Determining user activity, even through Oauth

[Robert Mullenix]

I am trying to determine the most recent time a user interfaces our JIRA Data Center platform.  We initially used the advice here: https://community.atlassian.com/t5/Jira-questions/Finding-the-inactive-users-with-respective-project/qaq-p/169507

The `attribute_name = 'login.lastLoginMillis'` works pretty well, but we have noticed that it does not include users that primarily access JIRA through the REST API and the OAuth authentication.

Is there a different column we can use that gets updated whenever a user successfully interfaces with the platform through _any_ means?

[Clark Everson]

Hi @Robert Mullenix 

Thanks for posting this as we are actually going through something similar, so if there is a better way I would love to hear it.

However, the way we do it (and this is where policy comes in) is anyone who accesses Jira via API or Bot needs to send in a request and the bot is created. We have a document that keeps track of all the bot users so then when we need to delete or inactivate users we can make sure to mark those users as exceptions. Optimizer for Jira has this functionality built in and I know we are looking at it. You can then also make an exceptions list in that tool that you only need to add to.

However another field for the table that can search off of like last login I am unaware of. Usually an exceptions list of some kind is needed. But i am happy to be corrected.

Best,

Clark

[Robert Mullenix]

How can you determine which users have OAuth token?  Exempting them would work for me.

[Clark Everson]

Hi Robert,

This is why we have a list of users that access via the API. Usually on server, unless you have a specific add on, username and password is needed for API access. Only in Cloud does it work via Tokens unless you are on 8.15 or higher for Jira, which just came out.

If you do have an add-on I would suggest reaching out to them specifically. I do not have familiarity with 8.15.x though to provide insight for it.

[Robert Mullenix]

Is the list of users with OAuth tokens something accessible via a table in the DB?