Method of session quota constraint enforcement

1. A method to limit active sessions connecting user access to a computer network, comprising method operations of:

authenticating a request to initiate a new user session in the computer network, the authenticating operatively conducted within a single sign-on (SSO) provider;

determining a session quota through a session quota logic of the SSO provider, the session quota logic retrieving a stored session quota, wherein the stored session quota depends at least in part on a quota hierarchy whose data structure is a binary tree with nodes that include data for one or more personal attributes selected from the group of personal attributes consisting of identity and job title;

comparing a number of active sessions with the determined session quota; and

enforcing the determined session quota through a session quota enforcement logic of the SSO provider, wherein each operation of the method is executed by a microprocessor.

2. The method of claim 1 , wherein a session quota enforcement rule configures the session quota enforcement logic to scan and terminate active sessions according to the session quota enforcement rule.

3. The method of claim 1 , wherein the session quota logic is configurable to assign a priority for a plurality of session quotas, the priority enabling the session quota to be determined from the plurality of session quotas.

4. The method of claim 1 , wherein the session quota enforcement logic accesses a session table stored within the SSO provider which maintains session information.

5. The method of claim 2 , wherein the session quota enforcement rule configures the session quota enforcement logic to reject requests to initiate new user sessions until the number of active sessions is lower than the determined session quota.

6. The method of claim 2 , wherein the session quota enforcement rule configures the session quota enforcement logic to determine and terminate an oldest session.

7. The method of claim 2 , wherein the session quota enforcement rule configures the session quota enforcement logic to determine and terminate a session having a greatest amount of idle time.

8. A method to limit active sessions connecting user access to a computer network, comprising method operations of:

authenticating a request to initiate a new user session in the computer network, the authenticating operatively conducted within a single sign-on (SSO) provider, the SSO provider operatively accessed through a load balancer;

determining a session quota through a session quota logic of the SSO provider, the session quota logic retrieving a stored session quota, wherein the stored session quota depends at least in part on a quota hierarchy whose data structure is a binary tree with nodes that include data for one or more personal attributes selected from the group of personal attributes consisting of identity and job title;

comparing a number of active sessions with the determined session quota; and

enforcing the determined session quota through a session quota enforcement logic of the SSO provider, session quota enforcement logic accessing both an internal session table of the SSO provider and session tables contained in a plurality of SSO providers cooperatively operating within the computer network, wherein each operation of the method is executed by a microprocessor.

9. The method of claim 8 , wherein a session quota enforcement rule configures the session quota enforcement logic to scan and terminate active sessions according to the session quota enforcement rule.

10. The method of claim 8 , wherein the session quota logic is configurable to assign a priority for a plurality of session quotas, the priority enabling the session quota to be determined from the plurality of session quotas.

11. The method of claim 9 , wherein the session quota enforcement rule configures the session quota enforcement logic to reject requests to initiate new user sessions until the number of active sessions is lower than the determined session quota.

12. The method of claim 9 , wherein the session quota enforcement rule configures the session quota enforcement logic to determine and terminate an oldest session.

13. The method of claim 9 , wherein the session quota enforcement rule configures the session quota enforcement logic to determine and terminate a session having a greatest amount of idle time.

14. A method to limit active sessions connecting a user access to a computer network, comprising method operations of:

authenticating a request to initiate a new user session in the computer network, the authenticating operatively conducted within a single sign-on (SSO) provider, the SSO provider operatively accessed through a load balancer;

determining a session quota through a session quota logic of the SSO provider, the session quota logic retrieving a stored session quota, wherein the stored session quota depends at least in part on a quota hierarchy whose data structure is a binary tree with nodes that include data for one or more personal attributes selected from the group of personal attributes consisting of identity and job title;

comparing a number of active sessions with the determined session quota; and

enforcing the determined session quota through a session quota enforcement logic of the SSO provider, the session quota enforcement logic accessing a shared session repository, the shared session repository maintaining session information for a plurality of SSO providers cooperatively operating within the computer network, wherein each operation of the method is executed by a microprocessor.

15. The method of claim 14 , wherein the SSO provider is one of the plurality of SSO providers and the plurality of SSO providers are capable of compensating for a failure of one or more of the plurality of SSO providers.

16. The method of claim 14 , wherein a session quota enforcement rule configures the session quota enforcement logic to scan and terminate active sessions according to the session quota enforcement rule.

17. The method of claim 14 , wherein the session quota logic is configurable to assign a priority for a plurality of session quotas, the priority enabling the session quota to be determined from the plurality of session quotas.

18. The method of claim 16 , wherein the session quota enforcement rule configures the session quota enforcement logic to reject requests to initiate new user sessions until the number of active sessions is lower than the determined session quota.

19. The method of claim 16 , wherein the session quota enforcement rule configures the session quota enforcement logic to determine and terminate an oldest session.

20. The method of claim 16 , wherein the session quota enforcement rule configures the session quota enforcement logic to determine and terminate a session having a greatest amount of idle time.