We currently track the SP sessions in the IdP user session. We should separate this. If we did something like used the database to track SP sessions, it would allow us to not lose details on SP sessions if a user session is destroyed for whatever reason.

In addition, this would also be very useful for administrative logout purposes. We could easily get details on all logged in SPs for a particular user from the database to build UI.

While addressing this ticket, we should also look at automatically purging expired sessions from the database.

This issue ticket was originally removed from the tracker as it clashed with the pull request.
See upstream ticket for migration details.