Prevent AD from updating a JIRA user field with blank

[Chris Dunstall]

In JIRA 7.1.6, we use JIRA LDAP Directory, which is connected to our AD, we use it for user accounts and authentication into JIRA. When a user logs in, it transfers the user details to JIRA. All staff are in our AD, along with temporary staff that require access to our systems. These staff (usually external contractors) are not allocated an email address with our institution and their actual contractor email address is stored within the system, however, we have a policy of not allowing non-institution email addresses in our AD.

So, when an temporary user logs into our JIRA, there's no email address to transfer. We can  manually update the JIRA account with their email address, however, AD will overwrite the email in the JIRA user details with the null/blank value in AD.

How can we stop this from occurring? I've seen in other applications that link to AD/LDAP not to update fields when it is blank in LDAP. Is this possible in JIRA?

[Tom Lister]

Hi @Chris Dunstall

there  is no way to prevent Jira LDAP syncing with the AD directory as is. I’ve solved the same issue by creating a second user directory of type Delegating LDAP directory. This allows you to specify the user name and email manually but will use LDAP for authentication. It will need to be placed before your main LDAP in the ordering of user directory. You’ll need to set group memberships for users in new directory.

[Chris Dunstall]

Hi @Tom,

Thanks for your answer.

The directory connected to our AD is already of type Delegated LDAP Authentication. I think it comes down to whether we want to continue using the 'Copy user on login' checkbox setting.