How do you logout a user from the server in PHP?

Hi

check out this blog post: Session duration on Sugar 7 | Enrico Simonetti [dot com]  

From that post you could try removing entries from oauth_tokens table.

HTH

Thanks, that's a very helpful article in general!

But it even says that just the table won't be enough:

If the entries are only removed from the database table, it will only fail to re-generate the next token as soon as the current one expires, but it will not logout the users right away.

And I believe there must be a clean method of logging a user out already available, since Sugar does that through the API and in other places. It's weird though that the same code doesn't work in an entry point or a logic hook.

Hi Artis Plocins,

If you need a user to be logged out after X minutes since login (independently from user activity), you can achieve so by setting the configuration option as stated on the blog post:

$sugar_config['oauth2']['max_session_lifetime'] = <seconds>;

Alternatively, if you need an idle logout triggered client side, I did a POC for a similar use case quite some time ago that you could have a look at as a starting point, and see if it still works. The POC would only apply to browser based inactivity (not mobile or plugins) and it is i initiated client side. The code can be found here: GitHub - esimonetti/SugarIdleLogout: Idle based automatic logout from web browser ui 

Also, do remember that this could cause issues if the users have unsaved work on their browsers and the system logs them out.

As a disclaimer, as usual please note that any of the code changes samples provided are "as is" and it would be your responsibility to maintain and support.

Hi Artis Plocins

Deleting entries from the oauth_tokens table will not just cause the regeneration of the next token to fail as soon as the current one expires.

It will also logout the users, however not right away, but within 2 min: The oauth_tokens table is checked every 2 mins if the refresh token still exists. If not, the access token is set to NULL and the session is logged out.

See include/SugarOAuth2/SugarOAuth2Storage.php

...

const TOKEN_CHECK_TIME = 120;

...

public function getAccessToken($oauth_token)

Hi Artis Plocins

Deleting entries from the oauth_tokens table will not just cause the regeneration of the next token to fail as soon as the current one expires.

It will also logout the users, however not right away, but within 2 min: The oauth_tokens table is checked every 2 mins if the refresh token still exists. If not, the access token is set to NULL and the session is logged out.

See include/SugarOAuth2/SugarOAuth2Storage.php

...

const TOKEN_CHECK_TIME = 120;

...

public function getAccessToken($oauth_token)