How to debug Confluence LDAP authentication agains two directories?

[Sorin Sbarnea (Citrix)]

I am trying to add another Active Directory for authenticating on Confluence 3.5.13 but I am not able to login with any user on the new directory.

Both directories are Microsoft Active Directories and I am able to bind on them with an utility, still Confluence doesn't seem to let me authenticate users with the new one.

• I tried to change directories order
• I see nothing interesting in the server logs (even after switching to debug mode)

[Sorin Sbarnea (Citrix) · Accepted solution]

Enable logging for crowd - Confluence has an internal version inside.

It seems that atlassian did not spend too much time setting and documenting the correct LDAP configuration for Microsoft Active Directory. Here is a set that is optimized

# User Schema Settings
User Object Class: person
User Object Filter: (&(samAccountType=805306368)(sAMAccountName=*))
User Name Attribute: sAMAccountName

Note: I'm still working to improve the settings and I will update the answer. On my TODO list: filtering the disabled accounts and improving the filters for the groups, now I have "only" 13000 of them.

[HuseinA]

On my TODO list: filtering the disabled accounts

Currently this is not possible in Confluence out of the box. It's being tracked at https://jira.atlassian.com/browse/CONF-24786 . But it's achievable by adding the following in your User Object Filter:

!(userAccountControl:1.2.840.113556.1.4.803:=2)

So it should look something like this from your original User Object Filter:

(&(samAccountType=805306368)(sAMAccountName=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

[Colin Goudie]

What groups are coming in on the 2nd AD connection? And do any of these group have permissions in Global Permissions to access Confluence?