nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Is a Jira internal directory admin account required when using LDAP?

Kevin Paulus

Our internet security boss wants "ALL" internal directory accounts removed. We use an LDAP directory (read-only with local groups). As the system admin, I have my LDAP account, but also two internal directory accounts used for access when the corporate exchange server is offline or when I need to replicate the permissions of another user's account to provide troubleshooting assistance.

Accepted answers

Florian Bonniec

Hi @Kevin Paulus

I do not recommand to remove all internal account but keep at least 1 user admin. If you remove all of them and have an issue with your AD, you will be locked from JIRA. Same if the user account to connect to the AD changed you will not be able to log in again into JIRA. More over you cannot edit the directory you "come from" so if you want to update the AD Directory you need an account that do not come from this AD.

Regards

All comments

Florian Bonniec

Hi @Kevin Paulus

Regards

Kevin Paulus

Thank you Florian,
I think its a case of educating the boss on how the software they bought works. I'm sure they will point to the recovery mode as the recommended process, but we have been there previously and that is just not as simple as the instructions claim. I was hoping to find a direct statement in the software documentation that better explains the purpose of the internal directory. I am still looking.

Florian Bonniec

The process of the recovery user is defined below.

https://confluence.atlassian.com/jirakb/restore-passwords-to-recover-admin-user-rights-972329273.html

I would say that it's less an issue than before since you do not have downtime since JIRA DC.

It also require access to the node system, so in big company it can be an isue as it will not be reactive enough.

Regards

Kevin Paulus

@Florian Bonniec ,
We're not in DC yet but are working our way up that path.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

jira-software

jira-software-server