User management
The OneWelcome Identity Platform manages the users' access to the mobile applications that they have installed. There are a few ways to view or manage user actions. For example, on the administration console, you can search for a user to get an overview of all actions that a user has performed and what information is stored for that user.
The OneWelcome Identity Platform itself does not manage user personal data such as name, email, and so on. It merely consumes incoming data that is given to the OneWelcome Identity Platform during user authentication. The authentication mechanism must take care that all communication for a user (user ID) refers to the same user, and that this ID is unique. The user identifier is therefore also the identifier that is used to find information about a specific user.
User information on the admin console
On the admin console, you can get user information in the Users section. The admin console provides an overview of the events and data for a user. To see user data, you need to enter the user identifier for a specific user.
Latest events
Shows the latest 20 events for a user. More detailed filtering can be applied in the Activity section. To access the Activity section, you need to have either the admin or operator role.
OAuth consent
Shows the clients and scopes for which the user has given consent.
Access tokens
Shows the current known access tokens for the user. Expired or revoked tokens are cleaned up automatically. When a refresh token is issued, the application to which this token was issued can refresh it based on either the user PIN or fingerprint, depending on the token type that is refreshed.
Access grants
This section is empty unless a client has not yet exchanged the access grant for an access token. This can occur when a client is configured improperly or when a device is suffering with network connectivity issues.
Mobile devices
Shows the mobile devices that a user has connected with the OneWelcome Identity Platform. It also shows the application to which this mobile registration is linked.
Modifications on mobile devices for a user are allowed for users of the admin console with the role admin.
Disconnect user from device
This option disconnects the user from a mobile device. The functionality can be triggered per row item (via the Action drop-down in the Actions column) and per user (via the Action drop-down above the table).
Disconnecting a user from a device forces the user to enroll for the application again before they can use it again. Other users using this same device are not effected by the disconnect operation. When using the disconnect operation, the client credentials of the device are not removed.
Revoke mobile authentication
This option is only available if the user has activated a device for mobile authentication. The functionality is triggered from the Action drop-down.
When the mobile authentication is revoked, the user can no longer use the mobile device for authentication. To enable mobile authentication again, the user needs to enroll on a mobile device. This option also revokes the activation for push notifications for this user on this device.
Revoke push notifications
This option is only available if the user has activated a device for mobile authentication with push notifications. The functionality can be triggered from the Action drop-down.
When the push notifications are revoked, the user can no longer use the mobile device for authentication with push messages. They can still use the mobile device for other types of mobile authentication that do not require push messaging. To enable push notifications again, the user needs to enroll for push on a mobile device.
Delete mobile device
This deletes mobile devices for a user. The functionality can be triggered per row item (from the Action drop-down in the Actions column) and per user (from the Action drop-down above the table).
When deleting a user's device, all users connected to the device are disconnected and must enroll again before using the application again. A list of users connected to the device is prompted before the delete action can be approved. The delete operation removes the client credentials of the device, after using the application again it is registered as a new client.
Manage users with the API
All endpoints contained within the end user API are secured via an API client. To configure an API client, see API configuration.
The end-user API allow you to perform get and delete actions for the following user-specific data:
