AD synchronization

[Maro Hamamjyan]

Hello,

In many cases. for ex. when a user is added in a AD group, which is used in security level, the user  has to wait a day to get the permissions. I tried to manually synchronize in web, it always shows successfully status, but in fact never synchronizes. Does someone know how to synchronize environment with AD from server sides? Is it a job or what?

Thanks in advance

[MARK RYAN DAYANGHIRANG]

First of I would suggest you enable Incremental Sync under advance settings and change the Group Object Filter under Group Schema Settings to (&(objectCategory=Group)(!(cn=*cnf=*)))

[Andy Heinzer]

In Jira Server, when you connect an external user directory to Jira, like Active Directory, there is a setting called 'Synchronisation Interval (minutes)' under the Advanced settings.  This determines how often Jira tries to sync with your directory.  By default this is set to 60 minutes, but there are cases for increasing or decreasing this interval.  If you have a very large directory with more than 2,000 users, and/or more than 2,000 groups, you might find that this sync interval could take a long time to complete depending on your environment. 

You can manually tell Jira to sync this directory right away.  This can be done in the web UI of Jira under Settings-> User Management -> User Directories.  You will need to be a Jira admin to reach this page.

I would not expect Jira to take a full day to sync your data.   Typically an hour should be all that is needed for Jira to do this.  But if your environment has a very large number of users or groups to sync over everytime, it's possible this sync itself is taking a very long time to complete (more than an hour), in which case, the job to sync that data can get messed up because Jira is on a schedule to run that every 60 minutes.  

If this is the case, I'd take a closer look at the $JIRAHOME/log/atlassian-jira.log file during this sync to see how long it takes to complete in your environment.

[Maro Hamamjyan]

Hi Andrew,

Thanks for your reply. You are right about the default 60 minutes setting in "Advanced Settings", but in fact when I Manually press on "Synchronize" it always takes 0s, that status is always "Completed successfully", and it never synchronies with AD. It also is not synchronizing automatically every 60 minutes as well, in fact we have to wait a day to see the changes...

What can it be?

[Andy Heinzer]

It sounds like something is wrong.  But without seeing the logs, I can't really say what the problem might be.  So I created a support case on your behalf so that we can gather these logs:

https://getsupport.atlassian.com/servicedesk/customer/portal/3/SDS-38040

Regards,

Andy