Crowd / Active Directory / Jira Internal user groups

[Christos Moysiadis]

Hello guys,

In the corp. they decided to stop using Crowd as the man in the middle with AD and Jira. So now i have a situation like this:

The problem now is that i don't have access to AD but only to Jira. That means that i can not add/remove/edit the groups of the users. For this reason i want to use the internal Jira groups instead of Active Directory groups for this case. 

The User groups have the same name in all 3 directories.

Is this possible? If yes what should i do?

[Jon Espen Ingvaldsen Kantega SSO]

Hi @Christos Moysiadis 

There are several ways for proceeding here from creating the internal directory all manually to construct it through a more automized batch operation. Another alternative is to create user records in Jira internal when they login. The latter is a feature found in some of the SSO apps for Jira.

Do you plan to setup some kind of SSO here (like Integrated Windows Authentication, or SAML SSO through AD FS or Azure AD)?

Regards,
Jon Espen
Kantega SSO

[Christos Moysiadis]

Hello @Jon Espen Ingvaldsen Kantega SSO ,

thank you for your quick response. At the moment we are not planning to setup a SSO , although its a great option.

Can the alternative solution that you propose , be achieved by "Internal with LDAP Authentication User Directory" option that already exists internally in Jira?

Best regards
Christos Moysiadis

[Jon Espen Ingvaldsen Kantega SSO]

You should give it a try! You have the option here to handle groups locally (which I believe is what you want.

https://confluence.atlassian.com/adminjiraserver/connecting-to-an-ldap-directory-938847052.html

Regards
Jon Espen
Kantega SSO

[Christos Moysiadis]

Thanks again for your support. One more question if its not a problem for you. 

I have this situation in db, in cwd_directory table more specific

Note: 

• directory_id 1 : Jira Internal Directory
• directory_id 10100 : Microsoft AD

What if i change all the groups, which have 1, to 10100 ?

PS: i know i should not touch the database data, but is it an option?

[Jon Espen Ingvaldsen Kantega SSO]

I am sorry, but I do not know how to handle this on the db level. You might be safe if you experiment in a separate test environment here.

Good luck!

-Jon Espen