nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

mapping groups in MS AD via LDAP with Jira/Confluence

Rachid Amajoud

Let's say i have 3 roles in Jira:

-Jira-users

-Jira-administrators

Jira-developers

AND in AD domain groups:

-jira_user

-Jira admins

-jira_develop

When I give a new user a certain role like jira_develop in AD, this user should be synchronised with the correct group in Jira local group (jira-developers)

Is this possible when I set an LDAP connection for each group or can I just set LDAP connection and use filters to get the right users from AD to right local groups in Jira?

How can this be done?

thx

Accepted answers

All comments

Josh Steckler

I'm a bit confused but as long as you make your AD groups members of your project roles, once you add members to the AD groups (and after a sync) those users will have access to those projects according to the permission scheme. Hopefully your permission scheme uses these roles.

Additionally, you shouldn't need multiple directory connections. You can write one filter to pull in these groups and the group members all at once.

Group filter: (&(objectCategory=Group)(|(sAMAccountName=jira_user)(sAMAccountName=jira_develop)(sAMAccountName=jira_admins))

User filter: (&(objectClass=person)(|(memberOf=CN=jira_user,OU=blah,OU=domain,OU=com)(memberOf=CN=jira_develop,OU=blah,OU=domain,OU=com)(memberOf=CN=jira_admin,OU=blah,OU=domain,OU=com)))

Rachid Amajoud

Josh Steckle

thx for your answer, i will try this! But what do you mean by

"Hopefully your permission scheme uses these roles." :-)

The role names in Jira are different then the role names(groups) in AD, so where in the config above do you refer to the Jira local groups?

thx

Rachid Amajoud

Hi Josh,

in this case, what will be then the Base DN? And should OU=domain,OU=com not be DC=domain,DC=com?

And Additional User/Group DN stays empty with just LDAP Read permissions !

example:

domain.com

OU=LAS Vegas

OU=software

OU=confluence

(group) = jira-user (role nested = jira-default)

(group) = jira_admins (role nested = jira-administrators))

(group) = jira_develop (role nested = jira-programmers)

And i am using nested groups!

thx

Josh Steckler

Your base DN could be as simple as "DC=domain,DC=com" - depending on where your user account OU is. This is what I use on mine due to the nature of our AD structure.

One thing to consider is to create a "master" group that contains all relevant groups to be used within JIRA.

Lets say underneath the OU=confluence, you create a new group "jira_groups" and you add jira_user, jira_admins and jira_develop as nested members. In that situation, you could use these filters. I assume when you said you use nested groups, it means that you have other groups nested within jira_user, etc.

User filter: (&(objectClass=person)(memberof:1.2.840.113556.1.4.1941:=CN=jira_groups,OU=confluence,OU=software,OU=Las Vegas,DC=domain,DC=com))

Group filter: (&(objectCategory=Group)(|(sAMAccountName=jira_groups)(memberof:1.2.840.113556.1.4.1941:=CN=jira_groups,OU=confluence,OU=software,OU=Las Vegas,DC=domain,DC=com)))

This uses a function of AD specific query syntax known as LDAP_MATCHING_RULE_IN_CHAIN, basically it picks up all levels of nesting below the specified object. See these two links for more: https://confluence.atlassian.com/crowdkb/active-directory-user-filter-does-not-search-nested-groups-715130424.html

https://msdn.microsoft.com/en-us/library/aa746475(v=vs.85).aspx

Edit:

An additional reason I suggest using a "master" group is due to JRASERVER-36979

The maximum length of an ldap group/user filter is 255 characters. So if you wanted to pull in all nested groups by naming jira_users, jira_admins and jira_develop individually, the filter would look like the following, but that would be 344 characters and therefore impossible.

(&(objectClass=person)(|(memberof:1.2.840.113556.1.4.1941:=CN=jira_users,OU=confluence,OU=software,OU=Las Vegas,DC=domain,DC=com)(memberof:1.2.840.113556.1.4.1941:=CN=jira_admins,OU=confluence,OU=software,OU=Las Vegas,DC=domain,DC=com)(memberof:1.2.840.113556.1.4.1941:=CN=jira_develop,OU=confluence,OU=software,OU=Las Vegas,DC=domain,DC=com)))

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

jira

active-directory

ldap