OpenID Plugin: allow max_sessions

[nynymike]

Some customers would like to limit the number of sessions a person can have active.

For example, consider this use case:

1. User navigates to website with Browser 1 (session 1)
2. User navigates to website with Browser 2 (session 2)
3. GG prompts user: Do you want to terminate Session 1?
4. GG performs back-channel logout of session 1

[altexy]

@nynymike
To implement this feature we need shared storage like Redis.
It would be harder to support/deploy GG, similar to true rate-limiting.

Also not sure what we may use for back-channel logout:
https://gluu.org/docs/oxd/4.0/api/#get-logout-uri

The get_logout_uri command uses front-channel logout.

[nynymike]

This feature is a placeholder. I don't want to implment it right away. Agreed that we'd need a shared cache. Also, Gluu Server doesn't support back channel logout today.