What is the best method to incorporate multiple layers of Active Directory for users?

[Dan Leatherwood]

Currently, we have an Active Directory group to which all users have to be members for authentication into JIRA.  From there we are manually creating the users within JIRA and assigning them to specific projects.

We want to increase security and we want to know if there is a way to add another layer of Active Directory groups at the project level.  Each of our business areas has an Active Directory group designation and each of our Application Development areas has an Active Directory group designation.  So, we are wondering if we can assign a "second layer" of Active Directory so that only the people in their area's AD group will have access to a specific project.

[Andrew Laden]

I am assuming you have your jira instance connected to your Active Directory instance already.  (though I am confused. You shouldnt have to manually create users if you do. But if you dont, I dont know how you are using an AD group to control authentication.) If you dont have your jira connected to AD, I would start there by adding it as a User Directory.

You can use AD groups, and assign the groups to project roles. The project role will control permissions.

So for example, you create a role called "participants".

In your permission scheme, you limit Browse Project permissions to the Participant role (remove all logged in users, etc)

You can create a AD group called "jira-projectblah-participants" and only add people to that group who should have access to the project.

Finally in the project, you add that AD group to the project as role "Participants"

Bingo. only people in that AD group can access that project.

You want to get out of the habit of adding users directly to project roles. Managing groups is much easier.