Admin Account Lock - Lock instead of delete

Installation

1. Get the plugin from the Shopware Store or upload it as a ZIP file under Extensions > My extensions
2. Click Install in the extension list — the required database tables are created automatically during installation
3. Activate the plugin using the toggle on the left of the extension card
4. Reload the administration once so the new sections appear

No further configuration is required — all features are ready to use right after activation.

Locking users

Via the user detail page (with reason, start and expiry)

1. Open Settings > System > Users & permissions and click the desired user in the user list
2. Scroll to the Account lock card on the detail page
3. Optionally enter a Lock reason (shown in the lock banner)
4. Optionally set Locked from: if the time lies in the future, the lock is only scheduled and starts automatically at that time — until then the user can sign in normally
5. Optionally set Locked until: at this time the lock ends automatically and the user can sign in again
6. Click Lock account — without dates the lock takes effect immediately and indefinitely

Both date fields use the UTC time zone; existing locks are displayed in the time zone of the signed-in admin user.

After locking, the card shows an Account locked banner with “Locked since”, “Locked until” and the reason. For a scheduled lock, the Lock scheduled banner with “Locked from” appears instead. To release the lock, simply click Unlock account.

Quick locking via the user list

1. Open the context menu (three dots) of the row in the user list
2. Choose Lock account and confirm the dialog with Lock account — this quick lock always takes effect immediately and indefinitely
3. To release the lock, choose Unlock account in the context menu

The user list shows the status in the Account lock column: Locked for effective and Scheduled for scheduled locks. Use the detail page for locks with a reason, start or expiry.

What a lock does

• The user can no longer sign in to the administration
• Existing sessions of the user are terminated on their next request
• Stored login tokens are no longer renewed
• The user cannot set a new password via “Forgot password”
• All data, assignments and the history of the user remain fully intact

Locking integrations

1. Open Settings > System > Integrations — the list shows the lock status in the Lock column
2. Either choose Lock integration in the context menu of the row and confirm the dialog (immediate and indefinite)
3. Or open Edit integration: the Integration lock section offers the same fields as for users (Lock reason, Locked from, Locked until)

A locked integration no longer receives new API access tokens; already issued tokens are rejected on their next request. After unlocking, API access works again immediately with the unchanged credentials.

Built-in safeguards

• No self-lockout: your own account cannot be locked — in this case the card only shows a notice
• Last administrator: the last active, unlocked administrator cannot be locked; the attempt is rejected with an error message. Scheduled locks count as well — there can never be a lock in place or pending for all administrators at the same time

Granting permissions

1. Open Settings > System > Users & permissions and create or edit a role in the Roles section
2. In the permissions area, enable the rows Admin account locks and Admin integration locks under the Settings category:
   • View — see lock status, banners and list badges
   • Edit — set and release locks

Users with administrator rights do not need any separate permission.

Controlling locks via the Admin API

All features are also available through the Admin API, e.g. for offboarding automation:

• POST /api/_action/okuehne-admin-user/{userId}/lock — locks a user; optional JSON body with “reason”, “lockedFrom” and “lockedUntil” (ISO 8601)
• POST /api/_action/okuehne-admin-user/{userId}/unlock — releases the lock
• GET /api/_action/okuehne-admin-user/{userId}/status — returns the current lock status
• For integrations identical under /api/_action/okuehne-admin-integration/{integrationId}/…

The endpoints require an Admin API token with the permissions described above.

Note on scheduled and time-limited locks

The lock enforcement itself is precise to the second and does not depend on a cron job: start and expiry are checked live on every sign-in and API attempt. For the automatic clean-up of expired locks and for invalidating stored login tokens of scheduled locks, the Shopware queue (message queue and scheduled tasks) should be running as recommended by Shopware.

Uninstallation

1. Deactivate the plugin under Extensions > My extensions using the toggle
2. Choose Uninstall in the context menu
3. Decide in the dialog: with the option Remove all app data permanently the lock tables are deleted; without this option, existing locks are kept for a later re-installation

Users and integrations themselves are never modified or deleted by the plugin.