diff --git a/user/tests/behat/edituserpassword.feature b/user/tests/behat/edituserpassword.feature
index a1e4fcb6a14..485ac65daf7 100644
--- a/user/tests/behat/edituserpassword.feature
+++ b/user/tests/behat/edituserpassword.feature
@@ -1,8 +1,8 @@
 @core @core_user
-Feature: Enable/disable password field based on authentication selected.
+Feature: Edit a users password
   In order edit a user password properly
   As an admin
-  I need to be able to notice if the change in password is allowed by athuentication plugin or not
+  I need to be able to edit their profile and change their password
 
   @javascript
   Scenario: Verify the password field is enabled/disabled based on authentication selected, in user edit advanced page.
@@ -15,3 +15,36 @@ Feature: Enable/disable password field based on authentication selected.
     And the "New password" "field" should be enabled
     # We need to cancel/submit a form that has been modified.
     And I press "Create user"
+
+  Scenario: Sign out everywhere field is not present if user doesn't have active token
+    Given the following "users" exist:
+      | username | firstname | lastname | email              |
+      | user01   | User      | One      | user01@example.com |
+    And I log in as "admin"
+    When I navigate to "Users > Accounts > Browse list of users" in site administration
+    And I click on "User One" "link" in the "users" "table"
+    And I click on "Edit profile" "link"
+    Then "Sign out everywhere" "field" should not exist
+
+  @javascript
+  Scenario Outline: Sign out everywhere field is present based on expiry of active token
+    Given the following "users" exist:
+      | username | firstname | lastname | email              |
+      | user01   | User      | One      | user01@example.com |
+    And I log in as "admin"
+    When I navigate to "Plugins > Web services > Manage tokens" in site administration
+    And I click on "Add" "link"
+    And I set the following fields to these values:
+      | User                | User One                  |
+      | Service             | Moodle mobile web service |
+      | validuntil[enabled] | 1                         |
+      | Valid until         | <validuntil>              |
+    And I press "Save changes"
+    And I navigate to "Users > Accounts > Browse list of users" in site administration
+    And I click on "User One" "link" in the "users" "table"
+    And I click on "Edit profile" "link"
+    Then "Sign out everywhere" "field" <shouldornot> exist
+    Examples:
+      | validuntil     | shouldornot |
+      | ## -1 month ## | should not  |
+      | ## +1 month ## | should      |
diff --git a/webservice/lib.php b/webservice/lib.php
index 5257640e944..b22d5198938 100644
--- a/webservice/lib.php
+++ b/webservice/lib.php
@@ -803,7 +803,7 @@ class webservice {
 
         $sql = 'SELECT t.*, s.name as servicename FROM {external_tokens} t JOIN
                 {external_services} s ON t.externalserviceid = s.id WHERE
-                t.userid = :userid AND (t.validuntil IS NULL OR t.validuntil > :now)';
+                t.userid = :userid AND (COALESCE(t.validuntil, 0) = 0 OR t.validuntil > :now)';
         $params = array('userid' => $userid, 'now' => time());
         return $DB->get_records_sql($sql, $params);
     }
diff --git a/webservice/tests/lib_test.php b/webservice/tests/lib_test.php
index 407556b0dda..efdd7dd8f55 100644
--- a/webservice/tests/lib_test.php
+++ b/webservice/tests/lib_test.php
@@ -193,6 +193,46 @@ class webservice_test extends advanced_testcase {
         $this->assertEquals($before + 60, $token->lastaccess);
     }
 
+    /**
+     * Data provider for {@see test_get_active_tokens}
+     *
+     * @return array
+     */
+    public function get_active_tokens_provider(): array {
+        return [
+            'No expiration' => [0, true],
+            'Active' => [time() + DAYSECS, true],
+            'Expired' => [time() - DAYSECS, false],
+        ];
+    }
+
+    /**
+     * Test getting active tokens for a user
+     *
+     * @param int $validuntil
+     * @param bool $expectedactive
+     *
+     * @dataProvider get_active_tokens_provider
+     */
+    public function test_get_active_tokens(int $validuntil, bool $expectedactive): void {
+        global $DB;
+
+        $this->resetAfterTest();
+
+        $user = $this->getDataGenerator()->create_user();
+
+        $serviceid = $DB->get_field('external_services', 'id', ['shortname' => MOODLE_OFFICIAL_MOBILE_SERVICE], MUST_EXIST);
+        external_generate_token(EXTERNAL_TOKEN_PERMANENT, $serviceid, $user->id, context_system::instance(), $validuntil, '');
+
+        $tokens = webservice::get_active_tokens($user->id);
+        if ($expectedactive) {
+            $this->assertCount(1, $tokens);
+            $this->assertEquals($serviceid, reset($tokens)->externalserviceid);
+        } else {
+            $this->assertEmpty($tokens);
+        }
+    }
+
     /**
      * Utility method that tests the parameter type of a method info's input/output parameter.
      *