Sample workflow to delete users from collibra who have not logged in for more than 3 months

Developers

I need a Sample workflow to delete users from collibra who have not logged in for more than 3 months.

Can anyone help on this?

mohammedsohailea73ba

Posted 4 years ago · Edited 1 year ago·Last reply 4 years ago

7 comments

arthurburkhardt

·4 years ago · Edited

This has not been tested, but it might look something like this. You can adjust the sample size to start with only a few users.

import com.collibra.dgc.core.api.dto.user.FindUsersRequest


def excludedUsers = ['67193aac-fb70-4006-9494-997e6d0ddd4b','528f662e-5c43-4164-8088-a7cb6ea33977']
def sampleSize = 500

userApi.findUsers(FindUsersRequest.builder().includeDisabled(true).build())
    .results.findAll{ !it.system && !excludedUsers.contains(uuid2String(it.id)) }[0..sampleSize].each{ user ->
		loggerApi.info("Delete user: ${user.userName}")
		userApi.removeUser(user.id)
	}

Ross Duval

·4 years ago · Edited

Hi all, we are undergoing the implementation phase of Collibra and I’m working through some of the security / functional requirements. Although not exact it seems a good tag to follow progress and thoughts.
We are using SSO and its the leavers aspect and setting this ‘disabled’ button. Does anyone have a solution or will it be an extract / API to set.
Have looked at seeing if a workflow could be written to append the surname with (" deactivated" to make it obvious if a user resides as an ownership type of ole - again the user source that is sent to ‘SSO’ prevents that aspect.
On the Licence front - in our system - all users are being set to Consumer. when created via SSO. If they are placed in a resource role , requiring author licence the ‘required licence’ changes accordingly f the user is then removed it returns back to Consumer. We are looking at a workflow to change the licence to align with ‘required licence’ and this housekeeping will ensure the author licences are kept in check.
Hope that helps and many thanks in advance for any ideas / solutions to evaluate.

arthurburkhardt

·4 years ago · Edited

The core APIs are usually pretty good, but in the case of users, it is lacking a few attributes. Specifically, you will not find the requiredLicense and the lastLogin attributes.
For this reason, I have implemented the outputModule instead of the core API, for users.

{
	"ViewConfig":{
		"Resources":{
			"User":{
                    "Id":                  {"name": "id"},
                    "LastLogin":           {"name": "lastLogin"},
                    "createdBy":           {"name": "createdBy"},
                    "createdOn":           {"name": "createdOn"},
                    "lastModifiedBy":      {"name": "lastModifiedBy"},
                    "lastModified":        {"name": "lastModifiedOn"},
                    "system":              {"name": "system"},
                    "userName":            {"name": "userName"},
                    "firstName":           {"name": "firstName"},
                    "lastName":            {"name": "lastName"},
                    "emailAddress":        {"name": "emailAddress"},
                    "language":            {"name": "language"},
                    "activated":           {"name": "activated"},
                    "enabled":             {"name": "enabled"},
                    "ldapUser":            {"name": "ldapUser"},
                    "userSource":          {"name": "userSource"},
                    "guestUser":           {"name": "guestUser"},
                    "apiUser":             {"name": "apiUser"},
                    "licenseType":         {"name": "licenseType"},
                    "requiredLicenseType": {"name": "requiredLicenseType"},
            }
		}
	}
}

Then, it’s quite easy to disable users with a PATCH call to the core API
There is no bulk PATCH endpoint, so all users need to be disabled one by one.

c.patch(f"users/{userId}", json={'enabled': False})

mohammedsohailea73ba

OP4 years ago · Edited

Thanks,

As a test purpose, we are planning to delete all users,

Do you have any sample workflow , to get all users and delete it (Excluding admin)

arthurburkhardt

·4 years ago · Edited

The java core APIs do not seem to include the last login date.
I suggest to use the outputModuleApi for that, then iterate over the list of IDs.

It could look like:

{"ViewConfig":
  {"Resources":
    {"User":
      {"Id": {"name": "id"},
       "LastLogin": {"name": "lastLogin"}}
    }
  }
}

The output ModuleApi allows for filters, so you should be able to quickly write the correct query to extract the info.
Then the core api allows to delete users. Note: I would really discourage you to delete users. It would be a much better practice to just disable them.

import com.collibra.dgc.core.api.dto.user.ChangeUserRequest

//delete users: not a good idea
userApi.removeUser(uuid)

//disable users: better practice
userApi.changeUser(ChangeUserRequest.builder().id(uuid).enabled(false).build())

noor

·4 years ago · Edited

we convert author users to consumer users who are not connected to DGC for more than 4 months…
consumer users >> we not are bothered whether they are active or inactive.

In both cases, there can be some users who login once in a while. So, just a switch could help.

mariobeatty

·4 years ago · Edited

Hello Noor,
You must have a small user base?? Ours runs into the thousands, so in addition to security requirements we must follow around inactive accounts, we also have a finite number of seats. Since ALL users occupy a license, we are forced to manage consumer accounts by disabling. However, converting authors to consumers is a nifty capability to have. Do you accomplish this manually or thru a script?