I've recently set up the "Internal with LDAP authentication" user directory in my Stash (v2.12.2).
The "pure" LDAP authentication was used before, and I was also able to create some technical accounts (not present in LDAP by definition) locally, i.e. in the internal stash directory. That was a part of my workflow.
Now all accounts I create get associated with that "delegated" LDAP directory, even if there are no such user records in my LDAP! This makes it impossible to authenticate such user - LDAP rightfully rejects it.
Is there a way to tell Stash which "user directory" method to use when creating a particular user? Is there a way to tell it that if the user isn't in LDAP, it should fallback to the internal directory?
Thank you in advance for your help.
What is the order of your directories in the "User Directories" screen? If you want the "Internal Directory" to be tried before the LDAP directory then it needs to be above the "Delegated LDAP Authentication" directory in the list.
I just tested this on an install of Stash 2.12.2 - I can create a user in the local directory and login successfully, as well as login with a user whose password is in LDAP. Here's what my User Directories screen looks like:
We had a similar issue raised in the past that was closed as invalid because Stash does not have the ability to write on User Directories. Hence it doesn't make sense providing a the "choosing directory" functionality during the user creation process:
Hence all the users you create manually go to the Stash Internal directory. Didn't you just get confused?
I think you didn't get my point. I know that Stash doesn't write to a remote user directory; instead it creates some internal records which are assiciated with the directory. As I see it, this association id decided upon the position of the directory in the list (its priority). The Delegated LDAP thing is in fact internal directory, so it is perfectly writable, but - if it is on top of the list, - Stash for some reason doesn't check whether each user account put into it actually exists in LDAP through which it is going to be authenticated.
Marcin's suggestion (thanks!) seems to be the only possible workaround - at least I've got a similar reply via the official Atlassian tech. support channel. However, there are situations when one wants some accounts to be associated with different directories - and not by moving the directories up and down the list every time.
Bitbucket Pipelines helps me manage and automate a number of serverless deployments to AWS Lambda and this is how I do it. I'm building Node.js Lambda functions using node-lambda ...
Connect with like-minded Atlassian users at free events near you!Find a group
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no AUG chapters near you at the moment.Start an AUG
We're bringing product updates and pro tips on teamwork to ten cities around the world.Save your spot