How to migrate delegated LDAP to connector LDAP?

[John Reynolds]

We are currently running a large Jira Server instance (1,000+ users) using a Delegated Authentication Directory with LDAP.  We need to migrate a new Connector LDAP directory (Generic Posix) and bring over user data. 

Usernames are the same on both directories.  There is one group on our current LDAP we filter users from (jira-users).  There are also local groups within Jira that we can re-create POSIX groups for on the new directory.

What is the best approach for migrating these users and groups from Delegated LDAP to Connector LDAP?

[Dave Theodore [Coyote Creek Consulting]]

Be careful! For sure, do not do this for the first time in production.  This should be pretty straightforward as long as you don't have users that exist in multiple directories that have work associated with each user.

In a Dev instance, make a clone of your Prod environment and dump the cwd_user database table so you can see what is happening. You want to be able to compare to the original as you make changes.

In theory, you would do the following steps in this order, but if you end up with users becoming disconnected from their data, you will need to troubleshoot and see where things went wrong.

1. Note the order of the current directories (1 = Jira internal, 2- LDAP Delagated Auth for example)
2. Add the new LDAP connector (so you have 3 of them)
3. Perform the sync of the new LDAP connector
4. Move the new LDAP connector above the LDAP Delegated Auth connector (ie: if LDAP Delegated Auth is #2 and LDAP is #3, invert the order)
5. Disable the LDAP Delegated Auth connector
6. Delete the LDAP Delegated Auth connector

I would advise comparing the cwd_user table against the original for steps 2-6 before moving on to the next step. This will help you understand at what stage things broke.  I hope that helps.