Question

I’m looking for information about authentication but I’m very newbie so I don’t know any system.

My requeriments are: An user only can authenticate from one computer/mobile device/tablet.

I’m thinking about a monitoring system of MAC address and when the user connect using other device I can see this like an alert.

What other methods are there? Certificates?.

Repeat, I’m very newbie with this.

PD: My app has been development with framework Symfony2

Answer 1

So first of all MAC address is a network local address, which means that after it goes trough router/switch the MAC address changes, so you cannot relay on this. Even if you wanted to lookup interface MAC addres with your client software MAC’s can be changed.

Secondly Certificates give you certain properties like nonrepudiation (you can calculate digital signatures on operations that users do and then the could not deny doing something in your application). But Public Key Infrastructure is really hard to manage! You would need your Certificate Authority to give valid certificates, You would need to monitor and update Certificate Revocation Lists to deny stolen/invalid/forged certificates from being treated as valid and authentic.

If it is not a security centric application and after you analyzed your options I would suggest simple form authentication (username/password/captcha). And write mechanizm that would periodicly (i.e. every second) send an AJAX request refreshing user status, thus you could recognize if user closed browser or has opened window. And in your authentication process you could check for other ACTIVE sessions for given username and deny login or act in some other fashion. If you need more informations about authentication I would recomend looking through security patterns