Cant associate user to groups in Jira

[David Alonso]

cant associate user to groups in Jira. The user adminsitration its integrated with Active directory. 

We can create a group, but not associate users, we need some permission extra for exectute this action? 

This is a error message: "The user directory its only read"

[Rudy Holtkamp]

Hi @David Alonso ,

The group is maintained in Active Directory and is setup as read-only in Jira. You need to either add the user via Active Directory and re-sync the user directory (or wait until it is done automatically). Or you need to change the User Directory connection and set 'Read Only, with Local Groups' in the 'LDAP Permissions' section.

Go to <your Jira url>/plugins/servlet/embedded-crowd/directories/list and click on edit.

[david chavez]

Hi @Rudy Holtkamp very thanks for your help¡

In this case, we need to edit the actual directory, but we dont have a permission to edit this. Exists some file to this configuration where can edit this?

How do you suggest resolve this?

[Rudy Holtkamp]

My Spanish is a bit rusty (as in non-existing), but the reason you can't edit the AWS_AD configuration is because you are logged via this user directory.

So you need to login via an admin account of the Jira Internal Directory. Maybe you should just create a temporary one. If you have logged in via that account you should be able to change the config settings of the AWS_AD entry.

[david chavez]

Thanks @Rudy Holtkamp , the problem is that to enter the application we are using a validation an AWS SSO that does not allow access to Jira without an AWS AD user. In addition to this the access is restringed by a physical token.

So we cannot log in with our own Jira user.

[Rudy Holtkamp]

@david chavez , which SSO app are you using? In some cases you should be able to bypass the SSO login for admins, otherwise you can't login if your AD failed and you need to change it.

[Rudy Holtkamp]

Hi @david chavez , I just looked for some methods of popular apps to bypass the SSO login:

• Easy SSO: add ?stopsso=true to the URL
• K SSO: add ?nosaml to the URL
• MiniOrange: disable in menu for admin user
• SSO from resolution: add ?nosso to the URL

If the app that you use is not in here, you might want to search in the docs or otherwise contact the app vendor.

Rudy