nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How to debug Confluence LDAP authentication agains two directories?

Sorin Sbarnea (

I am trying to add another Active Directory for authenticating on Confluence 3.5.13 but I am not able to login with any user on the new directory.

Both directories are Microsoft Active Directories and I am able to bind on them with an utility, still Confluence doesn't seem to let me authenticate users with the new one.

I tried to change directories order
I see nothing interesting in the server logs (even after switching to debug mode)

Accepted answers

Sorin Sbarnea (

Enable logging for crowd - Confluence has an internal version inside.

It seems that atlassian did not spend too much time setting and documenting the correct LDAP configuration for Microsoft Active Directory. Here is a set that is optimized

# User Schema Settings
User Object Class: person
User Object Filter: (&amp;(samAccountType=805306368)(sAMAccountName=*))
User Name Attribute: sAMAccountName

Note: I'm still working to improve the settings and I will update the answer. On my TODO list: filtering the disabled accounts and improving the filters for the groups, now I have "only" 13000 of them.

All comments

Colin Goudie

What groups are coming in on the 2nd AD connection? And do any of these group have permissions in Global Permissions to access Confluence?

Sorin Sbarnea (

Enable logging for crowd - Confluence has an internal version inside.

It seems that atlassian did not spend too much time setting and documenting the correct LDAP configuration for Microsoft Active Directory. Here is a set that is optimized

# User Schema Settings
User Object Class: person
User Object Filter: (&amp;(samAccountType=805306368)(sAMAccountName=*))
User Name Attribute: sAMAccountName

HuseinA

On my TODO list: filtering the disabled accounts

Currently this is not possible in Confluence out of the box. It's being tracked at https://jira.atlassian.com/browse/CONF-24786 . But it's achievable by adding the following in your User Object Filter:

!(userAccountControl:1.2.840.113556.1.4.803:=2)

So it should look something like this from your original User Object Filter:

(&amp;(samAccountType=805306368)(sAMAccountName=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

active-directory

ldap