Block users after certain inactivity period

[romandubrov]

Hi there,

In order to pass HIPAA certification we need to block username-password users that weren’t active for certain time. There is no such option available out of the box in management panel, and there is also no field in user or context that could indicate that user passed all auth stages (password, MFA forced conditionally from a rule, other rules that may throw UnauthorizedError for some other reason)

Am I missing something? Any ideas how to implement this?

We are using auth0-spa-js with popup on the app side, so there are no redirects (not sure if this is important)

[dan.woda]

Hi @romandubrov,

Welcome to the Community!

You can use the app_metadata property to set this up.

Here is an excellent write up from @joseantonio.rey:

Last_login not available in user object in custom rule

Hello! This is because there would be a caveat: rules execute after a successful authentication, meaning that the last_login value would be the value for the current time and date. What you could do is set the value to the app_metadata, and grab it from there. Your rule would look something like this: user.app_metadata = user.app_metadata || {}; // Grab the current value of last login and print it var previous_login = user.app_metadata.previous_login console.log(previous_logi…

[romandubrov]

Hi @dan.woda,

Unfortunately this does not work for me. I need to set a value to user_metadata only when user has passed MFA and other rules that may throw. I created a rule to update user_metadata and put it at the end of rules list, and it was executed before passing MFA or after previous rule thrown an error. I looked to user and context objects but seems there is no way to know that user successfully passed previous steps and rules.