Removing groups from user in Crowd, user still can access Jira ?

Hans Pesata

Hi!

We are using Crowd 3.7.0 with a Delegated Authentication Directory with a LDAP Connector. We created an Application so the users can access Jira and
the users get created, when they first log in.

I assume, that the users can also be pre-created via an import ?

We assign the appropriate groups to the users and users can start using Jira.
When we remove the groups from a user in Crowd, interestingly the user is still able to access Jira ?! Is this a cache related issue or is there an additional step necessary after removing the groups so the user doesn't have permission anymore to access Jira ?

Regards,
Hans

Marcin Kempa

Hi @Hans Pesata

Thanks for reaching out to Crowd's community!

Let me start from rephrasing your problem description to make sure I understand it correctly.

1. You have Crowd (3.7.0) and you've defined Delegated Authentication directory which is connected to some remote LDAP where you keep your users.
2. You also have Jira deployed and a Jira application created in Crowd.
3. You connected directory (from point 1) to your Jira application in Crowd
4. When the user logs in to Jira, authentication requests goes to Crowd, then to remote LDAP and the user is created

There are also some things that I am not sure as those are not mentioned in your post however I assume that:

1. You are creating groups manually in your directory in Crowd itself
2. You configured that 'all groups' can authenticate to Jira application in Crowd (https://confluence.atlassian.com/crowd/specifying-which-groups-can-access-an-application-25788430.html)
3. When you remove groups from user, this user can still authenticate in Jira and has same permissions as before

I think that this situation might be because of two things in your config (bare in mind that I base that on some assumptions):

• You have configured that 'all groups' can authenticate to Jira application in Crowd (this means that Crowd won't be checking group memberships, so even if user does not have groups assigned would be able to pass login in Crowd itself at least)
• Secondly in Jira you have selected that "Update group memberships when logging in": "For newly added users only". This means that even when user logs in to product memberships won't be updated at that time, only after next synchronization with Crowd, which is kind of a 'cache' issue. This is not well documented unfortunately (https://jira.atlassian.com/browse/JRASERVER-65260)

 

Regarding:

I assume, that the users can also be pre-created via an import ?

You can specify different type of directory, a connector one which will be periodically synchronizing users and groups from your remote LDAP to Crowd.

If you are not interested with that and you would like to just import them once, there are some import capabilities https://confluence.atlassian.com/crowd/importing-users-and-groups-into-a-directory-25788445.html

 

Hope that helps,

Marcin Kempa