How to map active directory groups to internal Confluence groups

[MikeA]

Confluence version 6.3

Active Directory Setup - Microsoft Active Directory (Read Only, with Local Groups)

Hi,  I'm taking over as a Confluence Admin for a employee that left the company and have some questions on user provisioning.  Currently when users want access to Confluence they submit a request and our Access Provisioning group will add them to two Confluence groups that map to Active Directory groups.

Confluence_Space_Admins

 Or

 Confluence_Users

Once they're assigned to these groups they can login with their active directory credentials.  I'm guessing these internal Confluence groups map to the Active Directory groups.  

 We’d like to add another group for the  Data Analytics team that maps to “Data_Analytics” Active Directory group.  However I'm not sure how to map an internal confluence group to a group in active directory?

Thanks

[Jonathan Smith]

@MikeA,

  Couple things to check into:

Go into Confluence Administration and see how your User Directories are set up. Is your Active Directory on top of Internal Directory? If so, good. 

Example: My internal directory is pretty empty, we just have a service account in case SSO goes down.

If your Active Directory group is on top, then you should have your help desk or whomever manages AD groups - create the new Data_Analytics AD group. Have them add the desired users into this group. After replication, the group should make its way into Confluence, and you should be able to lock down a space with that new AD group.

During Confluence setup for a new user, the people are added to Confluence_Users more than likely for application access. You can verify this by going into Confluence Administration and clicking Global Permissions.

Hope this information helps. Check out an add-on called SAML SSO if you don't want to worry about users typing in passwords! Wasn't the easiest setup, but works very well for us and support was great.

[Jonathan Smith]

Here is some additional reading about setting up user directories: 

https://confluence.atlassian.com/doc/configuring-user-directories-229838212.html

[MikeA]

Thanks, Jonathan I'll take a look!  The Data_Analytics AD group is in Active Directory but I'm not seeing it in Confluence?  Currently our User Directory is,

Microsoft Active Directory (Read Only, with Local Groups)  Should this be set to only "Read Only" ?

Thanks.  I'll review the link you provided.

[Jonathan Smith]

Read only with local groups is correct.

When I first tried to configure Active Directory in User Directories, I had an issue getting all of my AD groups over into Confluence.

Here is how I resolved:

1. Log out of Confluence
2. Log in with Service account (admin)
3. Navigate to Confluence administration, user directories
4. Click edit on Active Directory
5. Uncheck Enable Incremental Synchronization
6. This will fully sync your groups

• Not saying it will work for you but it is a good shot:

[MikeA]

Thanks, I was able to make that edit fairly easily.  Do I now need to create an internal for 'Data_Analytics' to synch the "Data_Analytics" group in AD with the internal Confluence "Data_Analytics" group?  forgive me I'm being a little dense here.

[Jonathan Smith]

No problem - I like questions!

Internal groups (local to Confluence) are completely separate from Active Directory groups. You shouldn't need to replicate the new groups into local groups.

If AD groups are working properly, you would only need local user/groups if....

Single sign on goes down in my environment. I would log in with service account  (internal user) which has local/internal groups. 

[Jonathan Smith]

Did you watch the AD groups sync after changing the Active Directory properties? Try going to a space and adding Data_Analytics to space permissions.

[MikeA]

When I uncheck the 'Enable Incremental Synchronization' option, I have options for,

"SAVE and TEST" and "Quick Test"

All tests pass if I enter a user in the AD - but I dont see anything related groups getting brought over.  

If I go try to set space permissions I dont see a group for "Data_Analytics" so I'm wondering if there's some incorrect settings in my AD setup?

[Jonathan Smith]

After saving your changes in the active directory setup, go back to your User Directories page and click synchronize. 

• Goal: Message says "Full synchronize completed successfully".

[Jonathan Smith]

If it takes a while, it is working :)

When I had incremental checked, the sync would take 10 seconds. Doing a full sync for the first time took minutes.

[Jonathan Smith]

@MikeA Any updates?

[Jonathan Smith]

@MikeA,

  Following up to see if your new AD group appeared in Confluence after syncing in the last step noted above.

[MikeA]

unfortunately, I'm still not seeing groups showing up but the tests are passing and users can authenticate with their AD credentials.  I also tried entering the specific AD server vs the alias.  I'm wondering if there's some configuration on the ldap side that's preventing the sync up.  I may have to escalate with my Access Provisioning department.

Thanks for all your help Jonathan

[Tobias Anstett _K15t_]

Hi Mike,

No, groups should be added no matter if you perform a full or an incremental update. However only groups will be synchronized which match the additional group dn configured in scheme settings of your connection.

Please refer to https://confluence.atlassian.com/doc/connecting-to-an-ldap-directory-229838241.html#ConnectingtoanLDAPDirectory-SchemaSettings

To get a more details about the AD structure you could e.g. use Microsofts AD Explorer -  https://docs.microsoft.com/en-us/sysinternals/downloads/adexplorer

Best, Tobias