Bitbucket server: How to lock out a user safely without removing from user directory?

[Marko Schröder]

Hi folks,

due to company security policies we have to ensure a safe lock out of users who left the company. On the other hand a simple deletion of the user is unwanted.

I run some tests and investigations. Removing an user from group shash-users seems not to be enough:

1. only a new login attempt to web-ui is prevented. As long as the user stays logged in the user can continue using the Bitbucket server.
2. ssh-based git activities seems not to be affected at all by removing user from shash-users

Conclusions:

1. I see no safe approach to lock out an user from Bitbucket server immediately.
2. To lock out a user safely it's needed to remove the user from group stash-users and remove all ssh keys of this user.

Questions:

1. What are the best practise suggestions?
2. How do you handle user management?
3. Did I miss important details (or misunderstood the documentation)?

I highly appreciate every suggestion and answer.

Marko

[Julius Davies [bit-booster.com]]

Are you using the LDAP integration?   If you disable the user in your LDAP (e.g., Microsoft Active Directory - right click on user object, click "disable" - something like that), I think Bitbucket Server picks that up pretty quickly and disables the user in Bitbucket.

The nice thing about this approach:  it's very easy to reactivate the user, and Bitbucket also picks up the LDAP reactivation very quickly (typically within 5 minutes I believe).

[Marko Schröder]

Hi,

thank you for your answer. We are working on a LDAP integration. That creates some more questions (https://community.atlassian.com/t5/Bitbucket-questions/How-do-I-migrate-users-from-Bitbucket-server-internal-directory/qaq-p/973322) ;-)

I am curios how your LDAP integration works: Will a user be thrown out of Bitbucket web ui immediately, if you disbled the user in LDAP and run a LDAP-Bitbucket-sync? Does your LDAP integration also deletes possibly existing ssh keys of the user if user is disabled?

Best regards,
Marko