Story: Disable User Accounts

[jonnalley]

User Story

As an OPS System Admin, I want to disable or remove named users for OPS so that I can better control who is accessing and using OPS and meet all requisite compliance needs.

Acceptance Criteria

• [x] A user account can be marked as disabled and then re-enabled an indefinite number of times with appropriate log or event history entries recording metadata of each action
  • [x] A notable exception to this should be that the user (User Admin) may not disable their own user account if there are no other active users possessing the System Admin role.
• [x] A user can view a list of pre-existing user accounts which are active
• [x] A user can view a list of pre-existing user accounts which include both active/enabled and inactive/disabled accounts.
• [x] A user that's marked as disabled will not succeed in an attempt to log in to OPS

---

Tasks

UX Design/Research:

Dev:

• [x] Create persistent store schema related to the concept of a user account's binary status
• [x] Create backend code related to the retrieval, listing, and updating of a user account's status
• [x] Create frontend code related to the retrieval, listing, and updating of a user account's status

Definition of Done Checklist

• [x] UI works as designed (UX team)
• [x] PR(s) have been merged to main
• [x] Design/tech debt eliminated
• [x] New design/tech debt documented (if applicable)
• [x] Build process updated
• [x] Documentation updated or added
• [x] Feature flags/toggles created

Additional Context & Resources

• This is "locking" in the database. As opposed to "inactive"
• This story does not cover topics related to using the users for anything or tying to 3rd party authn/IdP services, etc...
• A "user" in this context mentioned in the Acceptance Criteria refers to a human consumer of OPS, not a logged in or authenticated user. This is a bootstrapping effort to get RBAC/User management in place
• Will we need outbound email to confirm the action?

[kimschulke]

Users that don't log in for 60 days will become inactive users. If this is a mistake and that person needs access again, the system admins would need a way to enable them again. (users deactivated after 60 days would be a separate user story)

Should employees leaving OPRE also become inactive users... or should there be another process for this use case? for example, disable vs deactivate

We dont want to delete inactive users because we want to maintain their data in OPS

[jonnalley]

I updated #2104 to handle the 60-day auto disable

[johndeange]

@kimschulke - If the user turns in their PIV and cannot log into AMS that would effectively prevent them from logging into OPS. Also, for the case where their AMS account is still active the User's status can be set to LOCKED which will prevent them from logging into OPS.

[jonnalley]

8/12