Is there a way to automate deactivation of accounts based on "last login" time in JIRA?

[Jasen Sparacino]

We just connected jira to crowd and in the process of getting evertyhing cleaned up I have noticed that we have a bunch JIRA internal accounts that we can't delete. I want to deactivate them so they don't count against our license.

[Henning Tietgens · Accepted solution]

You could implement a Script Runner service which

1. searches for all active users where the last login is more than x days old and
2. deactivate these users.

With the following code you'll find all users which didn't login for one year and deactivate these users.

import com.atlassian.crowd.embedded.api.CrowdService
import com.atlassian.crowd.embedded.api.User
import com.atlassian.crowd.embedded.api.UserWithAttributes
import com.atlassian.crowd.embedded.impl.ImmutableUser
import com.atlassian.jira.bc.user.UserService
import com.atlassian.jira.component.ComponentAccessor
import com.atlassian.jira.user.util.UserUtil
import org.apache.log4j.Level
import org.apache.log4j.Logger

Logger log = log
log.setLevel(Level.INFO)

int numOfDays = 365 // Number of days the user was not logged in
Date dateLimit = (new Date())- numOfDays

UserUtil userUtil = ComponentAccessor.userUtil
CrowdService crowdService = ComponentAccessor.crowdService
UserService userService = ComponentAccessor.getComponent(UserService.class)
User updateUser
UserService.UpdateUserValidationResult updateUserValidationResult

long count = 0

userUtil.getUsers().findAll{it.isActive()}.each {
    UserWithAttributes user = crowdService.getUserWithAttributes(it.getName())
    String lastLoginMillis = user.getValue('login.lastLoginMillis')
    if (lastLoginMillis?.isNumber()) {    
        Date d = new Date(Long.parseLong(lastLoginMillis))
        if (d.before(dateLimit)) {
            updateUser = ImmutableUser.newUser(user).active(false).toUser()
            updateUserValidationResult = userService.validateUpdateUser(updateUser)
            if (updateUserValidationResult.isValid()) {
                userService.updateUser(updateUserValidationResult)
                log.info "Deactivated ${updateUser.name}"
                count++
            } else {
                log.error "Update of ${user.name} failed: ${updateUserValidationResult.getErrorCollection().getErrors().entrySet().join(',')}"
            }
        }
    }
}
"${count} users deactivated.\n"

Be aware that there may be users which didn't login at all, e.g. if you use users to "emulate" teams or for automated tasks. These users have to be filtered by your code.

Henning

[Jasen Sparacino]

Ugh.. Sorry for the incomplete post. The script buy Henning worked great. It did not deactivate users with "Not recorded" in their login details. If you have a bunch of automated users this isn't a bad thing.

[Jasen Sparacino]

The script by

[Greg Warner]

I have a script that moves them into a seperate jira group called jira-leavers using the API. This group has no access to JIRA but it means you're not tinkering with the database where very bad things could happen.

[Abhishek Singh]

Hello @Greg Warner ,

Can you please share the code.

Regards,

Abhi

[Bhushan Nagaraj]

You can write a scheduled SQL task that runs the query

UPDATE U 
SET U.active = 'F' 
FROM dbo.user AS U
INNER JOIN dbo.cwd_user_attribute AS A 
       ON R.id = A.user_id 
WHERE A.lastAuthenticated < '<your required datetime in unix time format>'

[Andrzej Pasterczyk]

There's no easy way for this. You could implement a plugin using JIRA API in Java or maybe with REST API but it's probably more effort than you'll gain out of it.