Restrict multiple user logins

idahodave wrote on Wednesday, October 05, 2016:

Hi everyone, hopefully this is not as difficult for you guys as it has been for me. It looks as if I might be beyond my ability/knowledge. This is one of the reasons this open source community is so appealing. We have installed OpenEMR and have been using it and things have going quite well for the most part. I have been asked to fix an issue that has been creping up with our service providers. Our providers are opening up two instance/tabs or sessions of OpenEMR in order to copy and past patient information which for us is a “no no”, from an audit standpoint. Because there were two different patients opened, many times the data would get saved under the wrong pid and we would get a call saying “I lost my data” this has created many technical support events because this happened so often, we would like to restrict them to one login/tab/session so as to prevent this from happening in the future.
My over all goal was to prevent the same user from logging in twice. The reason being is that if there are two browser tabs opened the session data from the browser was getting mixed up between the two tabs. For instance if I had jane doe opened in one tab and john doe opened in another tab some times the note would appear blank “lacking data” because the pid in the session data was different between the two open browser tabs “jane doe and john doe”. The note was showing up in the database under the pid of the other patient/pid. If I went into the database and changed the pid to the correct patient/pid the data would appear in the proper place under the patient/pid.

What would be the best way to accomplish this within the OpenEMR framework.

sunsetsystems wrote on Wednesday, October 05, 2016:

The underlying problem is that multiple browser sessions are supposed to work but they don’t. A developer needs to review the code pertaining to this:

http://open-emr.org/wiki/index.php/OpenEMR_System_Architecture#PHP_Sessions_and_Browser_Windows

Very likely restoreSession() is not being called in one or more places that it needs to be.

Rod
http://www.sunsetsystems.com/

sunsetsystems wrote on Wednesday, October 05, 2016:

By the way you can help by clearly documenting steps to reproduce the problem, starting with a clean database. The demo sites may be useful in this regard.

Rod
http://www.sunsetsystems.com/

teryhill wrote on Wednesday, October 05, 2016:

I got that he wanted to Only allow one login from his description.

sunsetsystems wrote on Wednesday, October 05, 2016:

Terry, yes I got that too but the core problem is as I described. There are valid reasons to have multiple logins.

Rod
http://www.sunsetsystems.com/

juggernautsei wrote on Wednesday, October 05, 2016:

My two cents is that we have tried to stop this before and people get more creative and install multiple browsers and so now game on. It is nearlly impossible to stop those that are determined to have two browser windows open at the same time.
The upside is that if they use two different browsers, there is no or less cross contamination of data.

Sherwin
www.openmedpractice.com

idahodave wrote on Wednesday, October 05, 2016:

Thanks all for the quick reaponses it is greatly apprecated. I have gone down the road of limiting to one log in per user as I didn’t know it could be resolved within OpenEMR. I have the one login per user almost complete. It flags the user as logged in and won’t allow another login. I have another issue with this approach and will spend a just a bit more time on it. If i’m able to reslove it i’ll post here what was done. If I’m not able to resolve it in a resonable amount of time I will post back here and try ti fix the “restoreSession()” calls. Again, thanks so much for your quick responses.

sunsetsystems wrote on Wednesday, October 05, 2016:

A different browser (e.g. Firefox and Chrome) for each login session would eliminate the cross-contamination problem that I describe. But in practice users would make mistakes and not always do that.

I think there may be browsers that do not share cookie-based sessions among multiple top level windows, but I have not looked into that in a long time.

Bottom line, there is a need for someone to dedicate some quality time to this.

Rod
http://www.sunsetsystems.com/