Delegated LDAP Authentication - Doesn't Authenticate

[Shelli]

I have upgraded from 4.1.2 to 4.4.4. We use our own LDAP for authentication (Microsoft AD). I created a Delegated LDAP Authentication in my User Directories and the connection test is successful. I have moved the directory to the top of the list (above JIRA Internal Directory).

However, when I try to login, it is not authenticated against our LDAP/AD. I have a user account in Jira with a different password than my LDAP one and this is the one I must use in order to login.

I did not check the Copy User on Login setting when I set up the directory. Since an account exists for my username in both Jira and LDAP, this shouldn't be causing an issue. I have restarted Jira in case that was needed.

Is there some step that I've missed?

[David Chan]

Explanation of Directories

Basically, each directory is considered completely independent. Meaning that Users/Groups are not seen between different directories. This also means that the "Internal" directory and the "Delegated LDAP Auth" directory is not linked at all.

In order for a user to log in using the "Delegated LDAP Auth" directory, users have to exist within that directory. This could mean selecting the "Copy User on Login" or simply creating the same users via the user browser list. Another thing to note is that none of the groups are recognised between the "Internal" directory and the "Delegated Auth" directory. Meaning that you will also have to re-set all the groups for your users to have the proper memberships.

So, as explained above there is currently no easy switch to migrate existing internal users to use delegated auth. There's a running improvement request which also contain SQL queries that can help streamline the migration a bit:

https://jira.atlassian.com/browse/JRA-24213

Possible Workaround for your Situation

You indicated that you upgraded recently. Were you using LDAP in JIRA 4.1.2? If so, then you would have had to modify the osuser.xml file. If you can rollback and re-do the upgrade, you can ensure to copy the osuser.xml file from JIRA 4.1.2 to the new JIRA 4.4.4 instance before the upgrade process. During the upgrade, JIRA will detect the LDAP settings and automatically migrate users into a "Delegated LDAP Auth" directory.

After the upgrade is done, JIRA no longer checks for the osuser.xml file, so this file needs to be in place before the upgrade.