LDAP Dynamic Group Support

[Khanh Nguyen]

It would be awesome if I can get Confluence/Jira to work with LDAP Dynamic Groups. By that I mean specifically. . .

Example LDAP cn definition:

cn=dg_all_managers,ou=groups,dc=abc,o=xyz

objectclass=top groupOfURLs

memberURL=ldap:///ou=people,dc=abc,o=xyz??sub?(mgrLevel=Y)

Let's say User1, User2 and User3 have the attribute mgrLevel=Y.

Scenario1: Is there a way to get Confluence/Jira to recognize the cn=dg_all_managers,ou=groups,dc=abc,o=xyz as having dynamic members User1, User2 and User3?

Scenario2: Do I need to go one step further and add an attribute to User1, User2 and User3 LDAP record to include a memberOf=cn=dg_all_managers,ou=groups,dc=abc,o=xyz

Our preference is to get scenario1 to work but might be willing to settle for scenario2.

Any advice on this is appreciated.

[Andrew Frayling · Accepted solution]

Hi,

You should be able to use scenario 2, have a look at http://confluence.atlassian.com/display/DOC/Connecting+to+an+LDAP+Directory#ConnectingtoanLDAPDirectory-MembershipSchemaSettings

If you use the "Use the User Membership Attribute, when finding the user's group membership" setting then the application will use the group attribute on the user (memberOf) to retrieve group membership, if you have this unchecked it will use the attribute on the group (member) to determine group membership.

The support for "real" dynamic groups (scenario 1) is an open feature request - https://jira.atlassian.com/browse/CONF-8046

Hope that helps,

Andrew.