How to combine a read only AD with extra users not stored in AD

[Jan Dähler]

My actual set-up is:

JIRA and confluence connect to crowd for user-authentication, crown is connected to my company's active directory (read only). For external team members i use the internal crowd database.

Now i have to add every groups twice in AD and internal db in crowd with exact same name (for example "jira-developers"). So they appear in JIRA and confluence as if they belong to the same group.

Question: Is this best practice in case of read only AD?

[Caspar Krieger]

The other alternative is to configure Crowd to use a delegated authentication directory to connect to AD, but bear in mind that users won't automatically be updated in such a configuration. (There are some options which allow the users to be created and updated on login which you can turn on, but the user does still need to log in.)