Migrating internal directory to LDAP on confluence

[Rahul Aich [Nagra]]

HI

I am on confluence 4.3

I have internal directory authentication. I want to migrate all of our users to LDAP authentication.

I am aware that jira provides you with an ability to perform such migration, but i want to know if this is possible on confluence 4.3...?

If not, what are my workarounds , options available?

Rahul

[Marco Mancuso]

Hi Rahul,

I assume you are going to set up a delegated auth directory and that all the users are already present in LDAP with the same username of the users you have in your internal directory.

I did it for JIRA and I think the same approach could be used in Confluence.

If you have access to the database you could do the following:

1. Create a new User Directory in Confluence and connect to your LDAP (delegated auth)
2. perform few queries in order to move all your users, groups and attributes to the new directory

• Select the ID of the new directory

select * from cwd_directory where directory_type='DELEGATING';

• Move all the users

update cwd_user set directory_id=newDirId where (filter only the users you want to move);

• Update all the uer attributes

update cwd_user_attributes set directory_id=newDirID where user_id IN (SELECT id FROM cwd_user WHERE directory_id= newDirID);

• Move the group memberships

update cwd_membership set directory_id=newDirId where child_id
IN (SELECT id FROM cwd_user WHERE directory_id=newDirId);

• Insert the local groups (in order to allow the remaining local users to login the groups need to be inserted instead of updated)

insert into cwd_group values (10003, 'group1', 'group1', 1, 0, '2011-10-28 17:20:45', '2011-10-28 17:20:45', '' , '' , 'GROUP', newDirID);
insert into cwd_group values (10004, 'group2', 'group2', 1, 0, '2011-10-28 17:20:45', '2011-10-28 17:20:45', '' , '' , 'GROUP', newDirID);
insert into cwd_group values (10005, 'groupN', 'groupN', 1, 0, '2011-10-28 17:20:45', '2011-10-28 17:20:45', '' , '' , 'GROUP', newDirID
);

In order to quickly perform the last point you can just export the cwd_group table, replace the id for the groups you want to migrate to the new directory and import them.

Of course, considering the king of change, it is highly recommended to perform a DB backup before and if possible to test the procedure in a staging environment.

You can find addition info here

• https://jira.atlassian.com/browse/JRA-24213
• https://answers.atlassian.com/questions/186252/from-internal-directory-to-ldap

I hope this helps.

Marco

[Rahul Aich [Nagra]]

Hi Marco

Thanks for the detailed explanation. We also have use-cases when the usernames are not the same. Say his LDAP username is jblogg but his username on internal directory of confluence is joe.

fOR SUCH use-cases what is your suggestion, other than re-creating his account?

[Marco Mancuso]

Hello Rahul,

there is a good article about this use-case at: https://confluence.atlassian.com/display/CONFKB/How+do+I+change+a+username+prior+to+Confluence+5.3for version prior than 5.3.

You will still need to act directly into the database to please be careful, do your backups and do it in staging first if you can.

Marco

[Rahul Aich [Nagra]]

Thanks Marco that helps.