[GH-ISSUE #4387] Last Login Date/Time for User gets not updated #8583

New Issue

saavagebueno · 2026-08-05T01:18:43-04:00

saavagebueno commented

2026-08-05 01:18:43 -04:00

Originally created by @MichaelUray on GitHub (Aug 21, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/4387

Describe the problem
Even I just logged out and logged in in with my user to the dashboard, it does not update the last login date/time.

NetBird version
selfhosted docker latest (0.55.1)

Nothing obvious to see in the logs.
I did migrate from SQLite to Postgres about two weeks ago if that matters.

Originally created by @MichaelUray on GitHub (Aug 21, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/4387 **Describe the problem** Even I just logged out and logged in in with my user to the dashboard, it does not update the last login date/time. <img width="1465" height="176" alt="Image" src="https://github.com/user-attachments/assets/672bd25c-deb9-4c4b-b358-b62847508324" /> **NetBird version** selfhosted docker latest ([0.55.1](https://hub.docker.com/layers/netbirdio/netbird/0.55.1/images/sha256-493efcf6cabe6b0e54487feeb26655f031e28996eb2d31868031f2fa81e436d5)) Nothing obvious to see in the logs. I did migrate from SQLite to Postgres about two weeks ago if that matters.

saavagebueno added the triage-needed label 2026-08-05 01:18:43 -04:00

saavagebueno commented

2026-08-05 01:18:44 -04:00

@saule1508 commented on GitHub (Aug 24, 2025):

This login date is not the date you logged in onto the dashboard, for what I know it is the login date of a peer of your user

@saule1508 commented on GitHub (Aug 24, 2025): This login date is not the date you logged in onto the dashboard, for what I know it is the login date of a peer of your user

saavagebueno commented

2026-08-05 01:18:44 -04:00

@MichaelUray commented on GitHub (Aug 25, 2025):

for what I know it is the login date of a peer of your user

There are peers which got just connected for this user as well, the peers are shown online - last seen "just now".
From my understanding means last login when the user did connect to the dashboard or to sign in via the web browser to connect.

@MichaelUray commented on GitHub (Aug 25, 2025): > for what I know it is the login date of a peer of your user There are peers which got just connected for this user as well, the peers are shown online - last seen "just now". From my understanding means `last login` when the user did connect to the dashboard or to sign in via the web browser to connect.

saavagebueno commented

2026-08-05 01:18:44 -04:00

@MichaelUray commented on GitHub (May 9, 2026):

After re-tracing this in the current codebase I want to share what I found, partly to settle the "what does this field actually mean" thread and partly so any future fixer doesn't have to repeat the archaeology.

What `User.LastLogin` actually contains

The field is updated by three different code paths with different semantic meanings, all writing to the same column:

1. JWT IdP claim — dashboard or device auth

management/server/user.go:240 inside GetUserFromUserAuth:

err = am.Store.SaveUserLastLogin(ctx, userAuth.AccountId, userAuth.UserId, userAuth.LastLogin)

userAuth.LastLogin is parsed from the JWT's last_login claim by shared/auth/jwt/extractor.go:116. This runs on every authentication that goes through the JWT middleware — both dashboard logins and gRPC device logins. The struct comment in types/user.go says "LastLogin is the last time the user logged in to IdP", but the value comes from a custom last_login claim that most IdPs do not set automatically:

Keycloak's standard claim for authentication time is auth_time, not last_login. Without explicit mapper configuration, last_login is missing or stale.
Auth0 needs an Action / Rule to populate this claim.
Dex passes through whatever the upstream IdP issued.

When the claim is missing or unparseable the extractor falls back to zero-time, and SaveUserLastLogin then short-circuits without saving (see below).

There is an explicit TODO comment in the same function acknowledging the next problem:

"this code should be outside of the am.GetAccountIDFromToken(claims) because this method is called also by the gRPC server when user authenticates a device. And we need to separate the Dashboard login event from the Device login event."

2. New peer added by user

management/server/peer.go:811:

case addedByUser:
    err := transaction.SaveUserLastLogin(ctx, accountID, userID, newPeer.GetLastLogin())

Adding a new peer (netbird up on a fresh device) writes the peer's registration timestamp into User.LastLogin.

3. Expired peer re-authenticated

management/server/peer.go:1203 inside handleExpiredPeer:

err = transaction.SaveUserLastLogin(ctx, user.AccountID, user.Id, peer.GetLastLogin())

Whenever a peer's session expires and the user re-authenticates that peer, the peer's new login timestamp lands in User.LastLogin.

Save logic always overwrites

management/server/store/sql_store.go:2731:

func (s *SqlStore) SaveUserLastLogin(...) error {
    // ...
    if !lastLogin.IsZero() {
        user.LastLogin = &lastLogin
        return s.db.Save(&user).Error
    }
    return nil
}

No MAX(existing, new) comparison. The field is always overwritten, even if the new value is older than the existing one. This is the smoking gun for the user-visible symptom in this issue: a JWT carrying a stale last_login claim can silently roll the displayed timestamp backwards, hiding the more recent dashboard or peer event.

So what does the dashboard actually display?

The latest of:

whatever the IdP put into the JWT's last_login claim (if anything)
the registration timestamp of the most recently added peer
the re-auth timestamp of the most recently expired-and-renewed peer

…minus any older value that happened to overwrite it. The label "Last Login" suggests a clear semantic, but in practice the field is multi-source with no ordering guarantee.

For the symptom in the issue ("logged out and logged in, no update") the most likely chains, ranked by how often I've seen them in self-hosted setups:

IdP doesn't populate the last_login claim on token issuance. No claim → zero-time → SaveUserLastLogin no-ops. The field stays at whatever the most recent peer event wrote.
IdP populates the claim with session-start time, not token-issuance time. The session was started before the most recent peer event → the JWT carries an older timestamp → silent rollback.
Active peer keep-alive overwrites with peer's last-seen. This shouldn't happen on the standard paths shown above (the three call sites are all explicit user/peer auth events, not periodic keep-alives), but it's worth verifying for setups where peer expiration is configured aggressively.

Suggested fix direction (open for discussion before I send a PR)

A clean fix would split the field by source rather than try to reconcile sources:

New columns users.last_dashboard_login and users.last_device_auth. Dashboard UI shows the right one in the right context (and either field can be exposed in the API alongside the existing last_login for backwards compat).
Each SaveUserLastLogin* callsite writes to the field that matches its semantic.
The LastLogin column stays as-is for one release as a synthetic MAX(last_dashboard_login, last_device_auth) so existing API consumers don't break.
The JWT-extractor falls back to the token's iat claim if last_login is empty or unparseable — iat is a standard JWT claim and a reasonable proxy for "when this session started".

This is a meaningful change (DB migration on users, API schema, and a coordinated dashboard-repo update), so I'd appreciate maintainer signal on whether this is worth a PR before opening one. Happy to scope it to a smaller increment if a partial fix would land more easily — e.g. just the MAX() comparison in SaveUserLastLogin plus the iat fallback would already make the symptom much rarer without a schema change.

@MichaelUray commented on GitHub (May 9, 2026): After re-tracing this in the current codebase I want to share what I found, partly to settle the "what does this field actually mean" thread and partly so any future fixer doesn't have to repeat the archaeology. ## What `User.LastLogin` actually contains The field is updated by **three** different code paths with **different semantic meanings**, all writing to the same column: ### 1. JWT IdP claim — dashboard *or* device auth [`management/server/user.go:240`](https://github.com/netbirdio/netbird/blob/main/management/server/user.go#L240) inside `GetUserFromUserAuth`: ```go err = am.Store.SaveUserLastLogin(ctx, userAuth.AccountId, userAuth.UserId, userAuth.LastLogin) ``` `userAuth.LastLogin` is parsed from the JWT's `last_login` claim by [`shared/auth/jwt/extractor.go:116`](https://github.com/netbirdio/netbird/blob/main/shared/auth/jwt/extractor.go#L116). This runs on **every** authentication that goes through the JWT middleware — both dashboard logins and gRPC device logins. The struct comment in [`types/user.go`](https://github.com/netbirdio/netbird/blob/main/management/server/types/user.go) says *"LastLogin is the last time the user logged in to IdP"*, but the value comes from a custom `last_login` claim that most IdPs do **not** set automatically: - Keycloak's standard claim for authentication time is `auth_time`, not `last_login`. Without explicit mapper configuration, `last_login` is missing or stale. - Auth0 needs an Action / Rule to populate this claim. - Dex passes through whatever the upstream IdP issued. When the claim is missing or unparseable the extractor falls back to zero-time, and `SaveUserLastLogin` then short-circuits without saving (see below). There is an explicit TODO comment in the same function acknowledging the next problem: > *"this code should be outside of the am.GetAccountIDFromToken(claims) because this method is called also by the gRPC server when user authenticates a device. And we need to separate the Dashboard login event from the Device login event."* ### 2. New peer added by user [`management/server/peer.go:811`](https://github.com/netbirdio/netbird/blob/main/management/server/peer.go#L811): ```go case addedByUser: err := transaction.SaveUserLastLogin(ctx, accountID, userID, newPeer.GetLastLogin()) ``` Adding a new peer (`netbird up` on a fresh device) writes the **peer's** registration timestamp into `User.LastLogin`. ### 3. Expired peer re-authenticated [`management/server/peer.go:1203`](https://github.com/netbirdio/netbird/blob/main/management/server/peer.go#L1203) inside `handleExpiredPeer`: ```go err = transaction.SaveUserLastLogin(ctx, user.AccountID, user.Id, peer.GetLastLogin()) ``` Whenever a peer's session expires and the user re-authenticates that peer, the **peer's** new login timestamp lands in `User.LastLogin`. ## Save logic always overwrites [`management/server/store/sql_store.go:2731`](https://github.com/netbirdio/netbird/blob/main/management/server/store/sql_store.go#L2731): ```go func (s *SqlStore) SaveUserLastLogin(...) error { // ... if !lastLogin.IsZero() { user.LastLogin = &lastLogin return s.db.Save(&user).Error } return nil } ``` No `MAX(existing, new)` comparison. The field is **always overwritten**, even if the new value is older than the existing one. This is the smoking gun for the user-visible symptom in this issue: a JWT carrying a stale `last_login` claim can silently roll the displayed timestamp **backwards**, hiding the more recent dashboard or peer event. ## So what does the dashboard actually display? The latest of: - whatever the IdP put into the JWT's `last_login` claim (if anything) - the registration timestamp of the most recently added peer - the re-auth timestamp of the most recently expired-and-renewed peer …minus any older value that happened to overwrite it. The label "Last Login" suggests a clear semantic, but in practice the field is **multi-source with no ordering guarantee**. ## Why dashboard re-login appears not to update it For the symptom in the issue ("logged out and logged in, no update") the most likely chains, ranked by how often I've seen them in self-hosted setups: 1. **IdP doesn't populate the `last_login` claim on token issuance.** No claim → zero-time → `SaveUserLastLogin` no-ops. The field stays at whatever the most recent peer event wrote. 2. **IdP populates the claim with session-start time, not token-issuance time.** The session was started before the most recent peer event → the JWT carries an older timestamp → silent rollback. 3. **Active peer keep-alive overwrites with peer's last-seen.** This shouldn't happen on the standard paths shown above (the three call sites are all explicit user/peer auth events, not periodic keep-alives), but it's worth verifying for setups where peer expiration is configured aggressively. ## Suggested fix direction (open for discussion before I send a PR) A clean fix would split the field by source rather than try to reconcile sources: - New columns `users.last_dashboard_login` and `users.last_device_auth`. Dashboard UI shows the right one in the right context (and either field can be exposed in the API alongside the existing `last_login` for backwards compat). - Each `SaveUserLastLogin*` callsite writes to the field that matches its semantic. - The `LastLogin` column stays as-is for one release as a synthetic `MAX(last_dashboard_login, last_device_auth)` so existing API consumers don't break. - The JWT-extractor falls back to the token's `iat` claim if `last_login` is empty or unparseable — `iat` is a standard JWT claim and a reasonable proxy for "when this session started". This is a meaningful change (DB migration on `users`, API schema, and a coordinated dashboard-repo update), so I'd appreciate maintainer signal on whether this is worth a PR before opening one. Happy to scope it to a smaller increment if a partial fix would land more easily — e.g. just the `MAX()` comparison in `SaveUserLastLogin` plus the `iat` fallback would already make the symptom much rarer without a schema change.

saavagebueno commented

2026-08-05 01:18:44 -04:00

@JasmeowTheCat commented on GitHub (Jul 27, 2026):

Still present on v0.75.0 (combined netbird-server image, dashboard v2.90.7), so this isn't migration-related — I'm on SQLite, never migrated to PostgreSQL, using the embedded Dex IdP with an upstream Authentik OIDC connector and localAuthDisabled: true.

Useful detail for triage: the login is definitely being processed. In the same login that left last_login untouched, JWT group sync ran and added a new group to users.auto_groups:

sqlite> select id, name, issued from "groups" where name like '%Game%';
d9jv1t32tu3s34dklf40|GameServer: Client|jwt

sqlite> select datetime(last_login) from users where id='abc';
2026-07-12 18:49:12

So the authentication path works and writes group changes, but the last_login update is either never issued or gated on a code path the embedded-Dex setup doesn't reach. Peer last_login values update correctly — this looks specific to the user record.

@JasmeowTheCat commented on GitHub (Jul 27, 2026): Still present on v0.75.0 (combined netbird-server image, dashboard v2.90.7), so this isn't migration-related — I'm on SQLite, never migrated to PostgreSQL, using the embedded Dex IdP with an upstream Authentik OIDC connector and localAuthDisabled: true. Useful detail for triage: the login is definitely being processed. In the same login that left last_login untouched, JWT group sync ran and added a new group to users.auto_groups: sqlite> select id, name, issued from "groups" where name like '%Game%'; d9jv1t32tu3s34dklf40|GameServer: Client|jwt sqlite> select datetime(last_login) from users where id='abc'; 2026-07-12 18:49:12 So the authentication path works and writes group changes, but the last_login update is either never issued or gated on a code path the embedded-Dex setup doesn't reach. Peer last_login values update correctly — this looks specific to the user record.

Sign in to join this conversation.

Branches Tags

main

proxy-activity-tracking

feature/android-client-ssh

feat/agent-network-per-account-serving

fix/custom-domain-validation

hardening/custom-domain-followups

feat-post_quantum_ml_kem

anonymize-level

embedded-vnc

mdm_integration

debug-ui-memprofile-lazy-windows

refactor/ui-lazy-windows

add-atomic-cache-ops

debug-ui-memprofile

fix/wails-go-vendor

relay_transport_down_no_offer_storm

revert/component-types

wins_nrpt_dns_delegation

dependabot/github_actions/actions-a940c7c866

fix/quickstart-subnet-and-domain-alias

notification-localization

ssh-settings-elevation

refactor/peer-event-bus

fix/relay-proxy-redirect-when-ice-active

claude/agent-network-test-cases-p743vw

android/gui-integration

ice-stun-wg-demux

dependabot/npm_and_yarn/proxy/web/npm_and_yarn-b39864987c

agent-network-setup-poc

dependabot/go_modules/aws-sdk-8f849ebaed

dependabot/go_modules/otel-e34c790afd

dependabot/go_modules/testcontainers-de325c0dd6

dependabot/go_modules/wireguard-dbd6b95108

dependabot/go_modules/pion-5f703e1eca

dependabot/go_modules/gorm-2271c8195b

fix-login-needed-check

dependabot/go_modules/google.golang.org/grpc-1.82.1

revert/component-types-hookup

feature/ios-ssh

docs/agent-network-docs-update

dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/s3-1.106.3

dependabot/go_modules/github.com/pion/stun/v3-3.1.5

fix-ssh-authorized-users-multi-rule

peer-acl-multi-source

reverse-proxy-crowdsec-appsec

reverse-proxy-allow-match-or

client-local-metrics

lazy-conn-per-peer

lazy-conn-rosenpass

dependabot/go_modules/github.com/gopacket/gopacket-1.7.0

dependabot/go_modules/goauthentik.io/api/v3-3.2026050.6

dependabot/go_modules/github.com/pires/go-proxyproto-0.15.0

dependabot/go_modules/github.com/jackc/pgx/v5-5.10.0

dependabot/go_modules/github.com/oapi-codegen/runtime-1.6.0

dependabot/go_modules/github.com/eko/gocache/lib/v4-4.2.4

dependabot/go_modules/github.com/pkg/sftp-1.13.11

dependabot/go_modules/github.com/coreos/go-oidc/v3-3.20.0

ssh-windows-privilege-check

fix/explicit-cors-handling

fix/remove-math-rand

test/gui-memory-leak-fix

fix/ui-status-dispatch

install-script-ui-dependencies

fix/grpc-get-network-map

fix/subscribe-status-coalesce

fix/tray-menu-item-leak

fix/windows-tray-race

feature/changeset

worktree-dns-route-qtype-fallthrough

mlsmaycon-patch-2

feat/agent-network-ollama

proxy-tunnel-cache-ttl-env

coderabbitai/utg/1e5b0a5

grpc-acl

test/battery-drain

components-impl-drop-indexes-use-xids-no-resource-policy-map

fix/nmap-relevant-groups

e2e-guardrail-blocks-unselected-model

fix/lazyconn-cold-start-allowed-ips

vertex-guardrails-model-access-e2e

refactor/relay-foreign-cache

ci/trigger-release-tests

feature/kimi-3-agent-networks-dns-warmup

feature/dns-lazy-conn-warmup

daemon-ipc-acl

feature/ui-translation-key-parity-check

refactor/relay-foreign-cache-tests

fix/lazyconn-idle-keep-wg-peer

dmitri-propagate-auth-grant-types-on-combined

0.74.7-branch

diagnose-empty-vs-corrupt-state

windows-sleep-detector

fix/cli-up-wait-for-daemon

rp_key_persistency

feature/native-grpc

0.74.6-branch

0.74.6-branch-sync

0.74.5-branch-sync

0.74.4-branch

fix/remove-stale-peers-removal

fix/remove-stale-proxy-logic

fix/nsis-preserve-autostart-on-upgrade

dependabot/go_modules/goauthentik.io/api/v3-3.2026050.3

dependabot/go_modules/github.com/pkg/sftp-1.13.10

components-impl-drop-indexes

fix-reset-aggregation-window-flake

dependabot/go_modules/github.com/pion/dtls/v3-3.1.5

0.74.x

fix/relay-states-lock

update-process-pkg

update-gopsutil-v4

fix/relay_states_lock

increase-sysinfo-timeout

dependabot/go_modules/github.com/Azure/go-ntlmssp-0.1.1

dependabot/go_modules/github.com/eko/gocache/store/redis/v4-4.2.6

dependabot/go_modules/github.com/eko/gocache/lib/v4-4.2.3

fix/fail-to-create-upnp-port-mapping-on-opnsense-firewall

0.74.3-branch

fix/routeselector-atomic-exit-node

netmap_progressive_alignment

nmap/components-impl

dependabot/go_modules/github.com/jackc/pgx/v5-5.9.2

dependabot/go_modules/github.com/oapi-codegen/runtime-1.4.2

dependabot/go_modules/github.com/gopacket/gopacket-1.6.1

dependabot/go_modules/github.com/coreos/go-oidc/v3-3.19.0

dependabot/go_modules/github.com/pires/go-proxyproto-0.12.0

fix/signal-watchdog-sync-stop

docs/agent-network

test/affected-logic

fix/revert-ice-filter

refactor/simplify-affected-peers

pascal-filter-policies-by-direction

claude/lock-contention-peer-connect-g8t6au

dmitri-filter-policies-by-direction

refactor/migrate-profiles-to-go

profile-bindings-ios

fix/skip-restart-unchanged-route

fix/mgmt-cache-async-resolve

refactor/wails-update-105

client_lifetime_serialization_refactor

fix/browser-ssh-2

fix/ipv6-and-netstack-accept-loop

fix/browser-ssh

profile-id-name-test

refactor/mgmt-bootstrap

feat/getting-started-unified-wizard

socket-grpc-permissions

fix/mysql-index-migration

windows-dns-firewall

tests/enable-race-on-tests

ui-refactor-gtk3

feature/affected-peers-grpc

profile-id

lazyconn-first-packet-fix-v2

claude/focused-gates-VMTgb

ui-tray-linux-leftclick

fix/ctx-enrichment

daemon-owner

worktree-accept-ra-forwarding

nmap/combined-deploy

task/align_protobuff_toolset

feature/session-extend

add-json-yaml-flags

refactor/ephemeral-cleanup

claude/webtransport-relay-wasm-mUjY9

claude/vnc-udp-feasibility-6KB1U

fix/wgport-config

e2e-windows-dns-combined

fix/login-cmd-root-flags

feat/reseller-openapi-spec

github-issue-resolver

add-steamos-support

fix-darwin-uninstaller

flutter-test

ci/freebsd-pkg-bootstrap

cached-serial-check-on-sync

fix-mgmt-cache-bypass-overlay

revert-easyjson-5938

revert-ice-5820

revert-firewalld-5928

refactor/permissions-manager

revert-dns-5935-systemd-resolved

revert-dns-5935-5945

revert-dns-5945-mgmt-cache

feature/log-most-busy-peers

prototype/ui-wails

coderabbitai/utg/8ae8f20

feature/use-peer-fqdn-on-https

release/0.68.3

add-slack-channel

claude/rdp-token-passthrough-eNcqW

transparent-proxy

fix/macos-stale-route-eexist

crowdsec-selfhosted

fix/remove-otel-units

entire/checkpoints/v1

fix/getting-started

feat/static-connectors-combined-server

feature/use-local-keys-embedded

feature/fleetdm

set-env-only-if-not-fork

feature/expose-has-channel

fix/connection-status-race

fix/filter-cgnat-cni-ice-candidates

feature/check-cert-locker-before-acme

test/proxy-fixes

test/proxy-mtu

prototype/ui-tauri

test/proxy-speed

fix-reused-ports

feat/migrate-to-embedded-idp

feature/add-serial-to-proxy-merged

deploy/proxy-serial

test/connection

feature/disable-legacy-port

feature/flag-to-disable-legacy-port

test/perftest

fix/http-redirect

poc-token-command

dn-reverse-proxy

prototype/reverse-proxy-rename

prototype/reverse-proxy-logs-pagination

feature/client-metrics

prototype/reverse-proxy-clusters

debug-dns-route

fix/win-dns-batch

add-extra-route-logs

job-stream-notify-disconnection-eof

deploy/secrets-manager

trigger-proxy-update

bug/update-ios-client-code-build-tags

sync-client-netmap-serial

log/conn-disconn

nmap/compaction-deploy

ci-win-test

feature/disk-encryption-check

wasm-debug

swap-dns-prio

fix/dex-config

feature/migrate-auto-groups-to-table

nmap/compaction

dex-nocgo-stub

feature/exclude-terraform-from-rate-limiting

test-freebsd

retries-refactor

coderabbitai/docstrings/b7e98ac

feat/integrate-zitadel

bug/ios-hanging-reconection

zitadel-idp

feat/network-map-serial

refactor/get-account-no-users

feat/auto-upgrade

feature/report-high-pat-id

feature/temporary-access-for-resource

fix/nmap-fwrules

dont-restart-dns

prototype/ui

update-gomobile

go-dns-for-ice

wasm-ldflags

test-ldflags

wasmbuild-test

feature/networks-s2s

vk/compare-nmaps

dbg/bothmaps

reorder-dns-shutdown

fix/relay-reconnection-race

fix/nmap-exitnodes

vk/debug/nmap-both

move-licensed-code

feat/better-daemon-connection-lost-message

feat/auto-update-2

test/timings

refactor/getaccount-raw

tests/nmap-getaccount

refactor/nmap

refactor/nmap-limit-buffer

feature/detect-mac-wakeup

feature/extract-modules

quick-setings

feat/sync-limiter

feature/store-cache-impl

fix-install-version

feature/store-metrics

feature/metrics-on-store

feature/use-gorm-cache

loadtest-signal

unsymmetrical-squash

refactor/reducate-signaling

test/update-reduce

feature/store-cache

feature/remote-debug

cli-ws-proxy-backend-addr

feat/mgmt-map-serial

snyk-fix-d9d0081a4c7f9137bdb59d0d50a141a2

snyk-fix-7415cea5a11acd66753540ca2c598c63

job-yml-update

feature/android-allow-selecting-routes

fix/up-sequence

fix/dns-hash-update

snyk-fix-967adae9863f17f108ce8948d9117b8d

log/getaccount-by-peer

signal-suppressor

dns-exit-node

feature/auto-updates

feature/cache-srv-key

merged-fixes

fix/missed-offers-and-debug

debug-and-fixes

poc-wasm-clean-backend-s2s

test/remote-debug

debug-api

fix/remove-gpo-if-empty

fix/test-freebsd

fix/mysql-setup

fix/remove-logout-btn

handle-existing-domain-user

chore/unify-domain-validation

snyk-fix-c5fafc8a50ce1f29046e25a1fc346185

feat/profile-edit-btn

snyk-fix-a54966211e18d4cf67e5a2757cc006d1

log-short-id

feat/logout-ephemeral

log-checks

batch-wg-ops

nb-interface-default

feat/aws-integration

add/race-test

feature/relay-feature-versioning

fix/systemd-service-logs

poc/preprocessed-map

add-account-onboarding

bind-ipv6

fix/merge-main

logs/peerlogs-addpeer

feature/net-297-network-migration

feature/support-skip-auto-apply-exit-node-routes

set-cmd

set-command-with-cursor

feature/limit-update-channel

stop-using-locking-share

feature/poc-lazy-detection

feature/net-248-removal-of-sync-mutex-locks

test/multiple-peer-logging

preresolve

add-ns-punnycode-support

apply-routes-early

windows-search-domains

fix/connecting-route-filter

feature/management/rest-client/impersonate

debug-local-records

resource-fields-snake-case

test/grpc-rate-limit

traffic-correlation-policy

feature/rest-client-options

feat/events-metrics

feature/buf-cli

test/add-ratelimiter

test/remove-write-lock-on-add-peer

fix/add-peer-semaphore

feature/users-roles-endpoint

mlsmaycon-patch-1

debug-user-role

chore/primary-key-on-networks

feature/update-account-peers-buffer-startup

remove-ubuntu2004-runners

refactor/permissions-no-pat-allowed

ref/logrus-factory

use-conntrack-zone

deploy/permissions-account

feature/lazy-connection-idle

ref/improve-test-cov

restore-pr-3440

test/increase-grpc-timeouts

feat/buffer-account-peers-update

test/networkmapgeneration-changes

feature/base-manager

feature/flow-receiver

chore/benchmark-with-large-runner

refactor/handshake-initiator

client/ui-update-systray-icons

userspace-router

wgwatcher-test

output-if-key-already-exists

fix/relay-reconnection

feature/port-forwarding-client-codecleaning

detached2

test/callbacks-nil-iceconninfo

refactor/optimize-peer-expiration

enable-udp-port-for-docker-template

fix/relay-update

feature/apply-posture-netmap

fix/group-update-existing-resource

conntrack-stats

upgrade-okta-sdk

multi-price

test/conn-stat

set-min-parallel-tests-for-management

dns-interceptor

debug-dns

router-dns

add-static-system-info

debug-0.29.4

debug-0.33.0

account-refactoring

relay/2800_quic

route-get-account-refactoring

test/seed-random-routes

feature/get-account-refactoring

test/reconnect-race-condition

refactor/get-account-usage

feature/add-session-id-to-update-channel

improve-ipv4conn

fix/async-pion-event-handling

debug

add-offload

feature/validate-group-association-debug

fix/limit-conn-for-sqlite

test/engine-iface

test/transaction-for-jwt-sync

fix/engine-stop-in-foreground

feature/add-mysql-support

test-migration

refactor/header-size-values

relay/eliminate-gob

test/signal-dispatcher-with-relay

relay/debug

validate-icon

feature/ipv6-support

use-pre-expanded-peers-map

feature/use-signal-dispatcher

validate/peer-status

add-read-write-times

fix/sync-peer-race

feature/relay-status

netmap

evaluate/network-map-hash

fix/lower-dns-resolve-interval-on-fail

feature/relay

fix/go-mod-version

upgrade-nftables

synology-userspace-mode

fix/use-ip-for-default-routes-on-darwin

fix/proxy_close

enable-release-workflow-on-pr

deploy/peer-performance

feature/permanent-turn

feature/permanent-turn-proxy

deploy/posture-check-sqlite

feature/optimize_sqlite_save

debug-ios-behavior

fix/delete-route-only-after-adding

tshoot/windows-logger

remove-new-routing

refactor/eliminate-repo-dependency

add-arm-to-ci

refactor-demo-account-object

test/abc2

test/abc

send-ssh-rosenpass-config-meta

refactor-demo

ensure-schedule-never-runs-non-positive

feature/peer-validator-groupmgm

feature/peer-validator-fix

fix/include-active-dashboard-users

fix/handle-canceling-schedule

fix/geo-download

debug-google-workspace

yury/resolve-ip-to-location

feature/extend-sysinfo

sqlite-async-peer-status

yury/add-postgresql-store

fix/route

test-build

posture-checks-poc

debug-keycloak-idp

poc/netstack

for-pascal-tmp

peer-logout-management

manual-peer-logout

detached

chore/refactor-management

test/dns-bind

fix/enforce-acl-for-containers

yury/use-sync-map-in-updatechannel

fix/events-key-handling

filter-cache-on-load-account

fix/user-expiration

handle-user-context-cancellation

nb-client-k8s-statefulset

fake-addr

fix/iptables_in_docker

ebpf-debug

update-getting-started-flow-use-postgres

fix/peer_list_notification

feature/device-authentication-with-client-secret

feature/keep_alive

feat-groups-from-jwt

separate_proxy_from_wgconfig

fix/wg_conn

wg_conn_fix

wg_bind_parallel_processing

fix-rollback-get-acls

proxy_cfg_cleanup

performance-improvement-rego

update-lock-log-level

feat-client-side-acl

refactor/move_grpcserver_logic_to_account_manager

feature/event-storage

feature/update-idp-redeeming-invite

feature/api-peer-info

return-groupminimum-setupkey

feature/interface-bind

documentation_enhancement

fix-peer-registration

ssh

users_cache

pass-client-caller

client_caller_type

revert-283-feat-fix-windows-installer

periodic-peer-updates

ebpf

braginini/wasm

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: DYNR/netbird#8583

[GH-ISSUE #4387] Last Login Date/Time for User gets not updated #8583

What User.LastLogin actually contains

1. JWT IdP claim — dashboard or device auth

2. New peer added by user

3. Expired peer re-authenticated

Save logic always overwrites

So what does the dashboard actually display?

Why dashboard re-login appears not to update it

Suggested fix direction (open for discussion before I send a PR)

What `User.LastLogin` actually contains