ScriptRunner Behaviour: Validate selected users have the same direct manager (LDAP)

[#1]

Hi everyone,

I wanted to share a ScriptRunner Behaviour I recently developed for Jira Data Center that solved a business requirement in one of our approval workflows.

Business use case

We wanted to automatically route requests to a supervisor for approval.

However, when multiple users are selected in a Multi User Picker, the request can only be routed automatically if all selected users report to the same direct manager.

To enforce this, I created a Behaviour that validates the selected users before the issue is created or updated.

What the Behaviour does

• Retrieves each selected user's manager attribute from Active Directory (LDAP)
• Supports multiple LDAP directories
• Searches users using sAMAccountName, userPrincipalName, or mail
• Uses in-memory caching to reduce LDAP lookups
• Displays an immediate validation error when users have different managers

This allows the approval workflow to safely determine a single supervisor without requiring users to manually select an approver.

I've published a generalized version of the script in my public Bitbucket repository:

👉 View the script:
https://bitbucket.org/gorgreyan/jira-scriptrunner-scripts/src/main/behaviours/validate-users-have-same-manager.groovy?at=main

This is the first script in the repository, and I plan to continue sharing reusable ScriptRunner examples for Jira Data Center. I hope they'll be useful to other Jira administrators and ScriptRunner developers.

I'd love to hear how you've approached similar requirements. Have you implemented manager-based approvals or reporting-line validation in your Jira environment? If so, did you use LDAP, another directory service, or a different approach altogether?

[Matt Doar _Adaptavist_]

Neat use of ScriptRunner. But how does the person selecting the users know which users to choose that should have the same manager? The multiselect list probably doesn't show that. I guess the error could maybe show a list of suitable users to try, perhaps.

[Gor Greyan]

Thanks, @Matt Doar _Adaptavist_I appreciate the feedback!

The main purpose of the Behaviour is actually to prevent users from selecting employees from different reporting lines.

The request is automatically routed to the selected users' direct supervisor for approval. If users with different direct managers are selected, the system wouldn't be able to determine a single approver, so the approval automation would fail.

In our case, the validation is intended to enforce that business rule before the request is submitted. That said, I agree that providing more guidance to the requester, such as indicating compatible users or offering clearer suggestions, would be a nice enhancement from a usability perspective.

Thanks again :)