Scriptrunner deactivate inactive users

Michael_qy22gs

Hi all,

We are trying to keep our user licenses under control, and have found the following code within the ScriptRunner library:

import com.atlassian.jira.bc.JiraServiceContextImpl
import com.atlassian.jira.bc.user.UserService
import com.atlassian.jira.bc.user.search.UserSearchParams
import com.atlassian.jira.bc.user.search.UserSearchService
import com.atlassian.jira.component.ComponentAccessor
import com.atlassian.jira.user.ApplicationUser
import com.atlassian.crowd.embedded.api.CrowdService
import groovy.xml.MarkupBuilder

import java.time.LocalDateTime
import java.time.Instant
import java.time.ZoneId

def crowdService = ComponentAccessor.getComponent(CrowdService)

// Number of days the user was not logged in Date
def numOfDays = 30
def dateLimit = LocalDateTime.now().minusDays(numOfDays)

// Search all active users
UserSearchParams.Builder paramBuilder = UserSearchParams.builder()
.allowEmptyQuery(true)
.includeActive(true)
.includeInactive(false)

def jiraServiceContext = new JiraServiceContextImpl(ComponentAccessor.jiraAuthenticationContext.loggedInUser)
def allActiveUsers = ComponentAccessor.getComponent(UserSearchService).findUsers(jiraServiceContext, '', paramBuilder.build())

// Users which last activity is before than limit date
def usersToDelete = allActiveUsers.findAll { user ->
def userWithAtributes = crowdService.getUserWithAttributes(user.username)
def lastLoginMillis = userWithAtributes.getValue('login.lastLoginMillis')

if (lastLoginMillis?.number) {
def lastLogin = Instant.ofEpochMilli(Long.parseLong(lastLoginMillis)).atZone(ZoneId.systemDefault()).toLocalDateTime()
if (lastLogin.isBefore(dateLimit)) {
user
}
}
}

if (!usersToDelete) {
return 'No Idle users found'
}

def stringWriter = new StringWriter()
def content = new MarkupBuilder(stringWriter)

content.html {
p('Follow users deactivated ') {
ul {
usersToDelete.each {
user -> deactivateUser(user)
}*.username?.each { deactivated ->
li(deactivated)
}
}
}
}

stringWriter.toString()

def deactivateUser(ApplicationUser user) {
def userService = ComponentAccessor.getComponent(UserService)
def updateUser = userService.newUserBuilder(user).active(false).build()
def updateUserValidationResult = userService.validateUpdateUser(updateUser)

if (!updateUserValidationResult.valid) {
log.error "Update of ${user.name} failed. ${updateUserValidationResult.errorCollection}"
return
}

userService.updateUser(updateUserValidationResult)
log.info "${updateUser.name} deactivated"
}

This would work, but we would also like to ensure that none of our admins are ever "De-Activated" if they are working within other Jira instances that month.

Can anyone suggest a way to include multiple groups that are not "searched" for de-activation?

Thanks,

Mike

Ram Kumar Aravindakshan _Adaptavist_

Hi @Michael

For your requirement, you could try something like the below in the ScriptRunner console:-

import com.adaptavist.hapi.jira.groups.Groups
import com.adaptavist.hapi.jira.users.Users
import com.atlassian.jira.component.ComponentAccessor
import com.atlassian.jira.security.login.LoginManager 

def adminGroup = Groups.getByName('jira-administrators').members
def jiraUserGroup = Groups.getByName('jira-software-users').members
def jsmUserGroup = Groups.getByName('jira-servicedesk-users').members

def users = adminGroup + jiraUserGroup + jsmUserGroup
users.unique()

def loginManager = ComponentAccessor.getComponentOfType(LoginManager)

users.each {
    def username = it.username
    def active = it.active

    def lastLoginTime = loginManager.getLoginInfo(it.username).lastLoginTime

        if (!active || !lastLoginTime) {
            Users.getByName(username).deactivate()
        }
}

Please note that the sample code above is not 100% exact to your environment. Hence, you will need to make the required modifications.

The code above does a check for any inactive or users that have never logged in. If found they will be deactivated.

I hope this helps to solve your question. :-)

Thank you and Kind regards,

Ram