Proposals/Done/LDAP account expiry

Introduction

The administration of users in Mahara that is connected to a LDAP directory should be simplified to avoid high administrative burden. That means when users are deleted from LDAP, the next time cron runs on Mahara, the accounts that cannot be found anymore are marked as “expired” automatically. Administrators can then view all expired accounts at /admin/users/suspended.php by choosing the option “Expired users” from the drop-down menu. Account expiry will only be done when there is a successful connection to LDAP to avoid accidental expiry of all accounts due to a connection error.

Users will be notified about the expiry as per standard account expiry notifications if a time frame is given for that in the site options.

Minimum new functionality

• Mark accounts as expired in Mahara that have been deleted from LDAP.
• Extend the current “Expired user” table to display also username, first name, last name, remote username to ensure that the correct accounts are deleted.
• Make the username clickable and link to /admin/users/edit.php?id= and make the first name and last name clickable and link to the user's profile page.
• Disable emails of expired accounts to avoid bounced emails.
• Add the “Results per page: 10 50 100 200 500” functionality so that admins can select many users at once.

Enhancement 1

Once the users whose accounts do not exist in LDAP anymore are expired, the administrators can select and delete them in bulk. If the user data (artefacts and portfolio) should be archived before deletion, the administrators can click on the name of a user and make a full backup of this user's data from /admin/users/edit.php

ToDo: Add a “Backup user data” button to /admin/users/edit.php?id= for the admin to backup everything in a user's account without having to masquerade as the user. The data will be made available as download to the admin. The admin does not need to be able to select only a page / collection, but should just straight backup everything.

Enhancement 2

Once the users whose accounts do not exist in LDAP anymore are expired, the administrators can download a CSV file which includes the information displayed in the table for expired users and use the usernames that are contained within it for the bulk export of user data1. The CSV file can also serve as record for which accounts have been marked for deletion / have been deleted.

This scenario would make use of the experimental feature of the bulk export without making any changes to it. Once the bulk export of the user data was successful, the administrator can return to the “Expired users” listing and delete the accounts in bulk.

ToDo: Create a CSV file for the data in the table of “Expired users” similarly to what can be done on /admin/users/report.php.

Enhancement 3

Once users are expired and viewable in the table of “Expired users”, the administrators can select all users they wish to make a backup of and delete automatically after having run the backup process when clicking on the new button “Backup and delete users”.

This functionality requires the development of a queue for making exports / backups of user data so that the administrator does not have to wait for the backups to be made. This option would provide better performance than via the experimental feature of the bulk export because backups would be scheduled when system resources are available.

ToDo

• Add the functionality to “Backup (user data) and delete” on the “Expired user” page for bulk action. When users are selected, these two processes would be performed sequentially. If a backup cannot be made due to any errors, the user is not deleted, but requires administrator intervention. Only when the backup can be made successfully, will the user account be deleted. The backup data is stored on the Mahara server and can be downloaded by the administrator from there.
• Implement an export queue and improve error handling.

Enhancement 4

Once users are deleted from LDAP, their accounts are marked for expiry. Institution administrators have an institution setting that allows them to automatically “Backup and delete” or only “Delete” expired user accounts. These options are only available when users are not allowed to be members of multiple institutions to prevent accidental deletion of user accounts that should be reactivated in another institution.

ToDo (in addition to Enhancement 3)

• Add the institution settings “Backup user data and delete expired users automatically” and “Delete expired users automatically” (without making an automatic backup) if the site setting “Users allowed multiple institutions” is not selected. Otherwise, grey these settings out.
• Add a pop-up window for each setting stating the potential ramifications of the actions instead of just mentioning them in a help file.