Force email verification periodically?

[vccoffey]

We need to force users to re-verify their account annually in order to confirm that they still active employees (have access to their organizational email). We could either do this a year from the last time each individual account verified their email, or once annually for all users. What's the best way to go about this?

[jeremyevans]

If you want something that uses what Rodauth ships with, maybe use the lockout feature, and every year, lockout their account? That would force them to unlock the account via a link sent in an email.

[vccoffey]

I like the idea of using the lockout feature.

That said, we do also use the lockout feature the normal way (eg when a user puts in the wrong password too many times).

We'd like to display two different messages, one for the annual lockout and one for the password fail scenario. Any tips storing the lockout reason and displaying a different flash message depending on the circumstance?

[jeremyevans]

If you are automatically locking out users, set a flag somewhere for the user when doing that, and have login_lockout_error_flash look for the flag and use a different message if it is set.

[dloft]

Would this work if we're also using an account_lockouts_deadline_interval of 6 hours? Seems like that would cause the email re-verification feature to only last 6 hours rather than indefinitely until they re-verify. Is there a way to have both normal lockouts last 6 hours and re-verification lockouts last indefinitely?

[jeremyevans]

account_lockouts_deadline_interval is only used for computing the new deadline. For reverification lockouts, just set the deadline to a date far in the future.