Login time of the user can be found in the session object of the user.
Retrieve over association the session of the user and check date value.
For the logout time, you need to build something on your own. But if you are using the session for the login time, you also need to store it in some logging object because the session gets destroyed when the user logs out.
The only problem is that you need to make sure that your users log out, if they only close the browser, they will also be logged out after a while but you will not have the exact logout time.