JIRA LDAP Configuration

Question

Hi Team,

We are using 5.2.11 version with Postgresql database.

As a part of our organization transition activity we have to configure new LDAP server in JIRA for authentication.

After this new LDAP server configuration ,we have to create fresh users as per their new LDAP  id  ( as  NTid, email details changed due to transition ) and authentication directory will be newly configured directory.

Note: We had created one Generic Id /Service user which is common in both directory and this id is Admin user for existing system.

Now I have two approaches for configuring this new LDAP directory,

1.  Create separate LDAP entry using 'Add Directory' feature : Fresh users along with Admin user needs to create.

2. Update existing LDAP directory details : Host name  & base dn will change as per new ldap.  Benefit with this approach is JIRA admin user will remain as is through which most of the existing configurations has made. So ultimately there will be no impact in this layer.

Please note :  In both approach we have to create fresh users as per their new id's.

Kindly suggest which is best approach from above.

Thanks,

Sujata

Sujata_33hzs9 · Answer

Hi,

Currently we dont have any plan for JIRA upgrade.

As I have mentioned we are configuring this new LDAP due to company transition ( Organizational changes ) , so old LDAP server will be discontinue in some time and new one will be use. And  applications authentication will be done as per new LDAP.

We have already identified this risk of creating new ids ( as per new LDAP ) after new LDAP configuration.

Now my question is which approach will be simpler. In my opinion approach #2 will be better as JIRA admin user configurations will remain as is and no need to migrate users.

Kindly suggest.

Andy Heinzer · Answer

This process is much more difficult on this version of Jira.  This is because this version of Jira won't let you rename existing user accounts in Jira.   Because of this, you pretty much have to create all new accounts for all the users.

However, if you could upgrade even to Jira 6.0 (or higher), then you would gain this feature: https://jira.atlassian.com/browse/JRASERVER-1549

Which is the ability to rename a user.  This feature can be helpful when you are changing LDAP directories that might have different usernames, but largely the same users.   Let's say your old LDAP has a naming convention of firstname.lastname, such as joe.smith, but your new LDAP has a convention of j.smith.

In this scenario in Jira 5.x and before, you're stuck with having to create new accounts anyways because you can't rename the existing users at all within that version of Jira.   But in Jira 6 and higher, it is possible that you could rename the users on your old ldap instance first to match the convention of the new LDAP server.   If you're using a connected LDAP in Jira that syncs changes to Jira, and you correctly have setup the "User Unique ID Attribute" in Jira's configuration of this directory, then when the user is renamed in LDAP, Jira can sync those changes on that account, without actually having to create a new user account in Jira.

In my view, it tends to be a better experience for the admin and the endusers if you can make these changes in LDAP and then have Jira sync those changes.