Look for a table named FND_Client_logon_tab.

Unfortunately, this table is empty.

We’re using IFS Cloud 22R2 - if it matters.

Well, then that explains why they no longer have this limit.  IFS is not populating this table which means they are not collecting and passing on this information from the client/website.  It would be interesting to see what appears for data in the oracle database sessions, but I bet all you get is the server name of the web server and the user under the client_info.  The webserver itself collects that data in the logs, but I don’t know how you can use that if IFS is not storing it somewhere in the database.

It is odd though because the table I listed collects the directory id which is the value that used to be the web user id.

I want to understand - maybe this is normal behavior for the IFS cloud? Maybe this table is now obsolete?

Just out of curiosity, what is their concern with this? 

Violation of security requirements, obviously. Security requirements vary from company to company and are sometimes very confusing.

So, no one knows how to limit access to IFS Cloud with one active session per user?

In Aurena (browser access) is not possible, as far as we’ve researched. A block like this will impact other functionality (like Duplicate Tab) and having multiple browser windows open pointing to different screens, since all the access is now via HTTP API (projections with cookies). You could CRIM a redirect after a check on Oracle sessions history (with history log enabled), but we were recommended against modifications on FND items. We’re on APPS10, making use of both IEE and browser interfaces. The IEE Client (in previous versions) was a different technology, where you could clone windows under the same session.