Hmmm seems it's only possible to kill an arbitrary user's session if db session is used.
https://forum.yiiframework.com/t/force-logout-a-user/21598/4

We can use same solution than in Account past their expiration date can be still active

1. Create a scope : https://github.com/LimeSurvey/LimeSurvey/blob/7558178fe4dd473b9ee3e75e447940a181b67d4e/application/models/User.php#L131 , maybe rename current to notexpired
2. Use this scope in https://github.com/LimeSurvey/LimeSurvey/blob/7558178fe4dd473b9ee3e75e447940a181b67d4e/application/core/Traits/LSApplicationTrait.php#L33 User::model()->notexpired()->active()->findByPk

It's done.

Since it's related to Plugin : i can be great to have an event in scope.

$activeScope = array(
    'condition' => "active = :active",
    'params' => array(
        'active' => 1,
    )
);
$event = new PluginEvent('UserScope');
$event->set('active', $activeScope);
App()->getPluginManager()->dispatchEvent($event);
$activeScope = $event->get('active');

Then another plugin can get active in another DB (for example in LDAP server for AuthDB)

@mohabmes : if you're OK, i can take it

@DenisChenu Implemented already. Here's the pull request https://github.com/LimeSurvey/LimeSurvey/pull/3690

:+1: