Migrating to Delegated LDAP: How can I get existing Internal users to use LDAP for authentication?

Rick Trudeau

I am running Jira 4.3.4.

Initially, we setup all our users to use the "JIRA Internal Directory".

We are now deciding that we would like to delegate authentication to our LDAP server. After creating a new User Directory "Delegated LDAP Authentication", I see that when creating a new user I can select this as the user's directory, instead of "Jira Internal Directory". After this, these new users attempting to authenticate go via LDAP, as expected.

But I'm wondering about the pre-existing users I had prior to configuring the Delegated LDAP. These users continue to show "Jira Internal Directory" for their configured directory and there doesn't appear to be a way to modify this.

Eventhough I've moved the Delegated LDAP Directory to the top of the list in the User Directories, my pre-existing users with "Jira Internal Directory" can still authenticate using their JIRA passwords eventhough the users do exist in my LDAP server.

Is there a way to configure these pre-existing users to now authenticate through my LDAP Server instead of the Jira internal directory?

Gregory Suddert

This is what we did last night for Confluence, but it will help in figuring out what you need from support. We migrated from 3.4.6 to 3.5.13 (thanks to Adam Laskowski!) and had to do a couple of steps that were counter-intuitive (this from our upgrade support issue, the bold ones are from our particular installation):

1. Do NOT copy your atlassian-user.xml over to your 3.5 instance.
2. Copy over the HTTPS settings in the INSTALL/bin/setenv.sh
   Perform the upgrade to 3.5 using the normal methods: untar the install, point the confluence-init.properties to the 3.4 home folder, start it up.
3. Copy over the datasource in the server.xml
4. Copy JDBC driver: ojdbc14.jar
   Let the upgrade finish, and once you see a login page/dashboard, shut down.
5. Copy your atlassian-user.xml to your 3.5 instance and start it up again.
6. Create the Internal with LDAP Auth directory.
7. Navigate to BASEURL/admin/migrate-external-memberships.action and run the migration (~7 minutes).

There is a migration magical script for the groups too. DON'T RUN THIS until you talk to the actual support guys...but at least you'll know what to ask for! Hope this helps!