@sleiman.sleiman You may group it by responsibility: Actions concerning CRUD in UsersController and actions concerning authentication layer in AuthController.
But take it as a suggestion, there are no strict rules and you're free to take your own path, that you find the easiest to follow.
Just mind that, if you go with RESTful resource controller UsersController, I would not consider ban, unban or other auth actions as Update in CRUD obviously.
Those 3 would probably go to the UsersController. Ban can be in the AuthController too if it makes sense depending on how you see it. You should check out some of the Auth packages on github and see where they put it.