Allow to track last sign-in time of users #9942
Conversation
rhafer
force-pushed
the
enterprise/6726
branch
2 times, most recently
from
336e81e
to
a5aadca
Compare
rhafer
force-pushed
the
enterprise/6726
branch
2 times, most recently
from
1e01cc4
to
3c87192
Compare
|
LGFM |
|
Missing a description in the graph's README about this functionality... |
Every time the OIDC middleware sees a new access token (i.e when it needs to update the userinfo cache) we consider that as a new login. In this case the middleware add a new flag to the context, which is then used by the accountresolver middleware to publish a UserSignedIn event. The event needs to be sent by the accountresolver middleware, because only at that point we know the user id of the user that just logged in. (It would probably makes sense to merge the auth and account middleware into a single component to avoid passing flags around via context)
Pass them to the identity backend to update the last sign-in date of the user.
rhafer
force-pushed
the
enterprise/6726
branch
from
3c87192
to
142928f
Compare
The README is currently lacking ANY information about the user management related feature. IMO adding a single paragraph about the sign-in time tracking there without any additional context brings no additional value. I am fine adding adding a more complete section about the user management features and related options. Including the features added with this PR. But I will work on that in a separate PR. |
|
|
@rhafer Which release will this end up in? |
|
It's not part of any release yet. It's only in master AFAICS |
|
Should become part of 6.4.1 |
Related issue: https://github.com/owncloud/enterprise/issues/6726
To allow tracking new user signins we're are now emitting an
UserSignedInevent from the proxy's account resolve middleware.A goroutine, started as part of the graph service (the only service that might have write access to the idm database currently) consumes that event and updates a new LDAP attribute
ocLastSignInTimestampon the user object.The PR does not yet expose the attribute on the
usersendpoint. Support for that will be added in a separate PR.