nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

LDAP Atlassian-user.xml configuration

Mark Carbonara

I'm trying to use LDAP in BAMBOO and I'm very new with LDAP. THis is what I currently have in the Atlassian-User.XML file. I was wondering if I'm leaving something obvious out. I rebooted server and still can use an Active Directory account. When I log into BAMBOO ADMIN and try to SAVE the Custom User REpository I get the following error:

Failed to change the active user repository: Source 'C:\bamboo\xml-data\configuration\atlassian-user-custom.xml' does not exist

- <atlassian-user>

- <repositories>

</repositories>

- <ldap key="ldapRepository" name="ADConnect" cache="true">

<securityPrincipal>CN=LDAP Connect,OU=Domain Guests,OU=Domain Users,DC=nbme,DC=org</securityPrincipal>

<securityCredential>secret</securityCredential>

<securityProtocol>plain</securityProtocol>

<securityAuthentication>simple</securityAuthentication>

<baseUserNamespace>OU=Domain Users,DC=nbme,DC=org</baseUserNamespace>

<usernameAttribute>sAMAccountName</usernameAttribute>

</ldap>

</atlassian-user>

Accepted answers

Mark Carbonara

Yes once, I entered all the other fields which apparently bamboo must have, it started to work.

<firstnameAttribute>givenname</firstnameAttribute> <surnameAttribute>sn</surnameAttribute>

<groupSearchFilter>(objectClass=group)</groupSearchFilter>

<membershipAttribute>member</membershipAttribute>

All comments

Sultan Maiyaki

It seems correct but missing some group related attributes. can you try to create a new file called atlassian-user-custom.xml in the {{BAMBOOHOME/xml-data/configuration/}} directory and let it have same content as the atlassian-user.xml file. Let me know the outcome after restarting Bamboo whether Users will be retrieved.

Again try to add attributes like below as suggested in https://confluence.atlassian.com/display/BAMBOO/Integrating+Bamboo+with+LDAP:

<baseGroupNamespace>dc=groups,dc=perftest,dc=atlassian,dc=private</baseGroupNamespace>

<usernameAttribute>cn</usernameAttribute>

<userSearchFilter>(objectClass=inetorgperson)</userSearchFilter>

<firstnameAttribute>givenname</firstnameAttribute>

<surnameAttribute>sn</surnameAttribute>

<emailAttribute>mail</emailAttribute>

<groupnameAttribute>cn</groupnameAttribute>

<groupSearchFilter>(objectClass=groupOfNames)</groupSearchFilter>

<membershipAttribute>member</membershipAttribute>

Regards,
Sultan

Mark Carbonara

THe error about saving the User Repository went away by creating a new file as indicated above; however restarting bamboo still didn't get the AD users retrieved. I can only get in via the initial admin account. Strange because we use AD with JIRA as indicated below and have had no issues.Our JIRA product which works fine with LDAP is using the following: in the OSUSER.XML file:
<opensymphony-user>
<authenticator class="com.opensymphony.user.authenticator.SmartAuthenticator" />
- <provider class="com.opensymphony.user.provider.ldap.LDAPCredentialsProvider">
<property name="java.naming.factory.initial">com.sun.jndi.ldap.LdapCtxFactory</property>
<property name="java.naming.provider.url">ldap://dc4.nbme.org:389</property>
<property name="searchBase">OU=Domain Users,DC=nbme,DC=org</property>
<property name="uidSearchName">sAMAccountName</property>
<property name="java.naming.security.principal">CN=LDAP Connect,OU=Domain Guests,OU=Domain Users,DC=nbme,DC=org</property>
<property name="java.naming.security.credentials">secret</property>
<property name="exclusive-access">true</property>
</provider>
- <provider class="com.atlassian.core.ofbiz.osuser.CoreOFBizCredentialsProvider">
<property name="exclusive-access">true</property>
</provider>
- <provider class="com.atlassian.jira.user.osuser.JiraOFBizProfileProvider">
<property name="exclusive-access">true</property>
</provider>
- <provider class="com.atlassian.jira.user.osuser.JiraOFBizAccessProvider">
<property name="exclusive-access">true</property>
</provider>
</opensymphony-user>

Sultan Maiyaki

Hi,

Great.. can you try to use the paddle tool to check connectivity and users and groups retrieved https://confluence.atlassian.com/display/BAMBOO/Testing+LDAP+or+Active+Directory+connectivity+with+Paddle

Mark Carbonara

Ok I get the following error: If I take out the line " <ldap key="ldapRepository" name="ADConnect" cache="true">" it goes furhter then complains about the "<atlassian-user>" tag.

C:\TEMP>java -jar paddle-2.0.jar
################################################################################
###########################################

LDAP Support Tool version 2.0

################################################################################
###########################################

Error reading atlassian-user.xml file: No LDAP settings found in XML configurati
on.
com.atlassian.paddle.configuration.ConfigurationException: No LDAP settings foun
d in XML configuration.
at com.atlassian.paddle.configuration.AtlassianUserConfiguration.setAtla
ssianUserXml(AtlassianUserConfiguration.java:62)
at com.atlassian.paddle.configuration.AtlassianUserConfiguration.<init>(
AtlassianUserConfiguration.java:34)
at com.atlassian.paddle.Paddle.main(Paddle.java:44)

Mark Carbonara

When I moved the </repositories> tag after the </ldap> tag I got much futher. This is what I'm getting now; however I'm not so sure if this is an error of if these fields are even mandatory???

Connected to server successfully
-----------------------------------------------------------------
TEST 1: Search and list 10 users
-----------------------------------------------------------------

Configuration does not have a setting for 'baseUserNamespace'
Configuration does not have a setting for 'userSearchFilter'
Configuration does not have a setting for 'firstnameAttribute'
Configuration does not have a setting for 'surnameAttribute'
Configuration does not have a setting for 'emailAttribute'
Configuration does not have a setting for 'userSearchFilter'
Configuration does not have a setting for 'baseUserNamespace'
Configuration does not have a setting for 'userSearchFilter'
Configuration does not have a setting for 'baseUserNamespace'
Exception in thread "main" java.lang.NullPointerException
at javax.naming.InitialContext.getURLScheme(Unknown Source)
at javax.naming.InitialContext.getURLOrDefaultInitCtx(Unknown Source)
at javax.naming.directory.InitialDirContext.getURLOrDefaultInitDirCtx(Un
known Source)
at javax.naming.directory.InitialDirContext.search(Unknown Source)
at com.atlassian.paddle.search.DefaultSearcher.search(DefaultSearcher.ja
va:36)
at com.atlassian.paddle.task.ListUsersTask.doSearch(ListUsersTask.java:5
5)
at com.atlassian.paddle.task.ListUsersTask.withConnection(ListUsersTask.

Sultan Maiyaki

Hi,

Thats good.. the latest errors shows that you havent add the properties:

<baseGroupNamespace>dc=groups,dc=perftest,dc=atlassian,dc=private</baseGroupNamespace>

<usernameAttribute>cn</usernameAttribute>

<userSearchFilter>(objectClass=inetorgperson)</userSearchFilter>

<firstnameAttribute>givenname</firstnameAttribute>

<surnameAttribute>sn</surnameAttribute>

<emailAttribute>mail</emailAttribute>

<groupnameAttribute>cn</groupnameAttribute>

<groupSearchFilter>(objectClass=groupOfNames)</groupSearchFilter>

<membershipAttribute>member</membershipAttribute>

Can you may be provide us with the latest atlassian-user.xml file

Mark Carbonara

Got it. Now getting only these two errors and it indicates to contact Atlassian support:

The following errors were encountered in running LDAP tests:

Error performing LDAP search filter 'null', base DN 'OU=Domain Users,DC=nbme,DC=

org': Empty filter

Error performing LDAP search filter 'null', base DN 'OU=Domain global groups,DC=

nbme,DC=org': Empty filter

Mark Carbonara

I contacted our AD guru and he indicates the following based on the last two error below:

Error performing LDAP search filter 'null', base DN 'OU=Domain Users,DC=nbme,DC=org': Empty filter<font></font>

Error performing LDAP search filter 'null', base DN 'OU=Domain global groups,DC=nbme,DC=org': Empty filter

Odd. It looks like it wants you to specify some filtering, but if the goal is to enumerate all users and groups.. the default filters shown below should do just that.

It appears that all that needs to be changed in this query is the root search areas, like so:

<baseUserNamespace>OU=Domain Users,DC=nbme,DC=org</baseUserNamespace>

<baseGroupNamespace>OU=Domain global groups,DC=nbme,DC=org</baseGroupNamespace>

Sultan Maiyaki

Yes that property is required for Bamboo to determine how deep it can go in searching users to be imported. I guess with this, your LDAP connection is fine already

Mark Carbonara

Yes once, I entered all the other fields which apparently bamboo must have, it started to work.

<firstnameAttribute>givenname</firstnameAttribute> <surnameAttribute>sn</surnameAttribute>

<groupSearchFilter>(objectClass=group)</groupSearchFilter>

<membershipAttribute>member</membershipAttribute>

Sultan Maiyaki

Ok great and thanks for the feedback

Aaron_t1dajh

I'm having trouble synchronizing with our LDAP repository. Running paddle against the custom xml config I have, I see two issues:

Paddle finds no groups for a given user
Paddle doesn't follow the referral given when asking for a group's members

In the atlassian-user.xml documentation I don't see any reference to what Paddle is looking at to determine the group a user object belongs to. For instance, our users get tagged with the attribute "memberofgroup=groupCN" when they are added to a group. Is Paddle looking for some default attribute for group membership? Also, does bamboo support following referrals?