Crowd delegated directory - is available to use usernames from AD in Jira Internal directory without creation in Crowd?

Question

We have Jira 5.1.x, connected to the Crowd (first & top directory) and having Internal directory too.

Crowd has configured Delegated directory, connected to the AD. AD has big number of users, but Delegetad Directory itself has a limited number of users, identical with the AD.

Is it possible to use in Internal directory username, present in the AD but doesn't present in Delegated directory ?

For the moment users can't  login to the Jira before identical account will created in the Crowd delegated directory. Moreover, Jira connected to the Crowd by read-only connection, but Crowd create empty accounts when user try to login to the Jira.

Andrey69 · Answer

Hi Tiago.

Bug on user creation is bad, but I don't really understand what really happens.

I fix situation with user creation by recipe, which found here:

https://answers.atlassian.com/questions/2108/how-do-i-stop-a-delegated-directory-from-automatically-adding-ldap-users
& in documentation:
https://confluence.atlassian.com/display/CROWD/Specifying+which+Groups+can+access+an+Application

* Next to your delegated LDAP directory, change the "Allow All to Authenticate" to "False"
* Then select the Groups tab, add in your jira-users, confluence-users (or whatever) from the delegated LDAP directory (and it has to be this directory, not a same named group in another directory)

Seems, in this configuration new user  wasn't create.
But, users with identical username in Internal directory & in AD still can't login.
This users doesn't presented in Delegated directory !
Here is the main trouble for us.

Tiago Comasseto · Answer

Hi Andrey,

Crowd has an option to disable the "Add Users" permission in the directory configuration withing the Application section. If you unmark this option, the users from LDAP shouldn't be created upon login into the client application.

However there is a know bug in this functionality, please vote on it and add yourself as watcher for further updates.

Cheers

Andrey69 · Answer

Using of full LDAP is not usable for us due to the security restrictions (Crowd can't change anything in LDAP) and total difference in groups. Jira (and Crowd) has some hundreds groups, but LDAP doesn't have it (but have it's own set of groups).

This is why we used Delegated Directory.

We doing big migration for users from Internal Directory to the Crowd. But, we can't do this at once. The idea was - creating one by one users in Crowd and switch Crowd directory on top in Jira. Users, who doesn't present in Crowd for the moment, should login using Internal credentials. But, in this configuration users who have identical username in Jira Internal & in AD can't login to the Jira.

Seems, Crowd check users in AD even if users doesn't present in Delegated Directory ! 
So, my question is - any workaround for this situation or we need to migrate all identical users at once anyway ?