Group Membership not found accross AD directories

Winfried Mühl

Dear all,

in Confluence 6.11 we are evaluating the restrictions in using one user account from one Active Directory (AD-1) which is member of a group in another Active Directory (AD-2).
Our test scenario in details

- in AD-1 (domain1): user XY is an account name
- in AD-2 (domain2): user XY from AD-1 is referenced as a member in a universal group TEST_GROUP
-- ! ATTENTION PLEASE: !
--- MEMBERSHIP is a REFERENCE to user XY in AD-1 (via distinguishedName CN=XY,OU=dep,OU=org,DC=domain1,...)
--- in AD-2 NO USER with NAME XY exists !

The directory list order is: first AD-1, second AD-2.

A query for user XY in >Confluence administration >Users results in
- User XY is found as account in AD-1 (domain1)
- BUT: the group membership of XY(@AD-1; domain2) in TEST_GROUP of AD-2 is not found

Also: when looking up the members of TEST_GROUP (AD-2 / domain2) in >Confluence administration >Groups  the referenced external AD account XY (@AD-1) is not found.

If a user account with NAME XY (not only reference) is present in AD-2 then his group memberships are found (even if this user is disabled). But this redundancy of account names (same name in two directories) is not what we want!

My conclusion: Confluence will only find group memberships if the user account name exists in the Active Directory that hosts the group(s). A LDAP Reference to an external account is unsufficient!?

All hints for a solution or workaround are gratefully appreciated! ;-)

Best
Winfried

 

Stephen Sifers

Hello Winfried,

Within Confluence you are able to utilize multiple user directories. However, there are some items you need to be aware of when doing so:

Avoid duplicate usernames across directories. If you are connecting to more than one user directory, we recommend that you ensure the usernames are unique to one directory. For example, we do not recommend that you have a user jsmith in both 'Directory1' and 'Directory2'. The reason is the potential for confusion, especially if you swap the order of the directories. Changing the directory order can change the user that a given username refers to.

Source Document: Managing Multiple Directories

This seems to be the cause of the issue you’re reporting. The user has the same username in both directories causing items from AD-2 to not show but items from AD-1 to display. This is also most likely due to the ordering of the directories in Confluence.

In short, If the username is the same within both directories, then the highest ordered directory will be precedence above the others.

I hope this helps clarify the issue you’re having with multiple user directories.

Regards,
Stephen Sifers