Getting Users from Nested Groups in AD

[Julian Kolb]

Hello,

I have the following problem:

I have nested groups in my Active Directory and dont get all Users of these groups in my JIRA. The followig scheme shows my AD tree:

image2015-9-14 11:49:54.png

In the configuration of the AD in JIRA i have the following settings:

LDAP Schema -> Additional Group DN: OU=JIRA

Group Schema Settings -> Group Object Filter: (objectCategory=Group)

I want to have all Groups of the OU=JIRA (jira-test) in my JIRA and i dont want to have the groups from other OU's listed in JIRA ("GroupA").

But I want to get all users, including the users from group from other OU's ("GroupA"), from all groups of the OU=JIRA ("jira-test").

With the config shown above i only get User1 and User2 if I filter my Users for the group "jira-test". I miss User 3 and User4 from group "GroupA".

Can you help me?

[Jan-Peter Rusch · Accepted solution]

I opened a support call with Atlassian:

Final answer:

If I can please confirm that you would not like the parent group of the nested group to be seen in Confluence? If this is correct, this is not possible. You will see a flattened list and it will be shown that the user is member of both groups. There also will be no relation shown between the parent and nested group.

So, nested groups only work, if the parent groups of a nested group are also available/displayed in Confluence.

[Avinash]

@Jan-Peter Rusch  i am okay with displaying both the groups. Can you share the way to achieve it by adding a group filter? 

[Thomas Heidenreich]

Did you check the "Enable Nested groups" option?

image2015-9-14 17:45:38.png

[I Yordanov]

Hi guys. Any update on the issue? I have the same with my Confluence. Couldn't find a way to make it work with nested AD groups. 

[Andrej Kvasnica]

This is nice. What about getting groups from nested groups (for using nested groups in filters and workflows and access rights too)?

[Jan-Peter Rusch]

Same problem here with Confluence... Any hints or answers?

• Nested Groups is enabled
• Follow Referrals is disabled
• Naive DN Matching is enabled

I tried about every possible configuration, like setting the additional Group DN to a parent OU=Groups and then filtering with the group object filter (objectCategory=Group)(CN=*_CON))

All the groups Iwant to see in Confluence end with _CON.

I also tried:

https://confluence.atlassian.com/display/JIRAKB/Active+Directory+User+Filter+Does+Not+Search+Nested+Groups

without any luck.

[Julian Kolb]

Yes! Sorry, forgott to tell you that.