Bitbucket server: How to lock out a user safely without removing from user directory?

Question

Hi folks,

due to company security policies we have to ensure a safe lock out of users who left the company. On the other hand a simple deletion of the user is unwanted.

I run some tests and investigations. Removing an user from group shash-users seems not to be enough:

* only a new login attempt to web-ui is prevented. As long as the user stays logged in the user can continue using the Bitbucket server.
* ssh-based git activities seems not to be affected at all by removing user from shash-users

Conclusions:

* I see no safe approach to lock out an user from Bitbucket server immediately.
* To lock out a user safely it's needed to remove the user from group stash-users and remove all ssh keys of this user.

Questions:

* What are the best practise suggestions?
* How do you handle user management?
* Did I miss important details (or misunderstood the documentation)?

I highly appreciate every suggestion and answer.

Marko

Marko Schröder · Answer

Hi,

thank you for your answer. We are working on a LDAP integration. That creates some more questions (https://community.atlassian.com/t5/Bitbucket-questions/How-do-I-migrate-users-from-Bitbucket-server-internal-directory/qaq-p/973322) ;-)

I am curios how your LDAP integration works: Will a user be thrown out of Bitbucket web ui immediately, if you disbled the user in LDAP and run a LDAP-Bitbucket-sync? Does your LDAP integration also deletes possibly existing ssh keys of the user if user is disabled?

Best regards,
Marko

Julius Davies _GitBoost_com_ · Answer

Are you using the LDAP integration?   If you disable the user in your LDAP (e.g., Microsoft Active Directory - right click on user object, click "disable" - something like that), I think Bitbucket Server picks that up pretty quickly and disables the user in Bitbucket.

The nice thing about this approach:  it's very easy to reactivate the user, and Bitbucket also picks up the LDAP reactivation very quickly (typically within 5 minutes I believe).