Set inactive User to "Unknown User"

Question

I have the requirement to make inactive users anonymous in issue view.

The Users are managed and synchronised by LDAP and are correctly set to inactive state. Renaming the users name in the external user repository doesn't have affect on the username in Jira. Is this because the user is already is set to inactive?

Atlassian Confluence handles inactive users as "Unknown User" (only in the frontend, in the admin area I still see the original name), This is the desired bavaviur in our case for Jira too. But Jira shows still the users real name for inactive users.

Is there any possibility to configure this bahaviour, so that the user  is shown as "Unknown User" in issues?

Andy Heinzer · Answer

Hi Patrick,

I understand that you have the need to anonymous some inactive user data within Jira server.  I suspect this could be due to the GDPR regulations.  If that is the case, I would recommend checking out our guide in Server and Data Center GDPR support guides and more specifically the page on JIRA: Right to erasure.

That second link has specific steps you can follow to make sure that this user data has been sufficiently anonymized to comply with the regulation.  However I do not believe this will allow you to have Jira behave the way you have described Confluence behaving in this way.  Instead this user identifiable data is being completely removed from the SQL database itself that Jira is using.

External user directory

These steps should be performed if your JIRA instance uses an external user directory.

There are 2 options that you can take to remove a user's PD, either modify the details to something anonymous, or delete the user completely:

* Modify the user's PD in the external directory:* Modify the user's PD and disable their user account in the external directory.
* Synchronize the external directory with JIRA.

* Delete the user's PD from an external directory* Follow the steps from Modify the user's PD in the external directory above. Right now user data in JIRA should be updated (synchronised) with the data from external directory, and user account should be inactive.
* Find and delete the user from the external directory.
* Synchronize the external directory with JIRA.
* At this point 2 things can happen:* If the user has not created any issues, and they're not the reporter, creator or assignee of any issues, then they will be deleted and removed from the user list.
* If the user has at least one comment or there is at least one issue that user is reporter/creator/assignee, then the user will be deactivated.

To answer you first question

Is this because the user is already is set to inactive?

Yes that is one possibility.  When Jira is syncing user accounts from an LDAP, disabling the user account in LDAP will also mark the user as inactive in Jira, but moving forward beyond that changes to the user object such as account renames are not typically going to be synced over of inactive accounts.

In addition to that limitation, the configuration of the external directory within Jira also uses a User Unique ID Attribute in order to track changes to usernames.  Depending on the type of LDAP this attribute could be different between the different LDAP flavors, such as objectGUID for MS Active Directory or entryUUID for OpenLDAP.  That attribute is expected to remain unchanged within the LDAP service throughout the life of the account.  So you should be able to temporarily enable the account in LDAP, and make the change to the account name (such as unknownuser12345), sync Jira to see this change, and then you can disable the account once more.   If the Unique User ID attribute is set incorrectly, then when you make a change to the username in LDAP and sync to Jira, Jira will see that username as a new account instead of treating the change in LDAP as a rename of the account in Jira.

I hope this helps, let me know if you run into any problems with these steps.

Andy