Project

General

Profile

Actions

Bug #25479

open

Users cleanup configuration is too strict on disabled users

Added by Clark ANDRIANASOLO 10 days ago. Updated 8 days ago.

Status:
Pending release
Priority:
N/A
Category:
Web - Maintenance
Target version:
Severity:
Minor - inconvenience | misleading | easy workaround
UX impact:
User visibility:
Operational - other Techniques | Rudder settings | Plugins
Effort required:
Very Small
Priority:
0
Name check:
To do
Fix check:
Checked
Regression:
No

Description

The current default is 60 days for the rudder.users.cleanup.account.disableAfterLastLogin configuration property : any user that did not log in a period of 60 days are disabled.
The disable reason is also empty in the users table (in the statushistory column) :

{"actor": {"name": "rudder"}, "reason": "", "actionDate": "2024-09-17T10:00:00.000Z"}, "status": "disabled"}

We should set it to a longer period of time by default : 90 days, because users should be able to leave a Rudder instance unused for a longer period of time, as demonstrated by some client use cases.
The configuration value should still be modifiable, and the never value should be a supported one (a documentation should be added in the configuration.properties.sample file).
Also, a known admin user should not be disabled.

We should also add a reason in the trace, e.g. "User did not login for too long" and log the disabling of users with a warning log (see also #25478).

Also, rudder.users.cleanup.account.deleteAfterLastLogin should only apply on already disabled users only (therefore the value of 120.days seems reasonable)

We should also update the doc and sample for the configuration parameters.


Subtasks 3 (3 open0 closed)

User management - Bug #25482: User cleanup configuration impact on user-managementPending releaseFrançois ARMANDActions
Bug #25483: User cleanup configuration impact on user-management in 8.2Pending releaseFrançois ARMANDActions
Bug #25490: User cleanup actions are logged every time even there is no change Pending releaseFrançois ARMANDActions

Related issues 3 (1 open2 closed)

Related to Rudder - User story #23440: Add users table to better track user and sessionsReleasedVincent MEMBRÉActions
Related to Rudder - Enhancement #25478: Normalize authentication logsPending releaseFrançois ARMANDActions
Related to Authentication backends - Bug #25458: All OIDC user are disabled at onceResolvedClark ANDRIANASOLOActions
Actions #1

Updated by Clark ANDRIANASOLO 10 days ago

  • Related to User story #23440: Add users table to better track user and sessions added
Actions #2

Updated by Clark ANDRIANASOLO 10 days ago

  • Description updated (diff)
  • Status changed from New to In progress
  • Assignee set to Clark ANDRIANASOLO
Actions #3

Updated by Clark ANDRIANASOLO 10 days ago

  • Description updated (diff)
Actions #4

Updated by Clark ANDRIANASOLO 10 days ago

  • Description updated (diff)
Actions #5

Updated by Clark ANDRIANASOLO 9 days ago

  • Description updated (diff)
Actions #6

Updated by Clark ANDRIANASOLO 9 days ago

Actions #7

Updated by Clark ANDRIANASOLO 9 days ago

  • Description updated (diff)
Actions #8

Updated by Clark ANDRIANASOLO 9 days ago

  • Status changed from In progress to Pending technical review
  • Assignee changed from Clark ANDRIANASOLO to François ARMAND
  • Pull Request set to https://github.com/Normation/rudder/pull/5880
Actions #9

Updated by Clark ANDRIANASOLO 9 days ago

  • Status changed from Pending technical review to Pending release
Actions #10

Updated by Clark ANDRIANASOLO 9 days ago

  • Subtask #25482 added
Actions #11

Updated by Clark ANDRIANASOLO 9 days ago

  • Subtask #25483 added
Actions #12

Updated by Clark ANDRIANASOLO 8 days ago

  • Subtask #25490 added
Actions #13

Updated by François ARMAND 8 days ago

  • Related to Bug #25458: All OIDC user are disabled at once added
Actions #14

Updated by Clark ANDRIANASOLO 8 days ago

  • Fix check changed from To do to Checked

It now works well with #25490 : the logs are clear and only disabled users are deleted.

There is a caveat on OIDC users : there roles are not known by Rudder, so they need to be declared as admin in the users file for them to not be disabled when the cleanup runs

Actions

Also available in: Atom PDF