Currently logged in users Session details from JIRA through postgresql/REST API

Question

Is there any way to get the Currently logged in users Session details from JIRA through postgresql/REST API by each node at any point of time ?

Also I am trying to get the user login details through postgresql but I am able to get only the Last Login Details using the below query.

SELECT d.directory_name AS "Directory",u.first_name AS "First Name",u.last_name AS "Last Name", u.user_name AS "Username", to_timestamp(CAST(attribute_value AS BIGINT)/1000) AS "Last Login" FROM cwd_user u JOIN (SELECT DISTINCT child_name FROM cwd_membership m JOIN licenserolesgroup gp ON m.parent_name = gp.GROUP_ID) AS m ON m.child_name = u.user_name  JOIN (SELECT * FROM cwd_user_attributes ca WHERE attribute_name = 'login.lastLoginMillis') AS a ON a.user_id = u.id JOIN cwd_directory d ON u.directory_id = d.id  ORDER BY "Last Login" DESC;

So please help/advise me, how to get the currently logged in users Session details in JIRA.

Thanks in advance...

Mauricio Karas · Accepted Answer

Hello there!

In the REST API documentation, there is nothing related to current logged users. On the GUI you can check the active users in System > User Sessions, I tried to see if there was a REST endpoint that could be used, but there is none. The client gets this "/secure/admin/CurrentUsersList.jspa" from the server, which returns a HTML page with the current sessions(you could parse the HTML).

I activated SQL logging to try to identify which queries were being made to get this information. There isn't so much clear information, but I was able to find out the "userhistoryitem" table that shows user activity.

The table shows the users activity with a timestamp in the "lastviewed" field, if you compare this to the session timeout which is usually 5 hours (check the session-timeout tag in $JIRA_INSTALL/atlassian-jira/WEB-INF/web.xml) you will know if the user is still logged in or not. Although the result information from this will not capture users that actually log out of the application using the logout button, which makes the data not 100% true.

Another option is to parse the information from the "atlassian-jira-security.log"(located in $JIRA_HOME/log). This log shows user activity and you can see when a user logs in and is logged out:

2018-06-26 18:13:35,413 http-nio-8080-exec-19 admin 1093x897x1 - 12.205.243.201,0:0:0:0:0:0:0:1 /rest/api/2/search The user 'admin' has PASSED authentication.

2018-06-26 18:14:41,165 ContainerBackgroundProcessor[StandardEngine[Catalina]] HttpSession [13l87aa] destroyed for 'admin'

------------------------

As you can see, there's no easy way to get this information without having to compare information and do some logic. Looking at Jira's source code I can see that an object of the class "JiraUserSessionTracker" is passed around and I believe it to be the holder of the user session information(the CurrentUsersList page uses it), so besides creating a plugin to get this, I don't see other more viable options.

Kind regards,
Maurício Karas