User Session Security Controls

A guide for printIQ users

What is this feature?

User Session Security Controls give your administrators two tools to better protect your printIQ environment. The first automatically logs out any user whose account is disabled, locked, or deactivated. The second is an optional setting that limits each user to one active login at a time, preventing credential sharing across devices.

Why would I use it?

• Disabled accounts are blocked immediately – there's no window where a deactivated user can keep working through an existing browser session.
• Credential sharing between staff is prevented when single-machine login is turned on.
• Users get a clear, plain-language message explaining why they were logged out so they know who to contact.
• Performance stays fast – validation runs with a 60-second server cache so page load times aren't affected.
• Administrators stay in control – the single-machine login setting can be turned on or off at any time without a system restart.

When does this apply?

Session validation runs on every page request. For performance, the result is cached for 60 seconds, so changes take effect within that window. The single-machine login check only applies when the feature is enabled via the admin settings panel.

Which users are affected?

The checks apply to standard printIQ users. The following are exempt:

• printIQ Staff Members – exempt from both the disabled-account check and the single-machine login check, so support access is never disrupted.
• printIQ System Processes – exempt from disabled-account validation.

How are sessions handled?

When a user logs in, the system generates a unique, cryptographically secure session token and stores it in the database. On every subsequent request, that token is checked:

• If the token matches, the session continues normally.
• If the token doesn't match (because the user has logged in elsewhere and single-machine login is on), the current session is ended and the user sees an explanatory message.
• If the account has been disabled, locked, or deactivated, the session is ended regardless of the token.
• If validation can't be completed due to a database or cache error, the system defaults to allowing access – validation failures never lock users out.

What happens after a forced logout?

The user is redirected to the logout page, which shows one of the following messages depending on the reason:

1. Account deactivated – your account has been deactivated. Contact your administrator to find out more.
2. Account locked – your account has been locked. Contact your administrator to regain access.
3. Logged in elsewhere – your account was accessed from another location, so this session has ended. Log in again to continue.
   
   
   

What about errors or database issues?

The system uses a fail-open approach: if validation can't be completed – for example, because the database is temporarily unavailable – access is allowed rather than blocked. Errors are logged for your administrator to review, but they won't cause unexpected logouts or prevent users from working.

Settings to know about

Frequently Asked Questions:

The user isn't seeing the correct logout message.
Each logout reason produces a specific message. Confirm which account status change triggered the logout (deactivated, locked, or logged in elsewhere) and check the logout page is on the latest version of printIQ.

Single-machine login doesn't seem to be working even though it's enabled.
Check that PrintIQ_SingleMachineLogin_Enabled is set to 'Yes' and that enough time has passed for the 60-second cache to expire. printIQ Staff Members are always exempt from this check.

A user is being logged out unexpectedly when they haven't been disabled.
If single-machine login is on, logging in on a second device will end the first session. Ask the user whether they or a colleague may have logged in somewhere else. If not, review the error logs with your administrator to check for validation issues.

The single-machine login setting was changed but the behaviour hasn't updated.
The setting is cached for up to 60 seconds. Wait for the cache to clear, or manually clear the cache, and try again. If the behaviour still doesn't match the setting, ask your administrator to confirm the value was saved correctly in the database.

Still not seeing the expected behaviour after checking the above?

Reach out to your system administrator or the printIQ support team for a closer look at the configuration.