Can I hide disabled users in the User Manager?

Question

We have Sitecore pulling user information out of Active Directory, and since a chunk of these are marked as disabled (University setting, and a chunk of our students get accounts for the time they're here), it results in a lot of extra results when searching for some common names.

In the Sitecore User Manager, is it possible to hide disabled users?

Answer 1

I propose hiding users through the use of filtering in the membership provider.

Consider using the customFilter attribute used by the Active Directory membership and role providers. Examples shown below.

Active Directory supports the following filter for excluding disabled users:

(!(UserAccountControl:1.2.840.113556.1.4.803:=2))

You can find more details here on filters supported by Microsoft Active Directory; no guarantees that the AD module will recognize them all.

---

The customFilter attribute is documented in the AD module docs but there are not too many examples on how to do this in production.

I was able to get the filtering of disabled users working today. Thanks for the idea.

Use these filters in your web.config. Users which require access to Sitecore are added to the GRP-Sitecore-Users group in Active Directory. To keep things simple, this tracking group limits who appears in User Manager; the remaining access is configure in Sitecore on an individual user basis.

SitecoreADMembershipProvider Custom Filter:

(&(memberOf=CN=GRP-Sitecore-Users,OU=Groups,OU=Company,DC=chs,DC=company,DC=corp)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))

SitecoreADRoleProvider Custom Filter:

(&(objectCategory=group)(memberOf=CN=GRP-Sitecore-Users,OU=Groups,OU=Company,DC=chs,DC=company,DC=corp)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))

Complete Example:

A complete example demonstrating settings with the Active Directory module can be found here. The only part missing is the disabled filter.

Answer 2

Looks like there is no way to do this without modifying some logic.

One way to do it would be:
The User Manager dialog requests a list of users from the UserProvider which can be configured with a web.config patch:

<userManager defaultProvider="default" enabled="true">
  <providers>
    <clear/>
    <add name="default" type="Sitecore.Security.Accounts.UserProvider, Sitecore.Kernel"/>
  </providers>
</userManager>

You can then create your own class that overrides from UserProvider and override the GetAllUsers() method to only return users that are not disabled.

Note that for not-administrators that can view the User Manager, Sitecore is calling another piece of logic (something like DomainProvider) to get the users, so you also might want to tap into that.

Another way to filter the user manager list:
https://sitecorecontextitem.wordpress.com/2014/03/14/sitecore-user-manager-filter-users-by-profile-type/