nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How to limit AD-synchronization to AD-Groups

Martin Krimpelbein

Hi there,

I'm a newbee in the Atlassian world - using Confluence and Jira Software/Servicedesk on our own infrastructure/network on a server.

I could manage to connect Confluence and Jira to our Active Directory. Works like a charme.

But I need to limit the synchronization to only one specifiy active directory group - our complete AD got about 200.000 users and the sync needs at last 60-90 seconds.

But i could't find any (for me) suitable "admin manual".

Can anybody help me and tell me what I need to set in the AD-configuration that the sync only work with a specific global group?

Thanks in advance. Have a nice day.

Accepted answers

All comments

Vickey Palzor Lepcha

User or Group Filters on the AD Configuration Page.

If you can add all JIRA Users to one group in AD.

Using that Group as the basis - filter all other users except users in that group in AD.

Martin Krimpelbein

Sorry, but I need to describe it step by step, because I'm not an AD-specialist. I was lucky that I found the Base DN Settings in another document for a complete diffrent topic, so I just copied and pasted it.

Otherwise I'would never be able to pass that configuration

But now it seems, that I need to make special commands

So here's what I understand:

I need to go to the AD Configuration page.

Than going to the entrie "Additional Group DN"

and now? What do I need to write in there?

Just the group I want the synchronization to work with - or do I need some of that (for me) cryptic things like OU=, DC= blablabla.

Info: The AD itself or any content can not be edited due to restrictions. It's just possible to use it for authentification - nothing more.

Vickey Palzor Lepcha

You need to find a commonality between all the users that you would want to sync from your AD.

All your JIRA Users in the AD, if they fall under one common group then you can use the DN which is common between all users .

You will have to get a help from some AD Admin who administers your organization AD and who can give you the requisite DN format

Like in some firms I know, all users are a member of one common group in AD - so that is the common point from where you can start.

Martin Krimpelbein

Mhhh seems that I dont understand it right.

I thought the Base DN that I set up ist the commonality between all users - complete AD with 200.000 people.

And to minimize this full sync I have to add a parameter in the field "Additional Group DN"

But your last post confused me because it sounds for me that i have to set the Base DN including the parameter for the specific AD-group.

Sorry, but english is not my native language - maybe theres a translation error in my brain

Andrew Laden

They don't describe it well for someone who isnt well versed in LDAP.

Remember that you are looking at a hierarchical directory. ie, a tree structure.

BaseDN is the topmost point in the tree that you will be looking for anything.

Additional User DN is a way to pick a lower point in the tree to start looking for users. ie, if the users you care about are all in a specific OU, you can tell LDAP to just look in that OU. It is preponderated to the Base DN. (ie if your baseDN is "DC=Company,DC=com" and your Additonal User DN is "OU=users" then it will only look for users in the full DN "OU=users,DC=company,DC=com" Users outside of that OU will not be seen.

Additional Group DN is the same but for GROUPS. It has nothing to do with looking up users. If you Additional Group DN is "OU=groups" then it will only look for groups in the DN "OU=groups,DC=Company,DC=com" It doesnt limit in any way what users a imported.

So to limit your users, you can do a few things.

1: If possible. put them all in the same OU, then you can use the Additional User OU setting to limit your import to those users.

2: Under "User Schema Settings" there is an option "User Object Filter". This allows you to filter what users are imported. But it has to be a valid LDAP filter.

https://ldap.com/ldap-filters/

https://confluence.atlassian.com/kb/how-to-write-ldap-search-filters-792496933.html (has good examples for AD)

Here is where it gets tricky, Some LDAP servers support the "memberOf" attribute. If yours does, you should be able to write

(&(objectCategory=Person)(sAMAccountName=*)(memberOf=cn=CaptainPlanet,ou=users,dc=company,dc=com))

But there are lots of caveats. (doesnt work with nested groups, for example)

You are best off using ldapsearch to help build your filter to make sure it catches what you want, and then putting that filter in the User Object Filter.

Martin Krimpelbein

Hey - thanks for your help. I think I got it now

I have to choose Option 2 due to massive restrictions of our company AD.

First I have to check, if my group isn't a nested group - hopefully not.

If it's not - and our LDAP support the "memberof" attributes, I got a chance that you already provide the valid string

Due to the limitation of Windows based PCs I need to use the powershell ad-cmdlets.

I'll try on Thursday and give a feedback.

Thanks again!

Andrew Laden

Take a look at the atlassian link, they talk about Nested groups with AD

And this will search for users that are a member of this group, either directly or via nesting:

(&(objectCategory=Person)(sAMAccountName=*)(memberOf:1.2.840.113556.1.4.1941:=cn=CaptainPlanet,ou=users,dc=company,dc=com))

Important for Active Directory to have memberOf:1.2.840.113556.1.4.1941 if you want to find nested groups (do not replace the numeric string) inside CaptainPlanet group.

JP _AC Bielefeld Leader_

Hi,

you can try out the Softterra LDAP Browser to play around with LDAP filters.

@Andrew Laden is right: The Additional User/Group DN just set the start search branches in the LDAP tree to search for users / groups.

The way to go is to use the User Object Filter. One hint: Make sure that an email attribute is set on an LDAP user object & don't let user object in your Jira without an email attribute.

We use:

(&(sAMAccountType=805306368)(mail=*)(!(|(cn=ws*)(cn=ts*))))

The filter on users having a cn starting with ws (webservice) and ts (technical service) is specific to our AD. The sAMAccountType accelerates search for users.

Be careful with nested groups.

Best

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

confluence-server

jira

jira-software

jira-server

jira-software-server

group

active-directory