User Management 

Administrators can manage frontend user passkeys from the backend module or via the fe_users record in the list module.

Viewing credentials in fe_users 

When editing a fe_users record in Web > List, a read-only info element shows:

  • Number of registered passkeys
  • Last used date
  • Enforcement level applicable to the user

This uses a custom TCA element (passkey_fe_info) registered by the extension.

Backend module actions 

From Admin Tools > Passkey Management FE:

List credentials
View all passkeys registered by a specific user.
Revoke a credential
Immediately invalidate a specific passkey. The user must re-enroll from that device.
Revoke all credentials
Remove all passkeys for a user. Use when a user's device is lost or stolen.
Reset grace period
Clear the user's grace period start (fe_users.passkey_grace_period_start set to 0). While the user is under required enforcement without a passkey, the next page request starts a new grace period of the configured length. Changing the enforcement level or the grace period days does not restart a grace period; this action does.
Unlock account
If the user's account is locked due to too many failed attempts, unlock it immediately.

Invalidating passkeys via database 

In an emergency, you can revoke all passkeys for a user directly:

-- View credentials
SELECT * FROM tx_nrpasskeysfe_credential
WHERE fe_user = <uid>;

-- Revoke all credentials for a user
UPDATE tx_nrpasskeysfe_credential
SET deleted = 1
WHERE fe_user = <uid>;

-- Or hard-delete
DELETE FROM tx_nrpasskeysfe_credential
WHERE fe_user = <uid>;
Copied!