LDAP connection and using different username than localpart

Thomas Schuchhardt

our specific LDAP setup is managed by iRedMAil and iRedAdmin

users DNS look like dn: mail=user@domain.com,ou=Users,domainName=domain.com,o=domains,dc=domain,dc=com

groups are similarly also identified by mail adresses

is it possible to user just the username für synchronizing the users to jira and append `@domain.com` automatically?

and either way if that is possible or not, how can i transfer ISSUES and boards to different users?
the usernames would change like  this
username -> username@domain.com
preferable i would want to run a query that replaces all user references with the new users

on the other services like bitbucket there is not much data created so transfering users should be able to be done manually

Andy Heinzer

Hi Thomas,

I understand you want to change all the usernames in Jira from the format of just 'username' to 'username@example.com' and that your users in Jira are being managed in an LDAP directory that Jira is connected to.

This can be done if you are using a connected LDAP directory (a delegated LDAP directory in Jira does not handle this kind of user rename task).   The trick to making sure this works is to make sure that your LDAP directory in Jira has the correct value for the "User Unique ID Attribute:" field for this user directory.   For different LDAP types (AD/OpenLDAP/etc) this attribute can be different.  However the purpose of that field is to generate a unique value that corresponds to the account itself.  This way if the account is renamed in LDAP, when Jira syncs with the LDAP instance it can understand that this is the same account and in turn will rename the user account it has for that user.   Whereas if Jira does not have the correct attribute set here, when the sync happens after a user rename, Jira would instead create a new user account.   If the new user account is created, this is because Jira does not understand that a rename has happened, and instead it is just adding the user accounts found in the directory per the DN/user filters in place.   These LDAP attributes in Jira are also better explained in Connecting to an LDAP directory.

 

I also tried to highlight the critically important attributes on the directory in Jira as it pertains to this scenario:

It's important to make sure that the user rename that happens in LDAP is working correctly in Jira first.  I would suggest trying to rename a test account in LDAP first, and then syncing Jira just to make sure this change is taking place in the way you would expect it to, and not just creating a new user account.  Once that is complete, there are two different approaches you can take to try to rename all these accounts in Jira from username to username@example.com formats:

1. You can actually attempt to rename the useraccounts in LDAP directly.  This would be to change the usernames to include the @example.com domain along with this.  This might not be the preferred method since it might effect other services using your LDAP instance for authentication/authorization.
2. The other alternative would be to edit the user directory settings in Jira.   You could change the User Name Attribute to have the same value as the User Email Attribute.   This way when Jira Syncs with the directory the next time after this change, provided the user Unique ID Attribute is correct, Jira would see these are the same accounts and rename them appropriately (provided your LDAP directory actually has current values for these mail fields).

 

That said, I would still recommend that you test out this kind of change on a staging server first.   This kind of change has the potential to lock out all your users from Jira if this is not done correctly or you encounter any unexpected results.   If you don't have a staging server to test this on first, then I would recommend trying these steps:

 

1. create a new LDAP directory in jira first with the same current settings,
2. order this new directory higher than your current directory,
3. perform a sync in Jira for this new directory,
4. then make this change to the User name attribute,
5. save these changes,
6. and sync the new directory again.

If this works, you should be all set.  But if this doesn't work, then you should still be able to quickly revert these changes by re-ordering the old directory back to the higher order and syncing that once more.

Regards,
Andy