Active directory groups mapping

[Adam Gaudry]

Hi there

I am trying to connect Confluence Server to AD. But for some reason, it seems to fail when trying to read nested groups.

I have nested groups enabled, but it doesn't seem to be able to register people who are nested.

So if person A is in group B, and group B is in group C, it doesn't seem to recognise that person A is in group B and C. 

Is there any advice that people can give me to assist with this issue? Is there an advanced setting that controls the max depth of nesting Confluence can read in AD?

Best wishes

[Adam Gaudry]

Hi @Jonathan Smith and @Tarun Sapra

Thanks for your answers. I feel I should provide you with more details as to the config.

Nested groups are enabled in Confluence.

The incremental sync has also been turned off.

For reference, we are currently using Crowd to sync AD to Atlassian apps, but we are trying to move away from that. 

I have duplicated the same config (ie the same options and the LDAP Schema) as I can see in Crowd. But whereas Crowd applies the permissions and groups correctly, connecting Confluence doesn't seem to work as I'd hoped.

Is there anything else I'm missing, is there any information I can provide that would help more?

[Jonathan Smith]

Hi @Adam Gaudry,

  Our responsibilities are broken up in our IT. I worked with our server team to set up the Active Directory settings in User Directories.

If you want, I can supply you the configurations we used if you think that will help.

Note: We are on Confluence server.

- Jon

[Adam Gaudry]

Thanks very much @Jonathan Smith. I missed an obvious step; restarting the Confluence services completely, and reran the sync after disabling and re-enabling the AD directory.

That seems to have pulled through significantly more, if not all, the nested group structures that I would expect to see.

There is a fairly major issue from my point of view though. We need to be able to give certain people administrator access to Confluence through an AD group structure. So in addition to the local (to Confluence) confluence-administrators group, we have created a confluence-admins AD group. I have given this as many permissions as possible through Global and Space permissions. However, I notice that it still doesn't have the elevated super-user access that people in the internal confluence-administrators group do.

Because in Confluence (unlike Crowd) you don't seem to be able to nest a group within a group (for example I can't make confluence-admins - the AD group - a member of confluence-administrators, the local group), this is a bit of an issue. Because it means that I would have to add and remove members to the confluence-administrators group manually. Which is not ideal for our purposes. 

How do you get around this issue? Or do you just have people manually added to the super-user group? I have read somewhere that calling the AD group the same as the internal group might help?

Best wishes

Adam

[Jonathan Smith]

Hi @Adam Gaudry,

  Within User Directories, Active Directory, expand Advanced Settings and un-check Enable Incremental Synchronization. Also, confirm 'Update group memberships when logging in' is set to "every time the user logs in".  Save, then synchronize.

We found that Confluence never did a full AD sync when incremental was checked. 

Hope this helps!

- Jonathan

[Tarun Sapra]

Hello @Adam Gaudry

You have to enable nested groups in the directory configuration at the confluence end as well. 

I use nested groups for Confluence connected with Crowd which is further connected to LDAP. In the directory configuration in COnfluence user directory you have to enable the nested groups.