Users getting deleted and readded after every incremental synchronisation

Can anyone please let me know what can cause confluence to delete users and readd them after every sync. In audit logs we can see users getting deleted from all groups and after next sync they are getting added to all groups. Is this a bug? or AD config issue?

7 answers

I answered with a broken link - edited the comment to remove it.

Ann Worley Atlassian Team Aug 21, 2017

Thanks for the update @John Mark Davis.

I see that you just replied on the support case, and the support engineer is taking another look at your logs. We can circle back to this thread when the root cause is found, as it will probably be the same issue for Confluence.

This is happening to us on an evaluation license Confluence. It is also happening on an evaluation license of Jira except I don't see our ldap users getting added back there, they just get removed and never put back. We are using port 3268 as it showed better performance from our directory server. I am unable to view the article you linked Ann. 

@Ann Worley disabling Follow refferals dint helped. We have a case open with atlassian, but no exact solution yet.

0 votes
Ann Worley Atlassian Team Aug 17, 2017

@Syed Ehteshamuddin I understand from your support ticket that the LDAP user binding to AD has only read permissions. I understand not wanting to make the user an AD admin, but it may help to add the User DN to the Account Operators group in AD.

0 votes
Ann Worley Atlassian Team Aug 17, 2017

@John Mark Davis Using port 3268 is recommended as it uses the AD Global Catalog. The post I linked was removed as a duplicate of this one, I am sorry for the broken link.

I had recommended that Syed turn off the Follow Referrals checkbox (in the User Directory Advanced settings). When that setting is on, it can make Confluence query multiple servers, not all of which have the desired users.

 
 

@Ann Worley I tried using a domain admin account and disabling follow referrals, but the behavior is still the same. I have opened a case for our Jira instance as that application is more important for us to have linked to our AD users.

Ann Worley Atlassian Team Aug 21, 2017

Thanks for the update.

I found your support case. I see that you just replied and Earl is checking your logs again. The root cause is probably the same in Confluence so we can circle back to this thread when the JIRA issue has been resolved.

Thank you @John Mark Davis for trying that out.
@Ann Worley I would be waiting to know the resolution.

Working with support on this issue in Jira, we identified that our Global Catalog was missing the "accountExpires" attribute. The LDAP queries being performed in the incremental sync were removing users because this attribute was not found in those synchronizations. Disabling the incremental sync from the advanced section of the directory settings worked as a work around. I had access to our active directory to add the "accountExpires" attribute to the Global Catalog. This should be done by someone that understands the structure and size of your domain as adding an attribute triggers a full sync between all the nodes in your domain forest.

I was unable to post the article links that helped me compare the query output between 389 and 3268 and how to add the attribute. The site kept telling me I was trying to post spam. @Ann Worley those articles were in my last comment on the support case I opened if there is a way for you to share them with @Syed Ehteshamuddin.

https://blogs.technet.microsoft.com/scotts-it-blog/2015/02/28/ad-ds-global-catalogs-and-the-partial-attribute-set/

This article actually covers all of it. I had just read up to the point that he queried the different ports, but it also shows how to modify the attributes.

Yay! It let me post this one.

Ann Worley Atlassian Team Aug 22, 2017

Thank you very much for sharing the solution. I look forward to finding out whether it helps @Syed Ehteshamuddin.

Suggest an answer

Log in or Sign up to answer
Community showcase
Posted Monday in Confluence

Organizing your space just got easier - Page Tree Drag & Drop is here

Hi Community! I’m Elaine, Confluence Product Manager. You may have read my earlier post about page tree in space navigation sidebar. I'm excited to share another improvement that helps you organize ...

80 views 3 4
Join discussion

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you