In GN4 every login session is identified by a unique id (Guid).
The session Guids are stored into a database table (gn_LoginTable) to allow the recovery of the login if the server crashes.
In other words, the users logged to GN4 client applications or browser should be able to continue to work even after a IISRESET or a recycle of the Application Pool.
Besides the login's Guid, the gn_LoginTable contains also other login's data, like the UserId and the last access datetime (gn_LastAccess column, used to check if the sessions are idle for long time).
Note that in GN4 there are different kinds of login sessions:
Web Application (a web browser calling the .aspx pages of GNPortal)
•Login data is stored into the database (gn_LoginTable).
•The session timeout is configured into the IIS (default: 20 minutes)
•When the browser sends a request to the GN4 server AFTER the web session has expired, then the user is logged out and the browser shows the 'Session expired' message.
•Because the user can close the browser without a explicit logout, the database can contain data of unused and expired web sessions.
Client Application (Cmd4, Ted4, etc... , calling the SOAP WebService's methods listed in AdminSrv.asmx)
•Login data is stored into the database (gn_LoginTable).
•The session timeout is configured in the ServerConfig.xml file (LoginTimeout parameter: default 20 minutes)
•On the client (Client.dll), a timer sends keep-alive messages to the server, refreshing the login last access date and time and avoiding the session expiration. If the client application crashes, then the keep-alive messages stop and the session expires.
•On the server (Server.dll), a timer looks for the expired sessions and, if found, removes them.
Server Application (Srv4, Back4, etc..., using directly the .NET libraries like Server.dll and Common.dll)
•Login data is NOT stored into the database
•No session timeout
In Back4, the cleanup process checks the last access datetime of the logins in the database and deletes the old useless ones.