tree 9a8d855f7b65e80436cfae55ac17633357946fd1
parent 80a280a847b9981a58c7b9c452568d474f4f30a1
author Dariusz Luksza <dariusz.luksza@gmail.com> 1709648636 +0000
committer Dariusz Luksza <dariusz.luksza@gmail.com> 1715638677 +0100

TrackActive: Automatically disable inactive accounts

Build on top of the `track-active-users-1.0` (already renamed to
`track-and-disable-inactive-users-1.0.groovy) script and add the
possibility of automatically disabling inactive accounts after
a preconfigured period.

The new functionality will mark inactive accounts that are not present
in `track-and-disable-inactive.users_cache`. The inactivity period can
be controlled by the `users_cache` `maxAge` configuration option.

To automatically disable users that are removed from `users_cache` we
register a `CacheRemovalListener` that will disable accounts as they
are evicted. Additionally, in case of explicit removal, the entry will
be re-added. This is to prevent full instance lockdown when
`users_cache` is flushed using the SSH command.

To test this feature, copy the
`admin/track-and-disable-inactive-users-1.0.groovy` into
`$gerrit_site/plugins` and add the following configuration to
`$gerrit_site/etc/gerrit.config`:

[cache "track-and-disable-inactive-users.users_cache"]
  maxAge = 1min

The `CacheRemovalListener` only fires, when the cache is updated. To
see any evictions, you would need at least two accounts in Gerrit and
make sure that one of them is constantly being used (eg. reloading the
web page). Eventually, you should see a log message saying that the
other account was disabled.

Bug: Issue: 327730872
Change-Id: I34974d842d6f73784d43932b587a6461eaf2ffae