Switching authenticaiton type from LDAP to internal delegated LDAP

Max Vorobiev

Dear experts,

We've got a production Stash server set up to authorize users via LDAP. The registration is as easy as logging in for the first time. But such ease is already starting to impact our license count.

So it was decided to restrict this by switching to another authentication method - delegated LDAP on the same global directory.

But there are lots (hundreds) of registered users already, all of them having certain access permissions.

What would be the most correct and less painful way of changing the authentication method? My biggest concern is to keep the list of current users with all their settings, i.e. they should under no circumstances be "forgotten" by the server.

Thank you in advance.

Michael Heemskerk

Hi Max,

The safest way is to create a new user directory using delegated LDAP and disabling, but not deleting your old directory. This will prevent the existing users from being marked as deleted, retain all existing settings and still stop the directory from synchronizing new users.

The steps:

1. Optional: Create a sysadmin user in the internal user directory so you can always login as a sysadmin if things go wrong.
2. Take a backup of the system before you begin
3. Set up your new user directory based on delegated LDAP authentication
4. Change the order of your user directories to make the new delegated LDAP directory come before your old one.
5. Disable the old user directory.
6. Verify that things work as expected. Create a test user in LDAP and verify that you can login to Stash as that user. Verify that existing users can still login and that they have retained their permissions and SSH keys.