How to properly filter users when using LDAP.

[Chet Wolosek]

Hello, 

We have been using local accounts for our instance of confluence but recently decided we wanted to utilize LDAP (Active Directory) integration so we have fewer user accounts to remember. I was able to go through and configure confluence to connect to our directory server and am able to pull users and group without issue. What I am having problems with is filtering the users that get automatically pulled into confluence as we do not want all users in our AD pulled into this. I did create group object filer rules that are working so that only certain groups are being presented but I am struggling with how to properly filter the number of users. What I would like to be able to do is only pull users that are members of specific AD groups (Using wildcards is an option since we use a consistent naming format). The primary reason why I want to filter the users that get pulled into this is because we don't want to have to buy a license for all user accounts in our domain as they wouldn't use the product. I have referenced this article for some of my work but I am still stumped so any help that could be provided would be greatly appreciated.

https://confluence.atlassian.com/kb/how-to-write-ldap-search-filters-792496933.html

Thank you

[Mikael Sandberg · Accepted solution]

You can use memberOf as part of your user object filter to restrict the scope. Take a look at https://confluence.atlassian.com/crowd/restricting-ldap-scope-for-user-and-group-search-169118612.html. It is for Crowd, but you can use the filter the same way in Confluence.

Note that it is not the number of users that you import from LDAP that control the number of licenses you need, it is the number of users that have permission to log on to Confluence.

[Chet Wolosek]

Does a license get counted if they login but don't have permissions to anything?

[Nic Brough -Adaptavist-]

Yes.  If they can log in, they use a licence.

To avoid that, just check the "can log in" group(s).  If they're not in there, they don't count towards your licence and they can't log in.

[Chet Wolosek]

Found that my user filters that I had tried using didn't work because it didn't support nested groups. If I added users as direct members of the targeted groups the filter worked as expected. If nested groups is not an option for this filter then I'll just have to add the users directly and call it a day. But if there is an option for nested groups that would be nice.

[Steven Behnke]

Nested queries are covered on the bottom of this page:  https://confluence.atlassian.com/kb/how-to-write-ldap-search-filters-792496933.html

Directly query group 'CaptainPlanet':

(&(objectCategory=Person)(sAMAccountName=*)(memberOf=cn=CaptainPlanet,ou=users,dc=company,dc=com))

Query users who are nested below group 'CaptainPlanet':

(&(objectCategory=Person)(sAMAccountName=*)(memberOf:1.2.840.113556.1.4.1941:=cn=CaptainPlanet,ou=users,dc=company,dc=com))

[Chet Wolosek]

Its what I get for not reading the entire article. Thank you for pointing that out and yes that does allow me to use nested group. Now I have exactly what I needed for this to work as intended. Thank you for all your help everyone.

[Steven F Behnke]

Instead, you should use

• Active Directory Sync
• Read-only with Local Groups
• Ensure that 'confluence-users' is applied as Default Group membership=

Under Global Permissions, ensure that only 'confluence-users' is allocated to Can Use Confluence permission.

Now, users will only be licensed when they log in initially. If you need to control who can log in, then you can reinvestigate Filters.