JIRA 7.11 and Active Directory Caching

[Chris Dunstall]

We are currently using JIRA Software 7.1.6 and are evaluating JIRA Software 7.11 on a clean slate.

I'm currently trying to configure our AD integration, much like we already have on our current production instance. However, where the older JIRA 7 only creates the user account from AD when the user logs in for the first time, JIRA 7.11 is attempting to create all the users and groups from AD in JIRA in one go.

The problems here are:

• I do not want to bring ALL users from AD across, only ones that need it (i.e. they log in, much like the older JIRA).
• I do not want all the any groups from our AD.
• It seems to stop caching at 1001 users, is this a bug?

I want to be able to manually control who comes over to JIRA from AD without having to create an AD group. Is this possible in JIRA 7.11?

[Moses Thomas]

@Chris DunstallIt  is possible !   and how to  go  about it,  you  will  should  use internal LDAP  with  authentication and also  manage  group  in  JIRA internal  directory.

Important  things you  need to  take note

• Users and groups container must be created in active directory for example (DEV→GB→ user_a, user_b, user_c and so on)

• Create groups in active directory were users will belong to in oder to be able to access jira/Confluence (for example active_jira_users, active_confluence_users), application access must also be configured in your Jira/Confluence server using these groups

• Nested groups would be used in active directory( for instance, Jira user, confluence users group should be a member of for instance atlassian_users , so that you can iterate user search for more that one group.

• To use both Jira internal directory and Active directory you must change the order of directories, in case of active directory usage then it should be the first directory on the list.

• To make life easy for other  users you may want to create a possibility for user’s to be able to change their password, via outlook for example if your outlook uses active directory credentials

• Since you will be using Active directory user credentials then all user names in you Jira internal directory must match Active directory user names if you don’t have these users in active directory then you will have to create all users.

Best  of luck  with  the configuration.

[Chris Dunstall]

@Moses Thomas That looks like a completely warped way of doing it.

I did mention in the last paragraph that I do not want to have to create anything in AD to manage this. We manage our current JIRA access completely from JIRA (i.e. when the user logs into JIRA for the first time, their user account is created/copied from AD into JIRA's LDAP directory).

I'm hoping that I can continue to manage the new JIRA in the same way but it's starting to sound like it can't be.

[Moses Thomas]

@Chris DunstallInfact this  the best way i  can think of, i don't see another way you can do  this,  you  will have to  create some group in AD that will  allow  access to  JIRA,  and filter this  users out, when  jira   will  search  in this container.  It  doesn't  make any  sense  not to  create any thing  in  AD.  i have done  it this way  and it work perfectly!.