Is it possible to update user information created by Active Directory Server if we disable the sync?

[JT Tsai]

We are planning to enable SSO for JIRA/Confluence. Currently all the users are created via Microsoft Active Directory which means they are read-only. The user names for SSO are different from the AD so I need to manually change them. I was thinking if I can stop the synching of the user accounts from AD, then I can update them manually. Yes?

[Brant Schroeder]

f you are using Active Directory as a user directory in JIRA this is connected via LDAP and the usernames would need to be changed in AD.  For JIRA username ( login name ) is the primary key, so if you change it JIRA thinks it's just another user.  You can change first name, last name, and display name. 

With that being said you could try to user the scriptrunner plugin. It has a built in script for changing username but you would have to write your own script to check for LDAP changes.  Don't know if it would work it you are trying to change directories though since you are moving to SSO.  You could always try in a test environment before making any changes in your production instance.

[JT Tsai]

Hi Brant,

Thanks for your answer. I need to clarify the requirement. Currently the AD's username is their workstation username but for SSO, the username is some unique name that the users created themselves from third-party SSO; therefore I need to change their JIRA username (currently their AD username) to match their SSO username. I was able to test this by changing the AD to allow write/read and I was able to change the  JIRA username (luckily, changing JIRA username doesn't count as another user) but I don't want the changed JIRA username to update the AD username. This is where my problem lies.

My first thought is that I just need to stop the AD from synching (basically a cut-off point where now users are manually created and use SSO username) but the problem when I stopped the synching, the JIRA users that are created by AD disappeared. I'm not sure if there is anyway to override that?