Confluence User Audit SQL

[MikeB]

I am working to audit our Confluence Server instance (5.10.3). I am needing to find out all the users who are set Active and have not signed in within the last 90 days

Below is the query we are working with, but unfortunetly it is not rendering the correct info. Would anyone be able to assist?

use confluence;

SELECT u.user_name, d.directory_name, l.successdate
FROM logininfo l
JOIN user_mapping m ON m.user_key = l.username
JOIN cwd_user u ON m.username = u.user_name
JOIN cwd_directory d ON u.directory_id = d.id
WHERE (successdate < '2017-03-03')
and u.active = 'T';

ORDER BY successdate;

[AnnWorley]

The following ran successfully on my PostgreSQL database and the results appeared valid:

SELECT u.user_name, d.directory_name, l.successdate
FROM logininfo l
JOIN user_mapping m ON m.user_key = l.username
JOIN cwd_user u ON m.username = u.user_name
JOIN cwd_directory d ON u.directory_id = d.id
WHERE (successdate > '2017-03-03')
and u.active = 'T'
order by successdate;

Are you getting an error message or an inaccurate result set?

[MikeB]

No error message, but the result set is a little odd. When we run that query, we are getting some overlap in intent - that is, some of the results that display are already deactivated.

From poking around a bit, it appears to be related to the user_name field in cwd_user having multiple active values (such as a user showing up 3 times with 2 "F's" and 1 "T" value).

Our instance is running on MySQL rather than PostgreSQL.

Are multiple active values in cwd_user common/to be expected, or can you tell us if this is unusual or indicative of anything we may need to address?

[MikeB]

Just noticed - we are using:

• (successdate < '2017-03-03') instead of > - the purpose of our audit is to deactivate users who have active accounts but haven't logged in within 90 days
• It looks like our results are ballpark correct, but not sure why multiple active values for accounts