Force reauthentication after user permissions have been changed

Question

In my application I can change user permissions and roles in backend.

When a user is logged in and I remove a role of the user, the user can still access content which he actually is not permitted to access anymore, because he is missing the role. The changes take effect only when the user reauthenticates himself with logout/login.

So my question is, can I access the session of a logged in user (not me)? I know I can access my own session and destroy it which forces me to login again. But I want to get the session of any user who is logged in. Is this possible? I could not find any resources about that.

I use PdoSessionStorage with symfony2.1 and fosuserbundle.

Answer 1

Make your user class implement Symfony\Component\Security\Core\User\EquatableInterface.

If you return false from the isEqualTo() method, the user will be reauthenticated. Use that method to compare only those properties that when changed should force reauthentication — roles in your case.