Email address update in AD not reflected in Crowd

One of our users noticed that their email address was incorrect in JIRA. This was traced back to a typo in their Active Directory record. Active Directory has now been corrected by IT, but the change does not appear in Crowd. How do I update their profile in Crowd/JIRA/Confluence?

We are using AD as a Delegated Authentication Director.

4 answers

1 accepted

This widget could not be displayed.

Thanks to both of you for the reply...
I was not keen on the DB update as it would require an outage to simply update an email address, the second suggestion to edit it in JIRA and Crowd does not work because we have a read only connection to LDAP...
I was surprised to discover that letting it sit for half a day did the trick - somehow it updated in both automatically!!

Thx!

This widget could not be displayed.

Hey Jon,

You can update the database directly. Let me know if you need the query.

This widget could not be displayed.

You can edit the email address in JIRA by going to Users > Users and click Edit link on the user's username. Delegated Authentication saved all the user details except the password in JIRA database of cwd_user table.

If you have Delegated Authentication configured in CROWD, edit the user details in Users > Search Users.

This widget could not be displayed.

Interesting update we discovered on this topic...in Azure AD, accounts that are of type Guest do not have the "mail" attribute on them.  The email address is populated into the "otherMails" attribute.  When we sync Crowd with Azure AD after adding a Guest account, the account is brought into Crowd and the Email Address field is populated.  So, it appears the behavior of the Crowd sync capability is if it sees the "mail" attribute on an Azure AD account it takes whatever is in it...even if it is nothing...but if the "mail" attribute is not present, it looks at the "otherMails" attribute and takes what is in that.  Seems like the logic in the sync code needs to be updated to look for the "mail" attribute but if it is not present OR it is NULL, look for the "otherMails" attribute.

Bruno Vincent Community Champion Feb 01, 2018

Hi @Byron Boudreaux

Crowd is not to blame here, it is an inconsistency in Microsoft Graph API.

Crowd actually uses Microsoft Graph API to request Azure AD, which is just fine as it is what Microsoft recommends. The otherMails attribute you are referring to is not exposed in Microsoft Graph API (it is exposed in Azure AD Graph API which is a different API). Microsoft Graph API only exposes the mail attribute (for both regular users and guest users).

The thing is Microsoft Graph API returns a null value when the user is a regular user with no O365 mailbox but it does return the user's email address when the user is a guest user.

Just used PowerShell to query Microsoft Graph...I stand corrected.

We tried using the Guest accounts since it would populate the email field as we needed it and it would allow us to not have to create accounts explicitly in our directory but we were not able to authenticate to any of the Atlassian apps behind Crowd even though the account showed up in each one and had permissions.

Bruno Vincent Community Champion Feb 01, 2018

@Byron Boudreaux

I've just done a small test and I could not authenticate with a guest user belonging to a Crowd Azure AD connector. I'm wondering whether Azure AD guest users are actually supported by Crowd's native Azure AD connector as of today.

You might want to take a look at the Office 365 Directory Connector for Crowd: https://marketplace.atlassian.com/plugins/com.cleito.odcc/server/overview

ODCC does support external guest users ("external" meaning "not belonging to any O365/Azure AD tenant", for instance a user with a gmail address).

Disclaimer: I work for the vendor of the ODCC plugin.

@Bruno Vincent

Thanks for the tip Bruno.  DO you know if there is like an eval version that we can test before we buy?

Bruno Vincent Community Champion Feb 01, 2018

@Byron Boudreaux

You can actually test and use the plugin for as long as you want. Without a license, Cleito ODCC is limited to 5 users, what means that only the first five users who try to connect will be able to authenticate on Atlassian applications with their Office 365 credentials.

Bruno Vincent Community Champion Apr 02, 2018

@Byron Boudreaux

FYI we have just released a new version of the ODCC plugin with new options that you might be interested in, especially the following ones:

  • Option to fill in the Crowd email address field with the value of the Office 365 / Azure AD mailNickname attribute when the mail attribute has no value in Azure AD (unlike the mail attribute, the mailNickname attribute is always provisioned in Azure AD)
  • Option to allow Office 365 / Azure AD guest users to log into applications with their email address (e.g. john.doe@gmail.com) instead of their default username (e.g. john.doe_gmail.com#EXT#@yourcompany.com or john.doe_gmail.com#EXT#@yourcompany.onmicrosoft.com)

Suggest an answer

Log in or Sign up to answer
Community showcase
Published Feb 27, 2018 in Crowd

The Crowd team is looking for feedback on Server & Data Center customers' identity strategies!

Do you own more than one Server or Data Center product? Do you have challenges provisioning users across your Atlassian products? Are you spending a lot of time integrating each Atlassian product wit...

1,456 views 6 14
Read article

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you