There are two ways to setup partial Directory authentication in Jira but the differences between them are not quite well documented. Which are they? * LDAP with local groups * Internal with LDAP authentication I am interested about ALL things that are different between this two types of setups. I discovered few of them, but it is essential to know them all. I know: * On LDAP-with-local-groups if the user is not returned by the LDAP, Jira will remove all group memberships from the user, without providing any way to put them back, other than manually. I think that this can happen even when one of the delegated LDAP servers fail to repond (you get a partial response). * On Internal-with-LDAP-auth nothing happens when the user is removed, still he will not be able to login obviously. * Even if Jira nows have an "active" attribute attached to users, there is no way of changing this attribute based on what LDAP returns. Obviously, Jira LDAP settings should include an LDAP filter which extracts this information, there a

Hi Sorin, It is quite tough to explain the difference between both of the mentioned directories without specifying which area you are interested in. In general, the integration method between JIRA and LDAP differenciate by two methods: * DELEGATED (Internal with LDAP Authentication) * CONNECTOR There are several point that differenciate these method * Delegated method does not have the ability to write into LDAP server while CONNECTOR have * DELEGATED method does not synchronize to your LDAP as CONNECTOR is * DELEGATED retrieve user information during the authentication process, CONNECTOR retrieve user information during synchronization process * DELEGATED could retrieve group membership during the authentication process, CONNECTOR able to retrieve LDAP groups and mapped the membership during the synchronization process The above differrences is just some of the general points, hope this would help clarify your doubts on this. Cheers, Septa Cahyadiputra

nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

What are the differences between using LDAP with local groups and Internal with LDAP authentication on Jira?

Sorin Sbarnea (

There are two ways to setup partial Directory authentication in Jira but the differences between them are not quite well documented. Which are they?

LDAP with local groups
Internal with LDAP authentication

I am interested about ALL things that are different between this two types of setups.

I discovered few of them, but it is essential to know them all.

I know:

On LDAP-with-local-groups if the user is not returned by the LDAP, Jira will remove all group memberships from the user, without providing any way to put them back, other than manually. I think that this can happen even when one of the delegated LDAP servers fail to repond (you get a partial response).
On Internal-with-LDAP-auth nothing happens when the user is removed, still he will not be able to login obviously.
Even if Jira nows have an "active" attribute attached to users, there is no way of changing this attribute based on what LDAP returns. Obviously, Jira LDAP settings should include an LDAP filter which extracts this information, there a

Accepted answers

Septa Cahyadiputra

Hi Sorin,

It is quite tough to explain the difference between both of the mentioned directories without specifying which area you are interested in.

In general, the integration method between JIRA and LDAP differenciate by two methods:

DELEGATED (Internal with LDAP Authentication)
CONNECTOR

There are several point that differenciate these method

Delegated method does not have the ability to write into LDAP server while CONNECTOR have
DELEGATED method does not synchronize to your LDAP as CONNECTOR is
DELEGATED retrieve user information during the authentication process, CONNECTOR retrieve user information during synchronization process
DELEGATED could retrieve group membership during the authentication process, CONNECTOR able to retrieve LDAP groups and mapped the membership during the synchronization process

The above differrences is just some of the general points, hope this would help clarify your doubts on this.

Cheers,
Septa Cahyadiputra

All comments

Renjith Pillai

You have already answered your question

In simple terms, delegated LDAP uses LDAP only for authentication. All group information is internal to JIRA and LDAP connection is readonly. On the other hand a direct LDAP connection can sync users, groups from LDAP to JIRA. It can also write back groups and users to LDAP.

Septa Cahyadiputra

Hi Sorin,

It is quite tough to explain the difference between both of the mentioned directories without specifying which area you are interested in.

In general, the integration method between JIRA and LDAP differenciate by two methods:

DELEGATED (Internal with LDAP Authentication)
CONNECTOR

There are several point that differenciate these method

Delegated method does not have the ability to write into LDAP server while CONNECTOR have
DELEGATED method does not synchronize to your LDAP as CONNECTOR is
DELEGATED retrieve user information during the authentication process, CONNECTOR retrieve user information during synchronization process
DELEGATED could retrieve group membership during the authentication process, CONNECTOR able to retrieve LDAP groups and mapped the membership during the synchronization process

The above differrences is just some of the general points, hope this would help clarify your doubts on this.

Cheers,
Septa Cahyadiputra

Sorin Sbarnea (

Thanks, clearly the linked page gives a lot of usefull information about how directory works. Does it happen for you to know if there are any performance implications or others regarding reliability and the posibility to fallback to other directory server if one is down?

Septa Cahyadiputra

Please refer to our limitation documentation here:

Limitation and User Management Recommendation

If you do have a clone LDAP server you could create two directory while the other is disabled when the first order LDAP server is working fine. When its down, just activate the second directory and disable the first one. This should works fine as JIRA use username to mapped the content instead of ID, so if the username is exactly the same, it should be fine.

Sorry to inform you that this process could not be automate by default.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

openldap

ldap