Let organisation owners sign a member out

Applies when

The project has user accounts.

How to do it

NIST SP 800-63B-4 asks services to disable a lost or stolen authenticator promptly. A member who loses a signed-in laptop needs the same for its sessions. Store a "sessions valid after" time on the membership. Refuse any session or token for that organisation created before it. This works for signed tokens too, without a revocation list. Keep the membership and the role. Delete the push subscriptions those sessions registered, as Unlink push from the account at sign-out says. Notify the member and write an audit event. Removing someone for good follows remove access when someone leaves.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

JavaScript example

export async function signMemberOut(db, organisationId, memberId, ownerId) {
  await db.none('UPDATE memberships SET sessions_valid_after = now() WHERE organisation_id = $1 AND user_id = $2', [organisationId, memberId]);
  await audit.append({ organisationId, actor: ownerId, type: 'member.signed_out', subject: memberId });
}

export const isSessionValidFor = (session, membership) => !membership.sessionsValidAfter || session.createdAt > membership.sessionsValidAfter;

Python example

def sign_member_out(conn, organisation_id: str, member_id: str, owner_id: str) -> None:
    conn.execute("UPDATE memberships SET sessions_valid_after = now() WHERE organisation_id = %s AND user_id = %s", (organisation_id, member_id))
    audit.append(organisation_id=organisation_id, actor=owner_id, type="member.signed_out", subject=member_id)

def is_session_valid_for(session, membership) -> bool:
    return membership.sessions_valid_after is None or session.created_at > membership.sessions_valid_after

How to check

Sign a test member in from two browsers. As the owner, sign the member out. Both browsers get 401 or 403 on their next request to the organisation. The member signs in again and keeps the same role.

Sources

• NIST SP 800-63B-4 on loss, theft, damage and compromise

Related rules

• Unlink push from the account at sign-out in Notifications
• Write an audit event for every sensitive action in Compliance
• Remove access when someone leaves in Accounts