FR: Add User management

[pglombardo]

Discussed in https://github.com/pglombardo/PasswordPusher/discussions/1337

^{Originally posted by **kayvanaarssen** August 10, 2023} Manage Active users on an server. When sign-ups are enabled, either with domain validation or Public. We would like to be able to manage the users and or delete them / block when needed. Or even block domains. This of course would need to have Password Pusher with a DB deployed.

[technofab]

Hi, in my point of view, for this request it can be useful use also a "LDAP" backend for users, for example full LDAP TBSAM or Active Directory, some projects like openproject use LDAP and Active Directory for user management.

[pglombardo]

OpenProject is a great example that I can use - built with the same stack as Password Pusher too . Implementing LDAP blindly is hard to do.

[petskratt]

Two user-stories that perhaps could be considered when picking implementation for this feature, related to instance with domain-limited user registration for file sharing functionality:

• I would like to delete or lock-out accounts of employees when they leave the company
• I would like to add / invite users from client domains that are not in the configured allowlist regex

note: my current "hack" solution is to add a scheduled job that removes verification from inactive users, so they need to re-verify email and are technically locked out when they don't control the email anymore

[pglombardo]

That's helpful @petskratt thanks.

note: my current "hack" solution is to add a scheduled job that removes verification from inactive users, so they need to re-verify email and are technically locked out when they don't control the email anymore

That's a slick solution for now :-)

I have this half implemented in a branch that I need to resurrect. Hopefully I'll get to this soon.

[petskratt]

Follow-up to my hack - setting locked_at timestamp is actually better, as token is generated and cleared automatically. The actual command, presuming credentials in env (in my case it runs in CronJob container, so having pwd on commandline not a great problem):

mysql -h $DATABASE_HOST -u $DATABASE_USER -p$DATABASE_PASS $DATABASE_DB -e "UPDATE users SET locked_at = now() where confirmed_at is not null and locked_at is null and current_sign_in_at < date_sub(now(), interval 1 month)"