How can I programatically log another user out in D7?

Question

On our site we have client accounts, each with a super administrator and sub users belonging to that account.

We want the super admin to be able to force sub users to log out. What's the best way to destroy a user's session in Drupal that works regardless of whether the session information is stored in Redis, Memcache or the database?

Before someone feels tempted to suggest user_logout(), that destroys the current user's session. I want the current user to be able to destroy a different user's session!

Answer 1

drupal_session_destroy_uid() sounds like a safe bet:

Ends a specific user's session(s).

The core implementation clears the database, as you'd expect, but any module that overrides session.inc, and doesn't provide a working implementation of that function, would surely be considered broken (as user_delete_multiple() and other functions need it).

So in theory you should be able to use that function regardless of the storage.

Answer 2

Session Proxy provides a generic replacement for Drupal's session handling that is supposed to work with various backends.
As such it also implements drupal_session_destroy_uid().

Note that the session implementation of Memcache API and Integration is considered unstable, and that the maintainer of Redis recommends the use of Session Proxy.

The problems of handling sessions consistently across various backends are outlined in issue 1260634.

Answer 3

In Drupal 7, We can log out a user if we have his User_ID using db_delete():

db_delete('sessions')->condition('uid', $User_ID)->execute();