Ability to prevent user account deletion
Problem to solve
Many companies have data retention policies. Deletion of users, whether by accident or by design, deletes data and can easily result in the inadvertent violation of data retention policies.
Target audience
Security analyst, All
Further details
We recently ran into this issue at a large customer. The security department, in an attempt to solve an authorisation problem, deleted a user's account. All of that user's underlying data was subsequently lost (or associated with the 'ghost' user). Restoration is proving to be time consuming. Nevertheless, the point here is that it was very easy for someone to intentionally remove a user account. That violated policy as it removed records of that user's activity and the user's underlying data.
In this case the customer was surprised because some of the data was thought to be shared. They wrote, "Even though there are other owners for the repos, still they got deleted." I suspect that this was due to confusion and that the deleted data was actually under the user's own namespace. (Preventing users from using their own namespace could prevent such confusion but that requires its own issue)
This is listed as an EE feature because policies that will be affected by this are generally found at large organisations.
Proposal
Allow GitLab installations to be configured to conform with data retention policies such that user accounts can be blocked but not deleted.
Links / references
Support ticket: https://support.gitlab.com/hc/en-us/requests/111538
Related issues: https://gitlab.com/gitlab-org/gitlab-ee/issues/7237 https://gitlab.com/gitlab-org/gitlab-ce/issues/56125
Possibly related: https://gitlab.com/gitlab-org/gitlab-ce/issues/48739