search

aspnet / Identity

[Archived] ASP.NET Core Identity is the membership system for building ASP.NET Core web applications, including membership, login, and user data. Project moved to https://github.com/aspnet/AspNetCore
Apache License 2.0
1.96k stars 870 forks source link

What is considered best practice for disabling / deactivating users? #1858

Closed egmfrs closed 6 years ago

egmfrs commented 6 years ago

I would define disabling / deactivating a user as having a property held against that user which prevented them from being able to log into the application when the property had been set to a certain value.

We are building an admin section where admin members can disable / re-enable users as required.

The options I have identified:

  1. Set email confirmed to false. To re-activate a user, regenerate an email confirmation link for them. Or
  2. Set Lockout Enabled to True and Lockout End to DateTime.Max Or
  3. Add IsEnabled field to AspNetUsers (default to True) and override SignInManager to check value is True before returning a Success result.

Are there any other options / which is the most recommended?

HaoK commented 6 years ago

All of these should work, there was some effort around making it easy to do via SignInManager's CanSignIn method, so 3 is probably closest to how we envisioned something like this working, but the other two options seem reasonable as well.