Comment 3 for bug 1350357

This definitely solves our issue, thanks both for the fix and for the outstanding turnaround time. I tested it on trusty, and set "allow-user-switching=false" in "[SeatDefaults]". Then, from within a stock Unity session, I tried to switch to another user from the indicator-session menu, and instead ended up locking my screen (as I would expect). When the screen was locked, "Switch Account" from the indicator menu simply had no effect (also as expected). So that's perfect, thanks.

Thanks for the clarification about the purpose of "can_switch" in the seat configuration. I realize there has never been an option before in the daemon to explicitly disable user-switching, but I'm glad there is now. From the system administrator's perspective, I think it should be something that can be globally disabled, particularly because the various shells tend to be bad at enforcing these options and preserving compatibility. LightDM has made it trivial to write our own greeter, which is great, but we don't want to get into the business of forking unity or gnome.

Yes, our custom greeter changes were required because Unity provides no way to disable user-switching from the screen locker, nor does it permit the user of an alternative screen-locker that does honor org.gnome.desktop.lockdown keys (i.e. gnome-screensaver). (filed as bug #1327384)

So we basically resorted to asking logind if there was already an active X11 session, and if so, refusing to log in as any user other than that one. https://github.com/mit-athena/lightdm-config/commit/5255191c is the change, if you're interested. But we're not terribly happy with it, so if this branch gets merged (and ideally SRU'd into Trusty), we'd love to back out that code.