How to review a user's account

How to review a user's account#

This guide shows you how to find out how one person signs in to your site, and when they last did.

Plone's own users control panel cannot answer either question. It lists names, roles, and groups, and nothing about how somebody actually gets in.

From the control panel#

  1. Open the Users control panel.

  2. Find the person.

  3. Open the actions menu at the end of their row, and choose Account.

The panel that opens has three parts.

Sign-in methods

Every provider this person has linked, named rather than listed as an id, with when the link was made and when it last worked. An account with nothing here signs in with a password.

Email addresses

The addresses on their profile, and which of them this site verified. A verified address matters beyond mail: it is what automatic linking attaches a new provider account to.

Recent activity

The most recent authentication events for this person, from the audit log.

From the API#

GET @user-account/<userid>

Needs Manage users, except when a caller asks about their own account.

Add events to ask for more or fewer recent entries:

GET @user-account/<userid>?events=50

One user at a time, deliberately. The audit log is bounded per user rather than globally, so folding either answer into the @users listing would read one bounded log per row on every page of it.

Read a badge on a sign-in method#

Two badges mean a login that will not work, and both are easy to cause by accident from the providers control panel.

Disabled

The provider exists and is switched off. Nobody can sign in or link through it, including this person.

Not configured

The provider was deleted while this identity was still stored against it. Nothing was deleted from the account: recreating the provider under the same id restores the login.

Tip

This is what a "my login stopped working" report usually turns out to be, and it is invisible everywhere else.

Read "not in the retained log"#

That is not the same as never signing in.

The audit log is bounded by both a per-user entry count and a retention period, so an account dormant longer than that period has had its entries dropped. See The audit log for both settings.

What this does not show#

A password, in any form. Nothing in this package can read one, and the audit log has never recorded credentials or tokens.

An IP address or a browser, unless you turned that on. See How to read the audit log.

Next steps#

Contents