Description of problem:

By default VMs do not allow console reconnect (thus 'Disable use strict checking' is not-checked').

engine=# select vm_name,vm_guid,allow_console_reconnect,console_disconnect_action from vms where vm_name = 'jb-w7-x86';
  vm_name  |               vm_guid                | allow_console_reconnect | console_disconnect_action 
-----------+--------------------------------------+-------------------------+---------------------------
 jb-w7-x86 | 8d809727-1f36-4633-b0da-9ea71cd66182 | f                       | NONE
(1 row)

Thus if an user (eg. my AD user - ad-w2k12r2) opens spice console in User Portal, close the spice console and admin@internal opens spice console, "console session" is assigned to admin@internal:

engine=# select username from users where user_id = (select console_user_id from vm_dynamic where vm_guid = '8d809727-1f36-4633-b0da-9ea71cd66182' );
 username 
----------
 admin
(1 row)

Thus it used to work in a way that later on any user could not open again spice console from User Portal (allow_console_reconnect = false).

But in 3.6-beta my user 'ad-w2k12r2' _CAN_ open console after admin@internal opened that.

It is even worse, while admin@internal has still the console opened, ad-w2k12r2 can open spice console from User Portal and thus he can practically steal open session and get whatever user priviledge admin@internal has been in that time using.

After AD user "steals" the spice console (original admin@internal's console gets closed; I had both users logged in on same client pc).

engine=# select username from users where user_id = (select console_user_id from vm_dynamic where vm_guid = '8d809727-1f36-4633-b0da-9ea71cd66182' );
  username  
------------
 ad-w2k12r2
(1 row)

Version-Release number of selected component (if applicable):
rhevm-backend-3.6.1.3-0.1.el6.noarch

How reproducible:
100%

Steps to Reproduce:
1. 1 vm assinged to an user with UserRole so he can open via User Portal
2. user in User Portal opens spice console of the vm and close it
3. admin@internal opens console from Admin Portal
4. user in User Portal opens spice console (admin@internal has still the spice console opened)

Actual results:
user in User Portal is able to access desktop of a VM while admin@internal is working with it

Expected results:
if admin@internal opens already opened spice console of an User Portal user, he replaces current session (it is written to db) and thus an User Portal use should not open the same spice console until reboot

Additional info:
" Click the Advanced Parameters arrow and select the check box to use this option. With this option selected, the virtual machine does not need to be rebooted when a different user connects to it.
By default, strict checking is enabled so that only one user can connect to the console of a virtual machine. No other user is able to open a console to the same virtual machine until it has been rebooted. The exception is that a SuperUser can connect at any time and replace a existing connection. When a SuperUser has connected, no normal user can connect again until the virtual machine is rebooted.
Disable strict checking with caution, because you can expose the previous user's session to the new user. "