There are two possible root causes:
By design, the field CMN_SEC_USERS.last_logged_in_date is populated no matter the status of the user: active, inactive or locked.
This is because a process instance was initiated and ran under the user id.
SaaS Portal Customers
DE36540 - Last Logged In Date updated even though user is inactive or locked in Clarity for On Demand Portal Users
STEPS TO REPRODUCE
1. On an SSO system behind the portal create a user in the portal and in one of the CA PPM environment who is set up the following way:
- User has been added to the portal and is active.
- User has been added to CA PPM, but they are active.
- User has not been added to any environments
- User must also be configured in the SSO server so that they can access the portal/CA PPM
2. Go to the SSO landing page and attempt to log in as the user
NOTE: The user is not allowed into CA PPM as expected.
Expected Results: The user's last logged in date is not updated
Actual Results: The user's last logged in date is updated even though the user inactive or locked.
BEST PRACTICE: Users status in the portal and status in PPM should match to prevent several different problems. User activation and inactivation should be done via the portal and not PPM.