users not being removed from jira-users upon deactivation

Question

Hello,

We use LDAP to manage our AD groups, however, anytime a user needs to be added to jira-users, we utilize the default group membership functionality in the JIRA user directory, however, when it comes time to deactivating the user via LDAP, the users aren't being automatically removed from jira-users.

We have our user directory type configured to use: Microsoft Active Directory (Read Only, with Local Groups)

Does it have anything to do with that configuration?

Thanks,
Scott

Robert Wen_Cprime_ · Answer

Jira synchronizes between the user/groups on the internal directory and the external (LDAP) directory.  The synchronization automatically happens if you have it set to read/write instead of read only, with local groups)

Here's the page that talks about synchronization: https://confluence.atlassian.com/adminjiraserver/synchronizing-data-from-external-directories-938847064.html

Scott McDonald_qykakt · Answer

Hi @Robert Wen_Cprime_ ,

I see what you're saying.  Any group that is managed internally by JIRA software (jira users, jira-developers, etc), will need to be managed by LDAP if I want them removed.  Will that create duplicates upon creation of the user?

If these users are stored in a jira-users AD group, will that effectively add them to the jira-users group in JIRA software as well?  How with JIRA know which group is the correct one?

Thanks,
Scott

Robert Wen_Cprime_ · Answer

Hi @Scott McDonald

Yes, I believe that's what's going on.  Because you're adding the user to the Jira user directory (which is a separate directory than LDAP), when you deactivate that user, it won't disappear from the Jira user directory.

You'll need to add users on a jira-users group managed by LDAP and remove the jira-users group in the Jira user directory.  If you have both user directories, the Jira user directory is the best place for admin accounts just in case something wrong happens with LDAP.