Is a Jira internal directory admin account required when using LDAP?

[Kevin Paulus]

Our internet security boss wants "ALL" internal directory accounts removed.  We use an LDAP directory (read-only with local groups).  As the system admin, I have my LDAP account, but also two internal directory accounts used for access when the corporate exchange server is offline or when I need to replicate the permissions of another user's account to provide troubleshooting assistance.

[Florian Bonniec · Accepted solution]

Hi @Kevin Paulus 

I do not recommand to remove all internal account but keep at least 1 user admin. If you remove all of them and have an issue with your AD, you will be locked from JIRA. Same if the user account to connect to the AD changed you will not be able to log in again into JIRA. More over you cannot edit the directory you "come from" so if you want to update the AD Directory you need an account that do not come from this AD.

Regards

[Kevin Paulus]

Thank you Florian,
            I think its a case of educating the boss on how the software they bought works.  I'm sure they will point to the recovery mode as the recommended process, but we have been there previously and that is just not as simple as the instructions claim.   I was hoping to find a direct statement in the software documentation that better explains the purpose of the internal directory.  I am still looking. 

[Florian Bonniec]

The process of the recovery user is defined below.

https://confluence.atlassian.com/jirakb/restore-passwords-to-recover-admin-user-rights-972329273.html

I would say that it's less an issue than before since you do not have downtime since JIRA DC.

It also require access to the node system, so in big company it can be an isue as it will not be reactive enough.

Regards

[Kevin Paulus]

@Florian Bonniec ,
          We're not in DC yet but are working our way up that path.