Fisheye user management with auto-add

[Kalle Lehtonen]

Hi,

We are having an issue with our Crowd migration with Fisheye.

On Crowd side:

• We have added Fisheye to Crowd as an application
• use group to specify the allowed users

On Fisheye side we have:

• configured Fisheye to use Crowd as external directory
• enabled 'auto-add'

The result is not what we expect. The Confluence entry says: https://confluence.atlassian.com/display/FISHEYE/Creating+a+user- "If you have enabled 'auto-add' for your external directory, users who don't exist locally in FishEye/Crucible will be automatically added the first time they log in to Crucible."

What happens to us, is that all users on the group specified in Crowd are automatically added to Fisheye users which causes us to exhaust our licenses.

What I read from https://answers.atlassian.com/questions/240127/jira-crucible-and-fisheye-user-management-problemsI get impression that when the group level is defined in Crowd all users in that group are automatically added, not when they first login? Is this true? And only solution is to create a separate group for Fisheye "enabled" users.

Thanks in advance!

[Kalle Lehtonen · Accepted solution]

We ended up creating separate group for Fisheye users and solved the issue with that.

[Piotr Swiecicki]

Hi,

Technically there is no need to enable extra logging, as by default synchronisation details are logged on info level. But if you enable debug logging you may see more details. Use either admin console (Admin / Server / Debug Logging) or pass --debug command line option, see https://confluence.atlassian.com/display/FISHEYE/Command-Line+Options

In the log file (you will find in the FISHEYE_INST/var/log folder) grep for DefaultUserManager and then for "auto-reimport user: ", "auto-import user: " and "resynchronising users with " messages.

What problem do you have now? Are you still exceeding number of licences or rather users are not imported automatically when they access FishEye for the first time?

[Kalle Lehtonen]

Yes, we are exceeding it again. And now I am not fully when or how it happens. I have compared the lists of users (btw. it is a bit annoying that you cannot see all users in same view or export the list :) and checked from the persons that have they logged in and they at least claimed they have not.

[Piotr Swiecicki]

ok, with the grep command explained above you should be able to see the moment the users are added.

Regarding user export, you can use new REST Admin API endpoint added in 3.3.0 release, see https://docs.atlassian.com/fisheye-crucible/latest/wadl/fecru.html#rest-service-fecru:admin:users

Just call https://YOUR_FISHEYE_INSTANCE/CONTEXT_IF_ANY/rest-service-fecru/admin/users

You can also use type parameter to filter users by authentication type: built-in, LDAP, host, custom, ajp, crowd.

Hope that helps,

[Kalle Lehtonen]

Hi,

Unfortunately the change did not help. Is there any easy way to enable logging of added users so I could verify when and how they are added?

We use Fisheye Version:3.1.5 Build:20131030082910 2013-10-30

And the credentials setup is:

JIRA/Crowd Authentication

Application Name fisheye (Crowd standalone)

Crowd URL http://***/crowd/services/

Auto-add users into FishEye true

Single sign on (SSO) enabled false

Synchronise Period Manual re-sync only

On Synchronisation Copy only new users.

[Piotr Swiecicki]

Hi Kalle,

It seems like you enabled "Periodically synchronise users with Crowd" flag in FishEye, so it tries to resynchronise with Crowd automatically. Try to disable this flag and deactivate those users in FishEye which wouldn't need to access it. That should work as you expect - existing FishEye users would have access to FishEye, new users logging it to FishEye would be automatically imported from the Crowd on the login attempt.

Hope that helps,
Piotr

[Kalle Lehtonen]

Great, thanks for the fast answer! I will try that option and report back. At least it sounds like that would be the answer.