Skip to content

Resolve "Deactivate a user (with self-service reactivation)"

Moved to new repo:

gitlab!17037 (merged)

What does this MR do?

For #63921 (moved)

  • Adds option to deactivate a user from admin/users/show page Screenshot_2019-08-06_at_10.49.05_AM
  • Adds option to activate a user from admin/users/show page if the user is currently deactivated Screenshot_2019-08-06_at_10.48.54_AM
  • Adds option to deactivate a user from admin/users/index page Screenshot_2019-08-05_at_5.38.14_PM
  • Adds option to activate a user from admin/users/index page if the user is currently deactivated Screenshot_2019-08-05_at_5.39.09_PM
  • The option to deactivate a user shows up only if the user is currently in activate state and does not have any activity in the last 14 days.
  • A deactivated user cannot access git, and when trying to do so is shown an informative error message to log in to GitLab to activate the account. Screenshot_2019-08-06_at_9.15.01_AM
  • A deactivated user cannot access the API, and when trying to do so is shown an informative error message to log in to GitLab to activate the account. Screenshot_2019-08-06_at_10.47.42_AM
  • When a deactivated user logs back in via username/password, an informative message is shown regarding their reactivation. Screenshot_2019-08-03_at_4.02.35_PM
  • When a deactivated user logs back in via SSO(like bitbucket), an informative message is shown regarding their reactivation.
  • Added new tab "Deactivated" for deactivated users in admin/users/index page Screenshot_2019-08-05_at_5.44.00_PM
  • Added "Sort by" label to sort options Screenshot_2019-08-05_at_5.42.49_PM
  • When a user is deactivated by the admin, the user is forcefully logged out when they perform their next request with informative error message. To reactivate their account, they would have to log back in. Screenshot_2019-08-06_at_9.28.45_AM
  • Deactivated users do not receive notifications.

API:

  • Added PUT users/:id/activate API for activating a deactivated user. Only for admins.
  • Added PUT users/:id/deactivate API for deactivating an active user. Only for admins. Returns 403 if the user has any activity in the last 14 days or if the user is not in an active state

TODO:

Does this MR meet the acceptance criteria?

Conformity

Performance and testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team
Edited by Manoj M J

Merge request reports