Determining native login using password

[W_Carey]

I have been attempting to determine when a user last logged into SeviceNow using a password. I've checked the Events list, using login, but it doesn't differentiate if a person logged in native (with password) or SSO. Can anyone help me determine these users in a list, report, using a script, etc. Your help is most appreciated.

[Swapna Abburi]

Hi @W_Carey 

If user authenticated successfully using SSO and logged into the instance, you will see two events associated with user ID. "external.authentication.succeeded" and "login". 

If user authenticated locally using user name and password, only "login" event is captured for the user.

you can verify the same from event log "sysevent" table. Parm1 field contains user ID and Name field contains the event name.

[jcmings]

There is a field on sys_user called "Last login time" but I don't know how to get more specific that that.