Use Active Directory group membership to grant access to Confluence 3.1 instead of OU structure.

[Chris Thompson]

I'm new to your product and just need a KB article or a config guide on this.

We are running Conf. 3.1 and are re-structuring our OU tree in Active Directory. The problem is that when we move our users around, they lose access to Confluence.

I wanted to set it up so that group membership determins access and not the user object's location in LDAP.

Is this possible?

Can you send me an article on how to do it? (I searched around some on this site and didn't find a simple step-by-step guide, sorry...)

[Rodrigo Girardi Adami]

Hi bitginsu,

I'm not sure about where you are moving the users inside the LDAP tree, but I believe that if you don't move them outside the LDAP search base dn it should be ok.

If you are moving them outside the LDAP base dn to another part, Confluence won't know where to look for them and therefore will not allow login.

I can recommend you to try 2 possible approaches in this case.

1) Create 2 LDAP structures inside the Atlassian User file: https://confluence.atlassian.com/display/CONF31/Configuring+multiple+LDAP+repositories

2) Move all the users and groups and update inside the Atlassian user the new location of the users and groups and the base DN if it had changed. https://confluence.atlassian.com/display/CONF31/Customising+atlassian-user.xml

I hope this helps. If you are willing to try this, make sure to use a test server to not harm production. Also, I'll keep this open so other people can participate and give their opinions about this. :)