Honored Contributor.. SPierce1 Honored Contributor..
Honored Contributor..
230 views

How to disconnect a single user or all users from the SA gui?

Is there a way to forcefully disconnect a user session from SA?

 

Today, even if I restart all the components of SA, any user who was already connected is able to continue their session without re-authorizing.

 

Some of the reasons that we may want to "kill" user sessions:

1)  The user session is causing a problem (twist spewing thousands of error messages - this happened yesterday)

2) The user permission have changed to something a lot more restrictive - we need to have the changes effective immediately

3) A rollup or hotfix has been installed that includes a fix to the gui.  If the user does not initiate a new session, they continue to use the old gui

4) Patching  or an Upgrade is in progress and we do not want users to make changes while the patching is in progress.  We can easily prevent new logins, but for the users who are already connected, there is nothing that we can do.

0 Likes
6 Replies
Absent Member.. jeremymk5 Absent Member..
Absent Member..

How to disconnect a single user or all users from the SA gui?

Hi Suzanne,

 

Please let me do some research about how you can forcefully disconnect  a user session from SA,

as soon as possible I will be abck to you

 

Cordially

 

Jeremy Jimenez

SA Team
SW Technical Support Consultant

jimenez@hp.com

0 Likes
Absent Member.. jeremymk5 Absent Member..
Absent Member..

Re: How to disconnect a single user or all users from the SA gui?

Hello Suzanne

 

I hope you are doing good.

 

Could you please try with this command 

pkill -9 -u username

 

wiht the above command you will be able to forcefully disconnect a single user from the java gui

 

Please let me know if this command will be useful for you

 

Cordially

Jeremy Jimenez

SA Team
SW Technical Support Consultant

jeremy.jimenez@hp.com

Highlighted
Absent Member.. apresence Absent Member..
Absent Member..

Re: How to disconnect a single user or all users from the SA gui?

Jeremy,

 

PLEASE - NOBODY RUN THIS COMMAND!

 

The pkill command is certainly not the right answer.

 

The answer as you have provided it will kill off all UNIX processes owned by a user.  If you're suggesting running that on an SA slice, that's very dangerous.  In any case, I'm pretty sure SA does not create a process under the user name connected to the SA GUI, so that would serve no purpose.

 

If you are suggesting this for someone running the SA GUI on a UNIX system, and running the command on that system itself, it would kill off all the processes that user started (as previously mentioned), and only kill off the processes that the user started.  Those processes may or may not include the SA GUI process.  I happend to log into the OS with user_A nothing is to keep me from logging into the SA GUI as user_B.  If I kill processes for user_B, that would not include the SA GUI.

 

All around, an incorrect answer, and a very dangerous command to run.

 

Honored Contributor.. SPierce1 Honored Contributor..
Honored Contributor..

Re: How to disconnect a single user or all users from the SA gui?

Partial solution:
So we did some testing and found the if we go to
Administration--> users and groups --> security settings
And set "SA Client Session Inactivity" to require login after to a very low number (eg 5 seconds), it will log everyone off (including admin users)


It basically requires the user to re-enter their password

I still need to test to see if there is a change to the UI, will it reload the UI as well?

What's still outstanding is how to kill a single user's session

0 Likes
Absent Member.. apresence Absent Member..
Absent Member..

Re: How to disconnect a single user or all users from the SA gui?

Suzanne,

 

That is an excellent discovery.  AFAIK the only way to terminate all sessions from the SA GUI is to restart the SA core services on all slices.  I'm sure if you restarted a subset of the services (like occ and twist) it would probably work, but we haven't ever tried it and are usually a bit wary of patially restarting SA services since this has bitten us before.

 

The problem with restarting those services is that when the SA GUI detects a connection loss it will just re-connect again transparently.  I'd imagine if you combined your trick for the user timeout with the restart of the core services that would effectively terminate all active sessions and force users to re-enter their password at least.

 

The question is, does this kick them out of the GUI completely to where they have to restart it?  It's during that startup phase that the GUI looks for and makes updates to itself, which is one of the points of concern you mentioned in your original post.

 

I'd also be curious if there was a way to send a message to all current users logged into the SA GUI, similar to a UNIX "wall".  If there is, you could message everyone requesting that they log out of and back into the GUI.  Another HP tool called Operations Manager (Or OpenView or OPC depending on how long you've been using it) used to support that feature.  Not sure if it still does.

 

Thanks!

Honored Contributor.. SPierce1 Honored Contributor..
Honored Contributor..

Re: How to disconnect a single user or all users from the SA gui?

Using the session inactivity timer will  force  re-entry of the password.

However, it  will NOT force a reload of the gui jar files.

 

We tested this  by changing the timestamp of the ngui.jar

- On a desktop - login to the gui

- on the SA server (all slices in the core)

     touch /opt/opsware/occclient/ngui.jar

- Set the inactivity timer

- Waited for the  previous login to time out

-  Enter the password when prompted.

At this point I had hoped that the ngui.jar would be be reloaded.  It was not.

 

To further verify, we started up a new gui session, and as expected, that loaded a new ngui.jar.

 

(An equivalent to the wall command would also be a very nice feature)

 

 

 

 

 

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.