Auth0 Dashboard Displays Recent Login Activity for a Blocked User
Last Updated:
Overview
The Auth0 dashboard displays a recent login and an increased login count for a blocked user. This occurs because Auth0 updates the login attributes after successful authentication, but before enforcing post-login checks like user blocks. Auth0 successfully enforces the block, and administrators can verify the rejected access in the tenant logs.
Applies To
- Auth0
- User Management
- Logs
- Login Activity
Cause
The user successfully authenticates using valid credentials. Auth0 updates the logins_count and last login attributes post-authentication but before executing post-login checks, including blocks, rules, and actions. Since Auth0 enforces the user block post-authentication, Auth0 increments the login count even though Auth0 ultimately rejects the user and prevents account access.
Solution
The login count increases for blocked users due to post-authentication checks.
Auth0 successfully enforces the block and prevents the user from accessing the account. The login count increases because the user provides valid credentials during authentication. Auth0 records this authentication event before evaluating post-login actions.
How do administrators verify the blocked login attempt?
Administrators can verify a blocked login attempt by querying the tenant logs for failed logins and matching the IP address.
- Navigate to the tenant logs.
- Query the logs for failed logins using the log type
f. - Locate the failed login attempt with the description "user is blocked".
- Verify that the timestamp and IP address match the user's last login timestamp and IP address in the raw (JSON) payload, and confirm that the body within the details object matches the user account.
