Creating local users with the Delegated LDAP auth enabled

Dear experts,

I've recently set up the "Internal with LDAP authentication" user directory in my Stash (v2.12.2).

The "pure" LDAP authentication was used before, and I was also able to create some technical accounts (not present in LDAP by definition) locally, i.e. in the internal stash directory. That was a part of my workflow.

Now all accounts I create get associated with that "delegated" LDAP directory, even if there are no such user records in my LDAP! This makes it impossible to authenticate such user - LDAP rightfully rejects it.

Is there a way to tell Stash which "user directory" method to use when creating a particular user? Is there a way to tell it that if the user isn't in LDAP, it should fallback to the internal directory?

 

Thank you in advance for your help.

4 answers

1 accepted

This widget could not be displayed.

What is the order of your directories in the "User Directories" screen?  If you want the "Internal Directory" to be tried before the LDAP directory then it needs to be above the "Delegated LDAP Authentication" directory in the list.

I just tested this on an install of Stash 2.12.2 - I can create a user in the local directory and login successfully, as well as login with a user whose password is in LDAP.  Here's what my User Directories screen looks like:

image2014-11-14 9:37:43.png

This widget could not be displayed.

Hi Max,

I am sorry for having misunderstood you - you are totally right. We actually have a feature request for your scenario here: https://jira.atlassian.com/browse/STASH-3323 in case anyone else is also looking for this.

Best regards,
Thiago Bomfim
Atlassian Support

This widget could not be displayed.

Hi Max,

We had a similar issue raised in the past that was closed as invalid because Stash does not have the ability to write on User Directories. Hence it doesn't make sense providing a the "choosing directory" functionality during the user creation process:

Hence all the users you create manually go to the Stash Internal directory. Didn't you just get confused?

Best regards,
Thiago Bomfim
Atlassian Support

This widget could not be displayed.

Hi Thiago,

I think you didn't get my point. I know that Stash doesn't write to a remote user directory; instead it creates some internal records which are assiciated with the directory. As I see it, this association id decided upon the position  of the directory in the list (its priority). The Delegated LDAP thing is in fact internal directory, so it is perfectly writable, but - if it is on top of the list, -  Stash for some reason doesn't check whether each user account put into it actually exists in LDAP through which it is going to be authenticated.

Marcin's suggestion (thanks!) seems to be the only possible workaround - at least I've got a similar reply via the official Atlassian tech. support channel. However, there are situations when one wants some accounts to be associated with different directories - and not by moving the directories up and down the list every time.

 

Suggest an answer

Log in or Sign up to answer
Community showcase
Published Aug 21, 2018 in Bitbucket

Branch Management with Bitbucket

As a project manager, I have discovered that different developers want to bring their previous branching method with them when they join the team. Some developers are used to performing individual wo...

1,315 views 8 11
Read article

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you