Linking user directories with Active Directory

[Behi Shamsai]

Good Afternoon,

I am trying to integrate Confluence with my Microsoft Active Directory, but i seem to be having issues. User are also unable to log in. I have a feeling that this issues are related.

Please assist me in setting up this connection.

When i perform the Remote Directory Connection Test, i get the following results:

---------------------------------------------

Test basic connection : Succeeded

Test retrieve user : Succeeded

Test user rename is configured and tracked : Succeeded

Test get user's memberships : Failed

Test retrieve group : Not performed

Test get group members : Not performed

Test user can authenticate : Succeeded

----------------------------------------------

Here is my configuration:

-----------------------

=== Directories configured ===
Directory ID: 294913
Name: Confluence Internal Directory
Active: true
Type: INTERNAL
Created date: 2018-12-05 11:56:25.073
Updated date: 2018-12-05 11:56:25.073
Allowed operations: [UPDATE_GROUP, UPDATE_ROLE_ATTRIBUTE, DELETE_GROUP, UPDATE_ROLE, DELETE_USER, CREATE_ROLE, CREATE_USER, DELETE_ROLE, UPDATE_USER_ATTRIBUTE, UPDATE_GROUP_ATTRIBUTE, UPDATE_USER, CREATE_GROUP]
Implementation class: com.atlassian.crowd.directory.InternalDirectory
Encryption type: atlassian-security
Attributes:
"user_encryption_method": "atlassian-security"

Directory ID: 1179649
Name: NRG Domain Controller
Active: true
Type: CONNECTOR
Created date: Wed Dec 05 15:30:24 PST 2018
Updated date: Wed Dec 05 17:29:32 PST 2018
Allowed operations: [UPDATE_GROUP, UPDATE_GROUP_ATTRIBUTE, DELETE_GROUP, UPDATE_USER_ATTRIBUTE, CREATE_GROUP]
Implementation class: com.atlassian.crowd.directory.MicrosoftActiveDirectory
Encryption type: sha
Attributes:
"com.atlassian.crowd.directory.sync.issynchronising": "false"
"com.atlassian.crowd.directory.sync.lastdurationms": "1969"
"com.atlassian.crowd.directory.sync.laststartsynctime": "1544059770324"
"crowd.sync.group.membership.after.successful.user.auth.enabled": "only_when_first_created"
"crowd.sync.incremental.enabled": "true"
"directory.cache.synchronise.interval": "3600"
"ldap.basedn": "DC=ad,DC=nrgmr,DC=com"
"ldap.connection.timeout": "10000"
"ldap.external.id": "objectGUID"
"ldap.filter.expiredUsers": "false"
"ldap.group.description": "description"
"ldap.group.dn": "OU=Geographic Locations"
"ldap.group.filter": "(&(objectClass=group)(cn=*))"
"ldap.group.name": "cn"
"ldap.group.objectclass": "groupOfUniqueNames"
"ldap.group.usernames": "member"
"ldap.local.groups": "true"
"ldap.nestedgroups.disabled": "true"
"ldap.pagedresults": "false"
"ldap.pagedresults.size": "1000"
"ldap.password": ********
"ldap.pool.timeout": "0"
"ldap.propogate.changes": "false"
"ldap.read.timeout": "120000"
"ldap.referral": "false"
"ldap.relaxed.dn.standardisation": "false"
"ldap.roles.disabled": "true"
"ldap.search.timelimit": "60000"
"ldap.secure": "false"
"ldap.url": "ldap://lax2nrgdc01:389"
"ldap.user.displayname": "displayName"
"ldap.user.dn": "OU=Geographic Locations"
"ldap.user.email": "mail"
"ldap.user.encryption": "sha"
"ldap.user.filter": "(&(objectCategory=Person)(sAMAccountName=*))"
"ldap.user.firstname": "givenName"
"ldap.user.group": "memberOf"
"ldap.user.lastname": "sn"
"ldap.user.objectclass": "user"
"ldap.user.password": "unicodePwd"
"ldap.user.username": "cn"
"ldap.user.username.rdn": "cn"
"ldap.userdn": "ldap_service"
"ldap.usermembership.use": "true"
"ldap.usermembership.use.for.groups": "true"
"localUserStatusEnabled": "false"

[Diego]

Hello there!
Behi, thanks for reaching out to our Community.
There is a possibility that one or more users do not have any group memberships in your LDAP. This can trigger the warning but as long as the authenticate, user rename, retrieve user and connection checks are good, users should be able to login.

Looking at your settings, it seems that you are using local groups with the connector. You could try and add one of the users that is unable to login to the confluence-users group (this group has login permissions by default. This is the Can Use global permission). After adding the user to the group, check if the login procedure works.

To add the user you can proceed as follow:

1- Click Cog Icon > General Configuration

2- Search for Groups in the left hand side

3- Search for the confluence-users group

4- Select the group

5- Click Add Members

6- Insert the username of one of the affected users

       * You can also click the magnifying glass and search for the user

7- Click Add

8- Try to login after adding the user to the group

You can check further information about the Can use permission here:

Global Permissions Overview

More information about the Local Groups and LDAP:

Connecting to an LDAP directory

Let us know if this helps you!