nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Automatic Application Access for User out of LDAP

Thilo Brause

We have JIRA connected to a LDAP for user Management.

To restrict accessing JIRA, we set up a filter in the configuration of the LDAP, that only users inside a certain Group in the LDAP are synchronized to JIRA.

We have set Default Application Access for each new User to JIRA-Software but still need to add each user manually to that Group in JIRA after we added the user to the Group in LDAP.

It seems that a new user synchronized from LDAP does not trigger the "New User" behaviour for Default application Access.

We want to reach a behavior, where each user we add to the Group in LDAP is added automically to the user group in JIRA - is there any way to achieve this?

Accepted answers

Bastian Stehmann

Hi @Thilo Brause,

in the User Directory Configuration you can add a default group (if you have local groups enabled). Every user will be added to that group when the user logs in for the first time.

All comments

Bastian Stehmann

Hi @Thilo Brause,

in the User Directory Configuration you can add a default group (if you have local groups enabled). Every user will be added to that group when the user logs in for the first time.

Moses Thomas_08kyb0

@Thilo Brause

Yep

For internal directory with Ldap authentication

it means you want to use both Jira internal directory and LDAP directory then

Just be sure that you have the group say Active-jira-user is in Ldap, and this group is also configured in JIRA as the group user must be in to access Jira. then you will manually add groups which are in Jira internal directory. (i guess your current case) just create groups in LDAP then add user to this group, if group are not in Jira(unified) they will be created after synchro depending on minutes you set for synchronization chose the Update group memberships when logging in > every time user logs in, chose synchronization . this should work.
Make sure your group setting is correctly filtered in LDAP configuration setting
Make sure order of directory is correct in JIRA application

You could configure LDAP directory to add a default group with Read Only, with Local Groups enabled (Every user will be added to that group when the user logs in for the first time) but you will have problem later when you want to add other group after first login because this is done once.

best!

Logan Hawkes

I'd like to clarify this to make sure I have this right.

The Jira server is configured with an LDAP user dir and JIRA Internal Directory. The LDAP is configured for Read Only, with Local Groups.
The LDAP config has:

"ldap.userdn": "CN=svc-jira-it,OU=Service Accounts,OU=PAN,DC=spockmate,DC=local”
"autoAddGroups": "jira-users|jira-software-users”

This means that all users added to the LDAP group "svc-jira-it" will be synced to Jira and appear in the list of users. However, they won't be granted access to Jira because there isn't a local "svc-jira-it" group on the Jira server that's granted access to Jira. The solution is to add a local group to Jira called "svc-jira-it" and add it to the autoAddGroups list in the LDAP config.

Have I got that right? It seems wrong to me.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

jira-software

jira-administration

jira-software-server