I do not see any reason to deactivate the accounts at the FAS level.
If you want to instead remove them from the ambassadors group, go right ahead.

We want to set them as inactive following the ambassador rules we have. Ambassadors who are not active (logged into Fedora systems or ML or whatever) for more than 18 months will be set as inactive in the FAS account. This will prevent to have them in the ambassadors list we have in the wiki, and which is created with a script.
Inactive ambassadors can come back and set their account to "active" again. We don't want and are not authorized to remove people from the ambassadors group, as that is not the rule.

Note, this process is a regular process, and we did the same a couple of years ago.
Thank you.

I just wanted to point out that we did it in the past: https://pagure.io/fedora-infrastructure/issue/4732

And for record tracking, here is the script that was used: https://robyduck.fedorapeople.org/scripts/ambassadors_activity2.py

Do note that at least one of these accounts IS still actively used:

username | last_seen
---------------+-------------------------------
aglaser | 2017-04-17 22:00:27.369651+00

Please do try to make sure you do not submit any active accounts.

I have disabled the accounts on the list with a last_seen < 2016.
Is there any reason why there's users with last_seen 2011 if we "did this before" with the same script?

@robyduck @jonatoni I would really like an answer to those questions.

@puiterwijk normally I reply as soon as I have some time, and FAmSCo is requesting these as a committee and not for any personal reason, so I don't understand why you closed this ticket immediately, saying you don't see any reason to do that. The rule why we request this is:
https://fedoraproject.org/wiki/Ambassadors/MembershipService#Inactive_Ambassadors

The same page also says, ambassadors get removed automatically from the FAS group if they are inactive for more than 6 months.

So the answers to your questions are:

• User aglaser did some activity after we run the script for the second time (we email them after a first run and wait 2 weeks to give them time to say: "hey I'm still active, logging into my account now")
• You see people with last seen 2011 because they are all already set as inactive and should get removed automatically from the FAS group, as stated in the link above. I never checked or had the possibility to check if this removal from the ambassadors group after 6 months of inactivity ever worked, but at this point I suppose it doesn't.

I closed the ticket because to me it sounds wrong to close accounts in the overall account system because one subteam decides on an arbitrary inactivity deadline.
Kicking out of the group, totally fair, deactivating accounts on the overall account system level sounds just wrong to me based on policies by a subteam.

What would happen if some random SIG would do the same but with 6 months inactivity time?

However, as said, I have now (even though I still disagree with the practice) disabled the accounts, as said earlier, so this ticket is now closed Fixed.

Well, you should have set them as inactive, not disabling them. People who want to come back and restart contributing can just do that and set their account as active again. Even after another 6 months, when they (should) get removed from the FAS ambassadors group by the automatic process.

Thanks for your help.

From an infrastructure point of view, inactive is for all intents and purposes disabled. The only way to disable them more is to set their passwords to random characters and their email to @localhost.localdomain.

The issue is that we don't do this for any other group and we (Fedora IT) are the ones who have to answer "Why is my account not working" over and over again. Especially for someone who may have been active elsewhere but put on this list because they didn't answer an ambassador email.

There is also the fact that while it is perfectly legitimate to remove a person from a group, making them inactive/invalid for the entire project seems excessive without approval from the Fedora Council.

I would love to do a cleanup with a lot of people who have accounts in Fedora who haven't logged in for years or have bad email addresses, but I wouldn't do so without getting the Council to approve it first. I am guessing there was some approval in the past for this since we (Fedora IT) have done it before?

From an infrastructure point of view, inactive is for all intents and purposes disabled. The only way to disable them more is to set their passwords to random characters and their email to @localhost.localdomain.

Ok thanks for clarifying, as form me the two words don't mean the same thing. I know of accounts which are admin_disabled though.

The issue is that we don't do this for any other group and we (Fedora IT) are the ones who have to answer "Why is my account not working" over and over again.

Correct. Apologies for that. We (FAmSCo) should that communicate better (again).

Especially for someone who may have been active elsewhere but put on this list because they didn't answer an ambassador email.

If he is active elsewhere he will not be set us inactive at all, because that means he is keeping himself up to date. We parse all fedmsg in Fedora world, even just a login for a second.

I would love to do a cleanup with a lot of people who have accounts in Fedora who haven't logged in for years or have bad email addresses, but I wouldn't do so without getting the Council to approve it first. I am guessing there was some approval in the past for this since we (Fedora IT) have done it before?
I am not sure when this exactly was made, but it could have happened just before the new Council was born. And no, there has not been any approval from the old Fedora Board.

If you feel we should bring this to the Council because you are not on a safe side, please do. Personally (not speaking for FAmSCo or any other process or rule) I feel if someone never logged into Fedora world, never wrote an email to the ML or whatever, he is not contributing actively to Fedora anymore and should be set accordingly. This doesn't mean we want to kick him out, he is always welcome to restart and just need to click on the inactive flag in the account system.

Out of curiosity, why can't the script that is used to generate the ambassadors list just look at who is in the ambassadors FAS group? Then inactive ambassadors could be removed from that group and their account status isn't impacted.

We had a very long discussion when FAmSCo took this process in place, where ambassadors where strongly against being removed from the FAS group just for a theoretical inactivity (the work of ambassadors is not always measurable like the work of a packager). We agreed then, 18 months would be ok, and FAmSCo had to run the script twice to give ambassadors the chance to login into the system. Only after another 6 months they will be removed from the FAS group.
Unfortunately there is no option to set people as per group inactive.

I think if people have been totally inactive for at least 18 months, and they don't respond to at least one email to ask them to login or otherwise become active, I think they should be removed from the ambassadors group. They can always be re-added if they desire to be active again.