How to disable a user

stefandv · April 10, 2019, 9:36am

I know I can put the LockedDate in the User table. But I want a difference between an user that is Locked (because of invalid login-attempts) and a user I have marked as “disabled” or “not-active”. Do I need to manage this myself (chaging the schema of the table)? Or is there a way to do this?

mythz · April 10, 2019, 9:40am

The InvalidLoginAttempts will hold how many failed attempts they had, or you can use something like DateTime.MinValue to indicate as such.

Otherwise you can override the existing behavior by overriding IsAccountLocked() in a Custom AuthProvider:

github.com

ServiceStack/ServiceStack/blob/79b972aa5509d77d2e770759d96e22a51f92a5e1/src/ServiceStack/Auth/AuthProvider.cs#L340


        return isAnotherUser;
    }
    return false;
}


protected virtual string GetAuthRedirectUrl(IServiceBase authService, IAuthSession session)
{
    return session.ReferrerUrl;
}


public virtual bool IsAccountLocked(IAuthRepository authRepo, IUserAuth userAuth, IAuthTokens tokens=null)
{
    return userAuth?.LockedDate != null;
}


protected virtual IHttpResult ValidateAccount(IServiceBase authService, IAuthRepository authRepo, IAuthSession session, IAuthTokens tokens)
{
    var userAuth = authRepo.GetUserAuth(session, tokens);


    var authFeature = HostContext.GetPlugin<AuthFeature>();

stefandv · April 10, 2019, 9:44am

Ok; LockedDate will be the goto solution, and I will use a valid DateTime.MinValue for SQLServer to implement my own logic to indicate a user has been inactivated from the system.
Thanks for your insight.