Project

General

Profile

Actions

Bug #25479

closed

Users cleanup configuration is too strict on disabled users

Bug #25479: Users cleanup configuration is too strict on disabled users

Added by Clark ANDRIANASOLO about 1 year ago. Updated about 2 months ago.

Status:
Released
Priority:
N/A
Category:
Web - Maintenance
Target version:
Severity:
Minor - inconvenience | misleading | easy workaround
UX impact:
User visibility:
Operational - other Techniques | Rudder settings | Plugins
Effort required:
Very Small
Priority:
0
Name check:
To do
Fix check:
Checked
Regression:
No

Description

The current default is 60 days for the rudder.users.cleanup.account.disableAfterLastLogin configuration property : any user that did not log in a period of 60 days are disabled.
The disable reason is also empty in the users table (in the statushistory column) :

{"actor": {"name": "rudder"}, "reason": "", "actionDate": "2024-09-17T10:00:00.000Z"}, "status": "disabled"}

We should set it to a longer period of time by default : 90 days, because users should be able to leave a Rudder instance unused for a longer period of time, as demonstrated by some client use cases.
The configuration value should still be modifiable, and the never value should be a supported one (a documentation should be added in the configuration.properties.sample file).
Also, a known admin user should not be disabled.

We should also add a reason in the trace, e.g. "User did not login for too long" and log the disabling of users with a warning log (see also #25478).

Also, rudder.users.cleanup.account.deleteAfterLastLogin should only apply on already disabled users only (therefore the value of 120.days seems reasonable)

We should also update the doc and sample for the configuration parameters.


Subtasks 3 (0 open3 closed)

User management - Bug #25482: User cleanup configuration impact on user-managementReleasedFrançois ARMANDActions
Bug #25483: User cleanup configuration impact on user-management in 8.2ReleasedFrançois ARMANDActions
Bug #25490: User cleanup actions are logged every time even there is no change ReleasedFrançois ARMANDActions

Related issues 3 (0 open3 closed)

Related to Rudder - User story #23440: Add users table to better track user and sessionsReleasedVincent MEMBRÉActions
Related to Rudder - Enhancement #25478: Normalize authentication logsReleasedFrançois ARMANDActions
Related to Authentication backends - Bug #25458: All OIDC user are disabled at onceResolvedClark ANDRIANASOLOActions

Updated by Clark ANDRIANASOLO about 1 year ago Actions #1

  • Related to User story #23440: Add users table to better track user and sessions added

Updated by Clark ANDRIANASOLO about 1 year ago Actions #2

  • Description updated (diff)
  • Status changed from New to In progress
  • Assignee set to Clark ANDRIANASOLO

Updated by Clark ANDRIANASOLO about 1 year ago Actions #3

  • Description updated (diff)

Updated by Clark ANDRIANASOLO about 1 year ago Actions #4

  • Description updated (diff)

Updated by Clark ANDRIANASOLO about 1 year ago Actions #5

  • Description updated (diff)

Updated by Clark ANDRIANASOLO about 1 year ago Actions #6

Updated by Clark ANDRIANASOLO about 1 year ago Actions #7

  • Description updated (diff)

Updated by Clark ANDRIANASOLO about 1 year ago Actions #8

  • Status changed from In progress to Pending technical review
  • Assignee changed from Clark ANDRIANASOLO to François ARMAND
  • Pull Request set to https://github.com/Normation/rudder/pull/5880

Updated by Clark ANDRIANASOLO about 1 year ago Actions #9

  • Status changed from Pending technical review to Pending release

Updated by Clark ANDRIANASOLO about 1 year ago Actions #10

  • Subtask #25482 added

Updated by Clark ANDRIANASOLO about 1 year ago Actions #11

  • Subtask #25483 added

Updated by Clark ANDRIANASOLO about 1 year ago Actions #12

  • Subtask #25490 added

Updated by François ARMAND about 1 year ago Actions #13

  • Related to Bug #25458: All OIDC user are disabled at once added

Updated by Clark ANDRIANASOLO about 1 year ago Actions #14

  • Fix check changed from To do to Checked

It now works well with #25490 : the logs are clear and only disabled users are deleted.

There is a caveat on OIDC users : there roles are not known by Rudder, so they need to be declared as admin in the users file for them to not be disabled when the cleanup runs

Updated by Vincent MEMBRÉ about 1 year ago Actions #15

This bug has been fixed in Rudder 8.1.7 which was released today.

Updated by Vincent MEMBRÉ about 2 months ago Actions #17

  • Status changed from Pending release to Released
Actions

Also available in: PDF Atom