Using user's Department/Organization from AD as a group in Jira (using LDAP)

Question

I want to build "User Object Filter" and "Group Object filter" for fetching "Department" (field) of the user from the AD in our JIRA where we are using LDAP for authentication. After fetching make the department as users group in Jira.

Further we have plan to implement Nested group functionality in JIRA using Department as group. We have department hierarchy like as follows

AB

ABX

ABXY

I am not sure if it is really possible to use Department field from AD as a group in JIRA and then make it nested.

Since I have little knowledge about LDAP and AD, so would really appreciate your help and suggestions on this.

Suhas Patil1 · Answer

Hello Nic,

Thanks for your answer. Currently we cannot go ahead with groups in AD since there are some difficulties (not technical).

I think we will try to built some plugin which will fetch details from AD and add user to the group if he is not already member. And create groups on first logon from the users of respective departments.

Please let me know if you have any suggestions from your side in building such plugin.

Nic Brough -Adaptavist- · Answer

JIRA is only really aware of the groups in AD.  If you want to pull out an attribute then you'll need some code to do it, and it won't be a group in JIRA unless you start doing things like making dummy groups for attributes or rewriting the user handling inside the application.

A better solution here would be to forget the department field and make a set of department groups in AD.

Also, as for nesting, it can understand the nesting, but it "flattens" it within the application.  As an example, if AD has a group called Birds, and a nested group called Penguins, the JIRA will see two groups.  It won't show you that Penguins is part of Birds, they're just two groups.  If you put Mr Flibble (a user) into Penguins, then, because the group is nested, he's automatically part of Birds too, and JIRA will show him as a member of Birds and Penguins.  It will also show the nesting to administrators if they are messing with user setups (e.g. they can't remove him from Birds directly, because he's only there because he's a Penguin), but not anywhere in the UI.