I suspect that this will give issues, as security rights are refreshed fairly rarely (i.e. at login).
I more classic approach would be:
- have a custom database table with only a couple of fields (e.g. if the page is locked, who locked it, when it was locked)
- when a user opens it, in the page-load business rule, retrieve the relevant fields.
- If it's not locked, or it was locked a very long time ago (e.g. more than 2 hours), then update the fields and let the user in; otherwise, bail with an error message.
As you mention, unlocking is an issue. I think there is a "page unload" event somewhere, but can't look it up right now; but keeping track of the last-locked time, you can basically use it with session-expiration strategies that will unlock it no matter what.