nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

map users

David Poprik

I am trying to convert my Confluence install from a local directory to an active directory Auth Only install. I was under the impression I could choose to "Auth Only" without synchronization but that seems to be my only choices as of the latest 5.9.4 windows server install. It imports all 200,000 + users in to the cache. I am now trying to map the old users in the internal directory to those imported but do not see how?

I would appreciate some guidance/tips.

Thanks!

Accepted answers

All comments

Steven F Behnke

When you say "auth only" you're referring to the delegated authentication connector. If you chose the Active Directory connector instead you are not using this delegated authentication connector.

You would typically filter the users out with LDAP filters instead of allowing it to sync 200,000+ users.

You cannot map users. They need to be the same username.

David Poprik

Steven, I found a doc on delegated "Connecting to an Internal Directory with LDAP Authentication" which is what I actually want. Auth Only.

However I do not seem to be able to log in with a domain account when I try it now when I was using the full microsoft AD directory settings.

I understand the names need to match.

David Poprik

Steven, I found a doc on delegated "Connecting to an Internal Directory with LDAP Authentication" which is what I actually want. Auth Only.

I set the old internal Dir user to the same username as the LDAP account but no good. If I chose "Copy users on login" in the user directory I added then a new account is created with that ldap accounts username and the directory sections says it is the delegated ldap directory I am pointing to. The original account says it is using the internal. I guess that is the problem. I need to change the old users to the ldap directory rather than the internal?

I understand the names need to match.

Steven F Behnke

I'm trying to follow but this is hard to visualize.

If you use Delegated Authentication Connector and use the Copy Users on Login option, users will be automatically created in the directory.

The Delegated Authentication Connector Directory should be FIRST in the list so that users attempt to authenticate against it instead of the Internal Directory.

David Poprik

Steven, Thanks for responding again. I have in fact placed the internal with LDAP user directory both first and second but it makes no difference. What I want to do is have it authenticate an LDAP credential and match the user up with one of my "original" internal directory accounts by the same username as the LDAP user.

I set a username to match an LDAP account and signed in both with the LDAP authenticator and then internal as the order and vice versa but I just get a failed login. (not a bad credentials message)

After a while with this I checked the create account option under the user directory for LDAP and signed on and it created the account in the internal DB for the LDAP user. I looked at it and the significant difference was that looking at the account entry in users the Directory section showed the LDAP directory rather than "Internal" like my original users.

Following up on this I opened the SQL DB and looked at the cwd_users table. All my original accounts had the same directory ID number. My new account created automatically via the "Copy" command when I signed in the first time to LDAP had a new number. I copied this number out, then in the confluence user manager I deleted the new user. I modified one of my original users to have the the same username as the LDAP account again and then editted the DB manually and changed the directory entry to match what I had copied out earlier from the auto added account. I had to restart the Atlassian service to get everything working right but now if I sign in with the LDAP credential I am the user account I want to be in the internal directory. There seems to be an issue with the LDAP AUTH method even though I am following directions.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

confluence-administration