User Locking and Banning
Account Locking
Account Locking is delivered by the Devise lockable module, and automatically locks the account after three failed sign-in attempts. A warning message is given on the last attempt.
Once the account is locked, the user can unlock via email using the Unlock my account link on the sign in page.
Account Banning
System administrator accounts can ban user accounts through the ActiveAdmin interface at /admin/users. Administrators can:
- Ban users: Click the “Ban” button next to any non-banned user
- Unban users: Click the “Unban” button next to any banned user
Once banned, users cannot sign in and only administrators can unban the account.
Banning Behavior
- Overrides locking: If an account is locked, the lock status is cleared when the administrator bans the account
- Prevents authentication: Banned users cannot sign in regardless of password correctness
- Blocks unlock attempts: Banned users cannot use the “Unlock my account” link
User Experience
When a banned user tries to log in:
- They receive the message “Invalid Email or password” (Devise treats banned users as authentication failures)
- They see the “Unlock my account” link on the sign-in page
- If they try to unlock, they receive “Email not found” (since the account is banned, not locked)
Admin Interface
In the ActiveAdmin user management interface:
- Ban button: Only visible for non-banned users
- Unban button: Only visible for banned users
- Success messages: Clear feedback when actions are completed
