How to migrate jira accounts from local to LDAP?

Question

We are using JIRA v7.7.0 , we are planning on switching from using local accounts to LDAP accounts.

What happens to all the data/files that are linked to a persons local profile?

Can we migrate users from local to LDAP without losing any of  the users info?

tony nero · Answer

thank you for the prompt response.  we will follow your advice and will report back with our results.

Andy Heinzer · Answer

It depends on how you make this switch.  If you add an additional user directory in Jira to this LDAP system, and that user directory has the exact same usernames that Jira has for your user accounts, and then you order this new user directory above the Jira internal user directory, then your end users won't have to create new accounts when they login.

The top ordered directory that contains the username will be used for authentication in the case of usernames that exist in multiple user directories.

If the new LDAP user directory has different usernames than what Jira is using, then adding this directory can create confusion for end users because it will create new accounts.

The problem that most admins run into when making this kind of switch is in regards to the group memberships being different for these same user accounts in the new system.  Application access and permissions are controlled for user accounts in Jira based on the accounts membership to particular group.  When you add in this new user directory, it won't necessarily have any of the user directories that your Jira internal user directory currently has, so that is something you have to work through to help make sure your end users don't have problems with both logins and changing permissions as a result of this kind of major change.   Group memberships don't span across user directories in Jira (the one exception being if your external user directory is using 'local group' in which case these LDAP users can then belong to groups in the Jira internal user directory).

Migrating users between user directories has some helpful info on this topic.  But I would also recommend that you create a staging server of your Jira instance so that you can test out this change before doing it in a production environment.  There are lots of things that can go wrong with a change like this and it tends to be a bad end user experience to try to just wing-it in production if you haven't done this before.