Sync users group and membership between Cloud and OnPremise

[Patrice Champet]

Hello,

We are using some atlassian products on Cloud and some others on Premise.

We are looking for a way to sync group membership for the groups existing on both platform for the groups that are locally managed (Crowd on Premise and Access on Cloud)

Did you face this kind of issue ?

How do you handled it ?

Thanks !

[Nic Brough -Adaptavist- · Accepted solution]

Hi Patrice,

What are you using for the user directories in Access and Crowd?  The best way to "sync" is to have them both use the same directory.

[Marc - Devoteam]

Hi @Nic Brough -Adaptavist- 

I think @Patrice Champet is talking about locally created groups in Cloud and Crowd, not SSO/AD related groups.

I don't think there is an option to keep this in sync. I think they should get managed in an user directory solution to keep aligned for both Cloud and Crowd

[Nic Brough -Adaptavist-]

Yes, that's why I asked.

If the user directories are different (e.g. using Atlassian accounts for Cloud and Crowd for server), then there's no synchronisation possible, beyond duplicating and botching the accounts together (which will go wrong)

[Patrice Champet]

Hi @Nic Brough -Adaptavist- , @Marc - Devoteam 

Thanks for your answers.

The point is that we have, as part of our legacy, access groups for our On Premise and Cloud apps in AD, using SSO.
But, as many company I think, we need to restrict Jira Project and Confluence Spaces to some group of users, for instance OU or project.
As the structure and groups existing in our AD are not reflecting OU or projects, we used to create these groups in CROWD.
So On Premise, we used to have these groups in CROWD, sync to all our Atlassian Landscape.

In our migration to the Atlassian cloud journey, we moved Confluence first.
The migration process just created the same groups used on our OnPremise solution.

But they are now unsync with our Crowd.

So this was to be clearer.

To fix this we created a sync job, that is checking diff between groups on Crowd and Access, and adding or removing the users from the cloud groups when necessary so that our OnPremise data and group membership remains the reference for the time being.

So the script is working as expected, the tricky part is that Cloud User Search seems to have a lot of bugs. There is some tickets open on Atlassian side.
https://jira.atlassian.com/browse/ID-8089