nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Jira LDAP integration and user passwords

Leo Catallo

I would like to set up Jira in a way that would be visible from Internet (and thus accessible to our partners) and at the same time would authenticate them with our Acitve Directory.

LDAP integration seems to be fairly straightforward in Jira, however I couldn't find any details as to what exactly does "synchronization" do. Looks like it basically replicates the user catalog from AD in Jira's database and the question I have to which I couldn't find an answer is: how are user passwords treated?

Does Jira replicate them in its database too?
Does Jira store them hashed or are they stored in cleartext?
Does LDAP synchronization mean that now I have an additional security risk of all passwords of all my AD users being stored in one more database?
Is this something that other people are concerned about?

Thanks.

Accepted answers

[]D []-[] [] []

that is my understanding of the LDAP-sync:

# Jira stores no passwords

# Authentification is made against LDAP-Directory

# Synchronisations means, that for example usernames, groups and groupmemberships are copied to the internal Jira-Directory so that permission-queries etc can be realized faster

All comments

Septa Cahyadiputra

Hi, In regards to LDAP users password, JIRA does not stored it at its database nor synchronize it. LDAP users credentials are keep in the LDAP server and JIRA will refer into it whenever an authentication process occurred. Hope it clarified your doubts. Cheers, Septa Cahyadiputra

Leo Catallo

Septa, in this case, what does synchronization do?

[]D []-[] [] []

that is my understanding of the LDAP-sync:

# Jira stores no passwords

# Authentification is made against LDAP-Directory

# Synchronisations means, that for example usernames, groups and groupmemberships are copied to the internal Jira-Directory so that permission-queries etc can be realized faster

Leo Catallo

That's what I thought as well, but this document https://confluence.atlassian.com/display/JIRA/Connecting+to+an+LDAP+Directory

has a list of settings that need to be configured and in "User Schema" there's

User Password Attribute

The attribute field to use when loading a user's password. Example:

uni

How is this used?

Septa Cahyadiputra

Synchronization will retrieve all user informations that is configured to be retrieved. Such as e-mail address and others. In the delegation processs, Confluence retrieve this information during authentication process which means Confluence retrieve the user information one in a time while synchronization, it will retrieve all users information in one process.

For example, in synchronization you should be able to see the users data after the synchronization process done while in delegation process, you would need to wait till the users authenticate against Confluence.

[]D []-[] [] []

just had a look into the DB (cwd_users) where i found the table-column 'credentials' which seems to store the encrypted password...

so the answer to your initial questions..

Does Jira replicate them in its database too?
Does Jira store them hashed or are they stored in cleartext?
Does LDAP synchronization mean that now I have an additional security risk of all passwords of all my AD users being stored in one more database?

.. must be:

Passwords are stored in the Jira DB (cwd-users) but they are hashed and can not be converted into clearext?!

I think there has to be an attribute for pw cause the admin-user has to store his pw somewhere but i dont know why Ldap-users pws have to be stored ...

Leo Catallo

That's what I saw too. At the same time, disconnecting LDAP connection (e.g. disabling the route on firewall) prevents Jira from authenticating LDAP users which means that it checks with the server anyway. So, the purpose of storing passwords is still unclear.

[]D []-[] [] []

Hi,

we are using a MS AD, for this kind of LDAP Jira fills the 'user password attribute' with 'unicodePwd'...

So if i clear the field and sync with the directory, will the pwds be purged from the Jira DB without any troubles?

Troy_Pawleska

I synced LDAP with Jira and all was working great I could login with my AD password, until I changed it in Jira, now I have two passwords, I can't get them to sync back up now. I'd like to have a single sign on.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

jira-administration