Disabled users in ActiveDirectory still active on confluence/jira

Question

Hi,

When I disable a user on my ActiveDirectory, and after jira or confluence does the synchronisation, the user still exists and active in jira and confluence.

My question is: how does Jira/Confluence manage disabled users ? in which cases it deletes/disables the users ?

(btw the users I disable have userAccountControl:66050, and also tried to set them as expired+disabled, but it changes nothing.)

Appreciate your help.

Thank you

Davin Studer · Answer

This is how mine is set up.

(&(objectCategory=Person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(memberOf=CN=confluence-users,OU={path},OU={to},OU={org unit},DC={domain},DC={ext}))

Yahya M · Answer

Hi Davin,

Thank you for the answer.

I've tried this (include only normal account "512" and exclude disabled "2"):

(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=512)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

but it deletes other users that are not disabled on AD, still don't know why only some users was deleted (maybe they are not normal ? an example of userAccountControl that was deleted have 66080 as value). and it even caused a problem when I've added the deleted users, I found that they no longer belong to "jira local groups" where the were before.

I think your second solution, cannot be automatized (at least easily), and I should manually move those disabled users, correct me if I'm wrong.

Davin Studer · Answer

If you want the user to disappear from the system you would need to add this to your User Object Filter. This will only sync users that are active in AD.

userAccountControl:1.2.840.113556.1.4.803:=2

If instead you want the user to still exist but not take up a license you would need to make sure they are no longer in a group that has the "can use" permission. So by default that is the conflunce-users group. Move them out of that group and maybe into another group that does not have "can use". Or even just remove them from groups all together so that they do not have "can use".