nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

[Solved] LDAP + internal authentication

Philippe Leména

[English version]

Hello,

We use our Jira server for different projects. The first one we have started is open to external users with the ability for them to create their own account in Jira.

Now, we need to start a new project for our staff and we have a LDAP that could be used for authentication.

Is it possible to have in the same server the two kinds of authentication : LDAP for our staff and internal Jira directory for external users ?

[French version]

Bonjour,

Nous utilisons notre serveur Jira pour plusieurs projets. Le premier projet que nous avons mis en oeuvre est ouvert à des utilisateurs externes, avec la possibilité pour eux de créer leur propre compte dans Jira.

Maintenant, nous avons un nouveau projet pour nos besoin internes qui sera ouvert à notre personnel et notre LDAP pourrait servir pour l'authentification de ces utilisateurs.

Est-il possible d'avoir les deux modes d'authentification sur le même serveur : LDAP pour notre personnel et répertoire interne à Jira pour les utilisateurs externes à notre organisation ?

Accepted answers

Manse Wolken

Hello Phillipe, bonjour Phillipe (et c'est tout je peut dis en francais, je dois continuer en anglais),

it is possible, even with older Jira Versions.

For current Jira versions you simply have to create a secnod user directory. Be sure to list it under the internal directory in the directory list.

Here is the excellent Atlassian documentation: https://confluence.atlassian.com/display/JIRA/Configuring+User+Directories

You can user Read Only LDAP with local Groups, if you want to be sure that Jira does not interfere with your LDAP setup.

Have fun

Manse

All comments

Manse Wolken

Hello Phillipe, bonjour Phillipe (et c'est tout je peut dis en francais, je dois continuer en anglais),

it is possible, even with older Jira Versions.

For current Jira versions you simply have to create a secnod user directory. Be sure to list it under the internal directory in the directory list.

Here is the excellent Atlassian documentation: https://confluence.atlassian.com/display/JIRA/Configuring+User+Directories

You can user Read Only LDAP with local Groups, if you want to be sure that Jira does not interfere with your LDAP setup.

Have fun

Manse

Philippe Leména

Thank you for your answer.

I've configured the new User directory with the type "OpenLDAP (Read-Only Posix Schema)" and testing answer it's OK but when I try to log in Jira with a new user present in LDAP, the connexion is rejected and I find this message in atlassian-jira-security.log :

2012-09-27 12:08:33,198 TP-Processor7 anonymous 728x407x1 1jt7hyy 172.26.3.21 /rest/gadget/1.0/login login : 'pcassagnes' tried to login but they do not have USE permission or weren't found. Deleting remember me cookie.

System Admin tells me that he can't find a connexion from Jira server to LDAP server.

Is there a place where I can see in the Jira Server if it has called LDAP server ?

Manse Wolken

Jira synchronises ever 60 minutes with LDAP and checks only user login in meantime.
And during your setup you have made an "ldap connecton test" if there was no errer (and I assume there was none) then Jira connects to LDAP correctly.

Have you set the location of your ldap groups? (Jira needs to read those).

If you don't want to create a jira-users group in LDAP (containing all of your ldap users that have to be able to log in to jira) then you have to enable a given LDAP group in Jira for Log in (thats in the GLOBAL settings)

https://confluence.atlassian.com/display/JIRA/Managing+Global+Permissions

The permission for the LDAP Group is: JIRA Users

Then your LDAP Users are able to log in to Jira.

Hint: I think the easier way is to create LDAP groups, named: "jira-administrators" "jira-developers" and "jira-users"

Cheers,

Manse

Philippe Leména

I don't understand the User Directory config screen same as I understand what you say in your last comment !

On the User Directory config screen, I can read, under the label "Default Group Memberships:"

A comma-separated list of groups that users will be added to when they first log in. These groups will be created if they don't already exist.

And for me it means that the user will be added in the Default Group Memberships in Jira when he logs in for the first time.

The Default Group Memberships was set by default to "jira-users" but in my french Jira, the equivalent group is called "GrpUtilisateurs" so I've changed this but same result : unknown Jira user existing in LDAP is refused par Jira.

I'va also tried to change the type of directory to simply "Open LDAP" and testing was OK but same result trying to log in with a new user.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

authentication

ldap