LDAP groups wont showup correctly when two Microsoft AD user directories are present

Licenses systems

I have configured for our Jira two Microsoft AD user directories, it is the ldap service so both have same users in them. Previously with Jira 7.3 I had all users shown up correctly, ie. if both user directories bring the same user but with different groups then both groups show up for user.

Now with Jira 7.7.0 this same configuration doesn't work. If I remove Group Object Filter all of our groups show, there are hundreds of them and some users have lots of groups(+10). It makes maintaining very difficult because now Jira has some hundreds of groups and we do project permissions by groups.

 

Whats has changed 7.3.1 -> 7.7.0 when it comes to AD configurations? What kind of group object filter should I have? It seems that whichever user directory is on top received priority and as such users will have the group its importing, If I switch it to bottom then the users will the other group. My current group object filter is "(&objectCategory=Group)(cn=ad_group_name))". User Object Filter is "(&(objectCategory=Person)(memberOf=cn=ad_group_name,ou=ou_name,ou=additional_dir,ou=one_more_ou,dc=domain,dc=local))" .

Keri

Hi team, 

 

There isn't anything that's changed, the only thing that I can think of that would be upgrade specific would be any configuration for LDAPS - that may have been knocked out. 

As far as the scenario you're talking about this new behavior sounds like how I would expect Jira to behave. 

 

Example:

• You have connected two directories: The Customers directory and the Partners directory.
• The Customers directory is first in the directory order.
• A username jsmith exists in both the Customers directory and the Partners directory.
• The user jsmith is a member of group G1 in the Customers directory and group G2 in the Partners directory.
• The user jsmith will have permissions based on membership of G1 only, not G2.

- Managing multiple directories

 

 

Have any changes been made to your AD groups? Or can you explain your use case a little more so we can try to further understand what's going on?

Cheers, 

Keri