[GH Request] Enact Confluence suggestions

[bmtcril]

Firm Name

Axim

Urgency

Low (2 weeks)

Problem/Request

Axim Eng reviewed the suggestions from here and approved. This ticket is to implement them.

Suggestions:

• Turn off API tokens for default user group
• Remove old / unused groups
• Archive inactive spaces so we don't have to keep managing their permissions
• Audit space groups for each space - update or remove core-committers group? It currently has page archive permissions, default group does not. Maybe remove blogs and attachments from the default group?
• Write a script to use the API to deactivate users who have been inactive for over a year post 1 post 2

Reasoning

See #1582

[github-actions]

Thank you for your report! @openedx/axim-oncall will triage within a business day. Simple requests usually take 2-3 business days to resolve; more complex requests could take longer.

[bmtcril]

Archived spaces

Aperture Engineering - no views in 2025
Educator team - no updates for 5 yrs
Engagement theme - no updates for 4 yrs
Hackathon - no updates for 3 yrs
John Mark
Joel Barciauskas
Analytics - 2 views this year

Spaces we should archive

Open source - should be archived, licensing page still used
Data Engineering - should be archived, retirement pages still used

[bmtcril]

User groups deleted
All groups had either 0 users, only Axim users who are already admins, or entirely / almost entirely inactive / suspended users.

• ~70 edx-* groups

• depr-external-contributors

• permission-share-dashboards-and-filters

• All members for directory - 66d602d1-048d-4519-8d6d-2afd5965c41d

• All members for directory - 8710ab3c-9a42-4353-8dd2-1262d764eb55

• arch-bom

• Atlassian:

• deactivated-2017-04

• inactive-users

• it-business-systems-team

• jira-developers

• jira-ops-users

• jira-portfolio-beta-users

• jira-portfolio-plan-committers

• jira-portfolio-shared-team-managers

• _licensed-jira

• _licensed-bamboo

• users

• sustaining-vulcans

• statuspage-users

• statuspage-administrators

• solutions-yonkers

• solutions-team

• solutions-rainier

• solutions-phoenix

• solutions-olive

• solutions-jerome

• solutions-hull

• solutions-holliston

• solutions-ent

[bmtcril]

Space permissions being set to:

• Not changing system / app users yet, but there are more than I'd like

Groups:

• administrators can do everything except delete own
• confluence-users can view all, add pages etc, add comments
• core-committers can also archive pages etc, and add/delete restrictions

Space permissions updated

• Accessibility
• Architecture and Engineering
• Data Engineering
• Design System Documentation
• Documentation
• Frontend Development
• Learner Team
• Localization

Spaces not updated:

• Personal spaces
• Mobile (has odd permissions and is only available to admins, rg-mobile, and schema-mobile)

[sarina]

@bmtcril - any update on this ticket?

[bmtcril]

No. The Confluence API is a nightmare to work with from Python and the packages weren't up to date with the latest API version, so I ran out of time for it. I'm holding on to it for some time when I have a few minutes to throw Claude at it now.

[bmtcril]

The Confluence removal script PR is here: openedx/repo-tools#663 It has been run to test once with a forced minimum pool of 100 users and successfully suspended 3 users with very, very old last login dates. Redactions below were manual for privacy reasons:

❯ uv run deactivate_inactive_confluence_users --no-dry-run --inactive-days 2250
Organization ID: 3989578f-a3e1-472d-a535-be32ae4fdd81
Directory ID: c0afe2f3-c4a1-491e-8489-4580951afaf6
Product: confluence
Inactive threshold: 2250 days (before 2019-12-24)
Mode: LIVE - WILL SUSPEND USERS
Excluded users: None

================================================================================

⚠️  You are about to suspend users. They can be restored later, but will lose temporary access. Continue? [y/N]: Y
Fetching all users from Atlassian organization...
100 users fetched
Found 100 total users

Processing users  [####################################]  100%

================================================================================
RESULTS
================================================================================

Total users processed: 100
Active users (within threshold): 23
Inactive users (beyond threshold): 3
Users with no confluence login data: 28
Already suspended/inactive: 46
Excluded users: 0
Errors: 0


INACTIVE USERS TO SUSPEND:
--------------------------------------------------------------------------------
  • <redacted name> (<redacted email>) - Last active: 2019-05-16 (2472 days ago)
  • <redacted name> (<redacted email>) - Last active: 2019-07-07 (2420 days ago)
  • <redacted name> (<redacted email>) - Last active: 2019-10-25 (2310 days ago)

================================================================================
SUSPENDING USERS...
================================================================================

Suspending   <redacted name> (<redacted email>)... ✓ SUCCESS
Suspending   <redacted name> (<redacted email>)... ✓ SUCCESS
Suspending   <redacted name> (<redacted email>)... ✓ SUCCESS

Suspension complete: 3 succeeded, 0 failed

--------------------------------------------------------------------------------
USERS WITH NO CONFLUENCE LOGIN DATA (may be service accounts or never logged in):
--------------------------------------------------------------------------------
  • <redacted name> (<redacted email>)
  • <redacted name> (<redacted email>)
  • <redacted name> (<redacted email>)
  • <redacted name> (<redacted email>)
  • <redacted name> (<redacted email>)
  • <redacted name> (<redacted email>)
  • <redacted name> (<redacted email>)
  • <redacted name> (<redacted email>)
  • <redacted name> (<redacted email>)
  • <redacted name> (<redacted email>)
  ... and 18 more

================================================================================

[bmtcril]

First batch of real users has been suspended:

2026-03-10 Run 1 - took 1h13m26s: 
Inactive-days 1894 (2021-01-01)
Total users processed: 12379
Active users (within threshold): 2231
Inactive users (beyond threshold): 2306
Users with no confluence login data: 4203
Already suspended/inactive: 3639
Excluded users: 0
Errors: 0

[bmtcril]

I changed the script to only pull active users to speed things up, and added retries around the per-user operations. Second batch of real users has been suspended:

2026-03-13 Run 2 - took 41m22s
Inactive-days 1532 days (2022-01-01)
Total users processed: 6435
Active users (within threshold): 1545
Inactive users (beyond threshold): 687
Users with no confluence login data: 4203
Excluded users: 0
Errors: 0

[bmtcril]

PR for automated GH issue reminders is here: #1671

All of the details of the suspensions are recorded in this Axim only doc (contains emails): https://docs.google.com/document/d/1QTJ4O0up8GnFXgidUniNABQ9ftKEnnJyo9tmeSF1rbE/edit?usp=sharing

Final round:

2026-03-19 Run 3 - took 37m 11s
Inactive threshold: 808 days (before 2024-01-01)
Total users processed: 5749
Active users (within threshold): 756
Inactive users (beyond threshold): 791
Users with no confluence login data: 4202
Excluded users: 0
Errors: 0