Forced Logout a User

[NiceDuck]

Any Ideas for how on admin side can force logout a user of their application?

[NiceDuck]

The first thing I did to achieve this is I created a dummy datapage with the same authentication as the one being used by the datapage your target user is using.  

If you have checked the "Only one session per user" you can log in using your target users credential and thus it will log them out on their end. 

This however, requires for the admin to know the password of the target user. 

Overall this will work but has some security and trust issues.

 

[NiceDuck]

The other method I found is by placing an identifier on each datapage to check the status of the current user.

This will require the following.

1) an extra field on the user accounts table (the table which your authentication uses as data source). Preferably, you can use a text 255. If you are using a view as a data source for your authentication, make sure to include the extra field on your view.

2)On every datapage you have, create an HTML block and insert the following script (you may want to try using the header instead)

********************
<script>
if("[@authfield:extra_field]" == "Ban"){
window.location = "your_logout_URL";
}
</script>

****************************************

On this workflow, all the admin had to do is go to the user table and edit the "extra_field" value to "Ban". I prefer that you create a datapage for this instead and also, if you are using a view as an authentication data source, add a criteria on it to filter out records which "extra_field" is equal to "Ban" so they cant login again.

The problem with this workflow is, your user will not be logout immediately.  They will only be logout if they refreshed the page or go to a new page (given that all of your datapage has this code)

I am still looking for other workaround but I hope this helps anyone.

quack
 

[oliverk]

Hello @NiceDuck

I'm going to try and implement your solution on my app.

You said this: "The problem with this workflow is, your user will not be logout immediately.  They will only be logout if they refreshed the page or go to a new page (given that all of your datapage has this code".

Did you find a workaround for this? Could the script be set to run periodically, say every few seconds? That way you have a maximum of a few seconds of access after the "Ban" has been implemented.

Thanks

Oliver