How to authenticate users in JIRA 4.3

[Deleted user]

I'm upgrading from JIRA 4.2.3.6 to 4.3.4 in my test environment in Windows server 2003 R2. In 4.2.3.6, users were authenticated either through one of two LDAP entries in the osuser.xml or in JIRA only.

When the database upgrade script ran (we're on SQL Server 2005 SP3), it moved all users who were authenticated through the 2nd LDAP osuser.xml entry and those who authenticated in JIRA only to the JIRA Internal Directory (ID) with a credential. All others, those who authenticated through the first LDAP entry in the osuser.xml, were put into the JIRA Delegated Authentication Directory (DAD) with a credential. Many of the users in the ID are associated with one or more issues in JIRA. My assumption is that the users' credentials either came from the LDAP or the password previously assigned to their JIRA internal account, correct?

The problem I'm having is that users in the ID are no longer able to log into JIRA. Do I create new user directories to point to their LDAPs as applicable? If so, I think I should use the JIRA with LDAP Authentication, Copy Users on First Login. However, according to the documentation, these users will be added to the ID where some of them already exist.

If I create multiple user directories, won't I be violating the rule of only having a user in one user directory. I've also switched the order of the ID and DAD on the User Directories page and saw no difference. External password management is on and external user management is off.

Ultimately what I want is to have all users authenticated through LDAP and for new users to be automatically added to a JIRA group that controls their access within the application.

Any and all help is appreciated!

[Colin Goudie · Accepted solution]

Providing the usernames stay the same you can just configure a new AD user directory in JIRA and make sure AD groups that these users belong to have permissions to use JIRA etc.. in Global permissions (and project roles etc..)

If the usernames match things tend to work out fine since JIRA is really using the usernames as the keys

I've found little issues with approaching it this way. Obviously do this on a test server first.

[Deleted user]

One of the ADs I need to connect to has over 10,000 users of which I only need about a dozen or so in JIRA so I definitely didn't want to bring all of those folks into my database for obvious reasons. Unfortunately, not all of the users I needed to add were in one AD group. I finally resolved my dilemma by putting all of the LDAP connections into the osuser.xml file in the order in which I want my user directories to be created in JIRA 4.4.4. The remaining users were put into the JIRA Internal Directory which is where I wanted them. Atlassian could do us administrators, who are not AD/LDAP experts, a huge service and go into more explicit detail about this process in their documentation. I had to run the upgrade 4 times in my test environment before I got the results I wanted!