How do I migrate from cloud to server and use AD for auth without losing mind?

Question

We are using Jira cloud. We would like to migrate to Jira Server which isn't hard, but we are failing at attempting to migrate our users' accounts.

Problem: When we add AD as the primary directory service we see either duplicate accounts created or we get a new single consolidated user account that essentially overwrites the migrated account. There are several variants of results based on configuration attributes at the directory service level. In most cases, overwrite occurs; and we lose user history.

Question: How should we 'migrate' to using AD as our primary account for authentication but still maintain the prior account and account history in Jira?

jeremylomas · Answer

That is correct--the user can log in with his AD credentials, but has no history--no assigned items, no groups, etc--the second account is only visible when querying the backend (PostgreSQL). In the UI, you can see the AD user that has never logged in.

Is that the expected behavior? Is there a way to then associate the AD account with the "old" user?

Thanks again for the response--it's much appreciated!

Craig Castle-Mead_20fp9z · Answer

Hey Jeremy,

On the target system, if you import from your source system, the expected output is that it would create a user in the internal directory, then when you add the AD connector, it will create another user (same username) with a different directory_id

The Jira content is "owned" by the username though, not the userID (listen to all the DBAs scream here), so once the AD user directory is moved above the internal directory where you configure the user directories, that authentication will happen against AD.

While the second user being created in the DB may seem confusing, it's expected. What's happening in the UI itself? Can the new user login but not see any of the history? Can the user not even login?

CCM

jeremylomas · Answer

Thanks for the quick response, Craig! I have been trying this method, but it doesn't seem to work (for any, let alone most).

I can change the username to match, but it will  invariably create a new user (same user name, email address, display_name--everything, but of course different directory id).

I've been scouring the forums and documentation but can't find what I could be missing or mis-configuring...any thoughts?