number of concurrent sessions per Kibana user. This builds on top of previous work, that introduced server side sessions .

Detailed approach: [This document|https://docs.google.com/document/d/1TpgCdz-S687s2XjTyTuJDx7Ig-rju_nnXfiefyt3dok/edit?usp=sharing], For [the MVP|https://docs.google.com/document/d/1TpgCdz-S687s2XjTyTuJDx7Ig-rju_nnXfiefyt3dok/edit#bookmark=id.ditlr5w78trc] see final section.

Justification: Example customer Enhancement Requests:

• [14109|https://github.com/elastic/enhancements/issues/14109]
• [13049|https://github.com/elastic/enhancements/issues/13049]
• [12108|https://github.com/elastic/enhancements/issues/12108]
• [8393|https://github.com/elastic/enhancements/issues/8393]
• [3676|https://github.com/elastic/enhancements/issues/3676]
• [997|https://github.com/elastic/enhancements/issues/997] etc..

In addition NIST compliance ([800-53 AC-10|https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/control?version=5.1&number=AC-10])

Release: The MVP is aimed for 8.7

[gayleb]

General info: Restricting the number of concurrent sessions is a technical control mechanism to enforce that certain accounts/access cannot be shared between multiple or too many users.

[jportner]

This appears to be blocked by #17870, Kibana will need to store session info to be able to limit concurrent sessions.

[jordansissel]

given user by role

Is this intended to limit concurrent sessions by role as in Elasticsearch security role (and not a user)? This doesn't map in my head about the stated objective to limit sharing "accounts" (elasticsearch users?).

[gayleb]

@jordansissel - maybe this is helpful?
The information system limits the number of concurrent sessions for each [account and/or account type] to [number].
Supplemental Guidance: Organizations may define the maximum number of concurrent sessions for information system accounts globally, by account type (e.g., privileged user, non-privileged user, domain, specific application), by account, or a combination. For example, organizations may limit the number of concurrent sessions for system administrators or individuals working in particularly sensitive domains or mission-critical applications. This control addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts.

[arisonl]

@gayleb Am I interpreting it correctly:
Ability to configure the maximum number of:

1. overall concurrent sessions
2. sessions per user
3. sessions per role

And three more questions:

• Is there a timeframe for this feature we should aim for?
• How much of a prio is this and can we approach it in phases, e.g. per user limit first?
• Are there any known differences in the requirements for the mobile vs full/desktop?

cc @mbarretta @derickson @m-adams @skearns64 @agup006

[Michael-Angel-Sec]

+1 Interested in this feature.

These control options are needed to implement DoD Application Server SRG V2R7 V-35070 Requirements. Excerpt:

Check Text: Review the application server product documentation and configuration to determine if the number of concurrent sessions can be limited to the organization-defined number of sessions for all accounts and/or account types.

If a feature to limit the number of concurrent sessions is not available, is not set, or is set to unlimited, this is a finding.