Jira: LDAP User Being Added to Internal Directory

[Dan Long]

User Directory Config:

• LDAP (Active Directory) is first
• Jira Internal Directory is second.

The issue is that one particular account; when it first logs into Jira via OpenID Connect SSO (Keycloak - LDAP - Active Directory), the account is added to the internal directory and his groups don't match the groups in LDAP.  

When we change his groups in the Internal Directory; as soon as he logs out and in; the groups gets reverted.

We have deleted the account in Jira from the Internal Directory but as soon as the account logs in; it's added back to the Internal Directory.  [ The account does not have any activity in Jira. ]

Other new users stay in the LDAP directory and no issues with group membership...

Any ideas?

[Ivan]

Hi Dan, this usually happens when the SSO or user provisioning flow isn't correctly resolving the user against the LDAP directory during login. If the user isn't found in LDAP at that point, Jira creates a new user in the Internal Directory instead.

I’d recommend checking:
-Whether the user’s username or email in LDAP exactly matches what's coming from Keycloak. -That the LDAP directory is active and syncing correctly.
-That the SSO mapping is pointing to the LDAP directory as expected.

It might also help to look at the logs during login to confirm which directory Jira is trying first for that user. Since other users work fine, it's likely a mismatch or case sensitivity issue with this specific account.