Configuring Account Disabling

WSO2 Identity Server enables the privileged users to disable user accounts for longer durations. These disabled user accounts can only be unlocked by privileged users.

Scenario

Pickup is a cab company that has many employees who use different credentials to sign in to different internal enterprise applications. Sam is an administrator at Pickup. Larry is an employee who had served Pickup for 7 years and is entitled for sabbatical leave. As Larry is going on sabbatical leave for 2 years, Sam wants to disable Larry's account.

Let's learn how Sam can disable Larry's user account!

Set up

Follow the steps below to configure account disabling in WSO2 Identity Server.

  1. Open the deployment.toml file in the <IS_HOME>/repository/conf directory.

    1. Check whether the following listener configs are in place:

      [event.default_listener.identity_mgt]
      priority= "50"
      enable = false
      [event.default_listener.governance_identity_mgt]
      priority= "95"
      enable = true
    2. To configure the email server to send emails that informs about the disabled account to the user, add the following configurations:

      • from_address: This is the email address from which the confirmation email will be sent.
      • username: This is the username of the given email address.
      • password: This is the password of the given email address.
      [output_adapter.email]
      from_address= ""
      username= ""
      password= ""
      hostname= "smtp.gmail.com"
      port= 587
      enable_start_tls= true
      enable_authentication= true
      [output_adapter.email]
      from_address= "[email protected]"
      username= "wso2iamtest"
      password= "[email protected]"
      hostname= "smtp.gmail.com"
      port= 587
      enable_start_tls= true
      enable_authentication= true

      If you are using a Google email account

      Google has restricted third-party applications and less secure applications from sending emails by default. As WSO2 Identity Server acts as a third-party application when sending emails for password entry, follow the steps below to enable your Google email account to provide access to third-party applications.

      1. Access https://myaccount.google.com/security.

      2. Under Signing in to Google section, turn off the 2-step Verification option.

      3. Enable Less secure app access in Google Account Security section.

  2. Restart WSO2 Identity Server.

  3. To configure the account locking requirements:

    1. On the Main menu of the Management Console, click Identity > Identity Providers > Resident.

      Resident menu-item

    2. Under the Account Management section, click Account Disable.

      Account Disabling Option

    3. Select the Enable Account Disabling check box.

      Account Disabling form

    4. Click Update.

  4. To enable the account disabling claim:

    1. On the Main menu of the Management Console, click Identity > Claims > List.

      Claims List option

    2. Click http://wso2.org/claims.

      WSO2 claim dialect

    3. Under Account Disabled, click Edit.

      Account Disabled claim edit option

    4. Select Supported by Default.

      Account Disabled claim's Suppported by Default option

    5. Click Update.

Try out

  1. To create the user account for Larry:

    1. On the Main menu of the Management Console, click Identity > Users and Roles > Add.

      Add Users and Roles menu-item

    2. Click Add New User.

      Add New User option

    3. Enter the required data as follows.

      Add New User screen

      • Domain: Primary
      • Username: Larry
    4. Click Finish.

  2. To assign login permissions to the user:

    1. Click the View Roles option of Larry.

      View Roles option

    2. Click Permissions.

      Role Permissions option

    3. Select Login and click Update.

      Login permission

  3. To disable Larry's user account:

    1. Click User Profile option of Larry.

      User Profile option

    2. Enter an email address to which Larry's account disabling emails will be sent and select the Account Disabled check box.

      User Disabled option

    3. Click Update.

    4. An email that informs about the disabled account is sent to the given email address.

      Account Disabled email

    5. Access the WSO2 Identity Server My Account at https://localhost:9443/myaccount.

      Sign In form

    6. Try logging in with Larry's credentials. Note that an error message appears.

  4. To revoke the account disabling:

    1. Click User Profile option of Larry.

    2. Unselect the Account Disabled check box.

    3. Click Update.

    4. An email that informs about the enabled account is sent to the given email address.

      Account Enabled email

    5. Trying logging in to the WSO2 Identity Server User Portal with Larry's credentials. The WSO2 Identity Server User Portal home screen appears.

Top