After a penetration test made upon an intranet application I'm developing, in ASP.NET MVC, one of the concerns raised was that the application supports concurrent user sessions and it is recommended that the application is reconfigured to support only one session at a time for any given user account.
Windows Authentication is being used. This means the user doesn't have to log in to the application, obviously. The application simply checks the Windows Identity IsAuthenticated property before proceeding with any action. The Session can't be timed out either. There is no configuration available, as far as I'm aware, that can limit the user to a single session id.
Is this recommendation correct? If so, can I limit the user to a single session id given I'm using Windows Authentication?