Issues with AD user not syncing after email change

Question

User requested an email username change to reflect the name they go by, not their first name. User was in Confluence 7.13.7 prior to the email username change. Once the change happened with AD, the user was moved to "Unsynced from Directory". The user had never logged into Confluence so the unsynced user was deleted as part of troubleshooting the issue. Now after the AD sync, the user with old or new email username is not in the list of users. I have confirm the user has the correct roles, removed the roles from the user and added them back with no success. We are using OKTA for SSO and can see successful login attempts in the OKTA logs. Wondering if anyone has run into this issue or has any idea how to bring the user in to Confluence through the associated AD. If user attempts to log directly into Confluence and not through SAML, they receive a username and/or password are incorrect error.

Benjamin_tmh9yg · Answer

Hi @Chase Gonzales ,

Good Find. That would probably be it based on confluence data model:

https://confluence.atlassian.com/conf719/confluence-data-model-1157467603.html

According to the documentation for the cwd_tombstone table:

Records removed users, groups, memberships and aliases during incremental synchronization for external user directories.

Maybe worth to do a full resync before trying to remove the entry from the table.

-Ben

Chase Gonzales · Answer

Hello Ben,

We have confirmed that new users are being imported and changes to users are being sync'd. The only reference I can find for her account so far is under cwd_tombstone. Would this prevent the user from being re-imported?

Benjamin_tmh9yg · Answer

HI @Chase Gonzales ,

No difference between the two in terms of AD syncing. Is the any new user being created? Want to make sure its still isolated at this point.

It may be stored in the DB. Try viewing the logs while sync the directory and see it there's any warnings or errors, it might gives some hints about conflicts.

Here's an article about Syncing issues when a user is deleted:

https://confluence.atlassian.com/jirakb/deleted-user-from-active-directory-is-not-synchronised-in-jira-service-management-application-1081352476.html

It may not be the exact situation but it may lead you to some options and ideas.

-Ben