Active Directory Member Users suffering Log in Problems in JIRA

Ariq_Ibne_Aziz

Current Scenario:

JIRA is installed in a Virtual Machine, running on Windows Server 2012 (Hyper-V). JIRA Web Application Server is not a member of Active Directory. So far a Workgroup/Standalone user is not facing any problem.

Problem:

We have recently deployed Active Directory(AD) in our System. After Joining AD, most of JIRA account users are suffering Login Issue. The problem description is given below:

1. After Joining AD, New AD users can login in JIRA successfully
2. After 1 hour of Browsing and activity the user is forcefully logged out
3. That user cannot login to JIRA portal.
   1. User Provides Username and Password
   2. Click On Login
   3. but user can’t log-in, instead the page is refreshed and again asked for Username and password.

The users who are not member of AD, therefore hasn’t joined the AD are not suffering the issue.

Troubleshoot:

We have tried troubleshoot methods as follows:

1. Restarted the JIRA Server(VM)
2. END users cleared cache, cookies and history from browsers.
3. Users also tried different Browsers
4. Users are even logged out from AD and Joined as a Workgroup user
   1. For a certain time, the user being able to login in JIRA Application
   2. But again that user faces the problem.
5. We have Prepared a new Desktop PC, gave it  a windows 10 OS, disabled the firewall, There is no antivirus, made him a new member of Domain Controller (AD).
   1. That new user is also facing the same problem.
      1. First login was successful
      2. After few hours the user is logged out automatically and not being able to login.
   2. Note: We have a firewall and antivirus. But it never interrupted the users from Login in. So we are not thinking that as a source of our problem

Exception:

Only one user is not facing any problem who is also a domain member but he is not a Jira user.

Note: JIRA Server has not joined Domain Controller(AD) and JIRA is not integrated with Domain Controller (AD)

Andy Heinzer

It's difficult to say for sure what is happening.  But it sounds the users can't login to Jira because they don't have application access.  In Jira, the ability to login to the application is granted by group membership.   Hence you account has to belong to a group that has application access to Jira Core, Jira Software, or Jira Service Desk to be able to login to the main site at all.

Since this appears to happen after an hour or so, that could correspond to the fact that Jira defaults it's sync time to a connected directory to 60 minutes.   So let's say you have an existing user 'jsmith' in the Jira internal directory, but you just added the same username 'jsmith' to your LDAP/AD server.  If Jira is connected to that LDAP/AD AND that user directory in Jira is ordered above the Jira internal directory, when that user attempts to login, he/she will need to use the password in LDAP/AD, and not the password stored in the internal Jira directory.  Additionally, if this describes your scenario, the other 'gotcha' is that this new LDAP/AD account might have the same username as before for the user, but that doesn't mean it has the same group memberships in Jira.  That includes group memberships that grant application access to be able to login.   I have a hunch here that your new LDAP/AD users don't actually have the group memberships being granted to them to have the application access to be able to login yet.

I would suggest trying to follow the KB Unable to login to JIRA applications.  It has some additional logging you can enable in Jira in order to be able to see why users can't actually login to Jira (ie bad password/authentication vs no group membership/authorization)