Users from subgroups in AD are not shown when using a User Object Filter

[bughunter]

Hello.

We are using a User Object Filter in the "User Schema Settings" to limit the Users.

Users in a group jira_users are found. If a user Michael is in a group team_a and team_a is a member in jira_users Michael is not shown in jira. If Michael is direct member in jira_users he is shown in jira.

When we look for Michael in "Users" all groups and nested group memberships are shown correctly.

We need the ability to use nested groups in the filter.

(&(objectCategory=Person)(sAMAccountName=*)(memberOf=CN=jira_users,OU=jira,OU=atlassian,OU=xDelegation,DC=company,DC=local))

Limiting the Users by using "Additional User DN" does not limit the Users.

Is this a decision by design or an error?

[bughunter · Accepted solution]

http://jira.atlassian.com/browse/JRA-32191

[petry]

Hey Christian,

We created an Improvement Request for this particularly problem. You can see it here:

• Members of nested groups are not picked up when setting an User Object Filters

My suggestion is to vote on this request and add yourself as a watcher to receive future updates regarding this case. You can add some comments there also, it will reach the developers directly.

Cheers,

Andre

[Mallmann]

Hello guys,

In case anyone is still facing this issue:

What happens is that Confluence does not retrieve the subtrees of the user filter you set. So, basically Confluence is only looking for the users that are "memberOf" confluence-users, and not the ones that are memberOf subtrees within the confluence-users group.
However, Microsoft Active Directory (AD) has a specific string that you can add to your filter so that it will look the subtrees as well. For example:

(&(objectCategory=Person)(sAMAccountName=*)(memberOf:1.2.840.113556.1.4.1941:=CN=confluence-users,CN=Users,DC=example,DC=com))

Please, refer to this official Microsoft documentation in case of any questions.

I hope it helps 

Best regards,

Eduardo Mallmann

[Aurelia Pagano]

Thanks a lot!! This was what I was looking for since hours!

[Tiago Comasseto]

Hi Christian,

I've run some tests locally and was able to confirm that JIRA doesn't pull in nested members of a group that is in the search filter. Basically it only searches for the attribute memberOf into the group that is declared in the search filter.

An alternative is include the nested groups into the User Object Filter as the following example:

(&(objectCategory=Person)(sAMAccountName=*)(|(memberOf=CN=jira_users,OU=jira,OU=atlassian,OU=xDelegation,DC=company,DC=local)(memberOf=CN=team_a,OU=jira,OU=atlassian,OU=xDelegation,DC=company,DC=local)))

Cheers

[bughunter]

Adding the nested groups is nice if you have a stable and limited number of groups.

If the creatiung of new groups is rife in your organisation then this is no solution. You would'nt want to fix your LDAP-Filter on a weekly basis; this would be an administrative nightmare...