Need help limiting LDAP user sync by security group

[Justin Samsel]

Hello, new user to Confluence here.

I am trying to limit Confluence to only importing AD users that are part of the two AD security groups Confluence-Admin and Confluence-Users. I found this KB that I think is pointing me in the right direction, however I can't write the filter correctly.

In "User Directories > Configure LDAP User Directory > LDAP Schema > Base DN" I have:

OU=MyUsers,DC=MyCompany,DC=com

And in "User Directories > Configure LDAP User Directory > User Schema Settings > User Object Filter" I have:

(&(objectCategory=Person)(sAMAccountName=*)(|(memberOf=cn=Confluence-Admin,ou=MyUsers,dc=MyCompany,dc=com)(memberOf=cn=Confluence-Users,ou=MyUsers,dc=MyCompany,dc=com)))

I'm either trying to do this completely wrong or my syntax is broken somewhere. Does anyone have any guidance on fixing this?

[Justin Samsel · Accepted solution]

After more reading and trial and error I figured out I was just writing the DN of the security groups wrong. After correcting them in the example above the proper people are getting imported into Confluence.

[Kelvin Latner]

Hi Justin!

I've been tasked with limiting access to our Bitbucket application to a specific group (Distribution List) in our LDAP directory, which is a few hundred users.  Right now, anyone/everyone in our LDAP directory can sign into Bitbucket, which is thousands of users...  We have limited licenses.  I too have tried to tried several filtering suggestions I've found; however, I haven't guessed the right combo yet...  :/

Would you be so kind as to provide examples of your corrected settings?

Thank You Sir!  :D

[kns_jeinhorn]

Justin wrote "I solved it!" but did not share his solution.

Justin, it sure would be nice if you would share the details.

[Nicola J]

@Justin Samsel Any chance you can provide what you ended up with? I have this exact scenario and could do with a hint as to what was wrong in the original DN above...

[kns_jeinhorn]

In my case, the goal was to sync users who belonged to either one of two security groups.

The Active Directory structure in our company, loosely represented:

corp.mycompany.com             (Domain)
|--Otherstuff1                 (OU)
|--Groups                      (OU)
   |--OtherGroup1              (OU)
   |--SpecialGroup             (OU)
      |--IgnoreGroup1          (group)
      |--MyGroup1              (***group to be included***)
      |--MyGroup2              (***group to be included***)
      |--IgnoreGroup2          (group)
   |--OtherGroup2              (OU)
|--Otherstuff2                 (OU)

I managed to make it work by using the following value for the "User Schema Settings - User Object Filter":

(&(objectCategory=Person)(sAMAccountName=*)(!(useraccountcontrol:1.2.840.1135

Good Luck!

Janet