Active Directory and nested groups

Using standalone JIRA 5.2.10 running on Windows and connecting to Active Directory with nested groups enabled in Advanced Settings, I am finding that nested groups are not working. In AD, I set up a group base OU, _Jira, and within that set up my JIRA groups (e.g. JIRA User, JIRA Developer). To some groups I added individual users (e.g. to JIRA Administrator), while to other groups I added groups defined outside the _Jira OU (e.g. an existing group named Developers was added to JIRA Developer).

When I synchronise AD with JIRA, the groups in _Jira appear as expected, but only users explicitly assigned are being shown as members. Users who are members of groups that are members of the JIRA groups are not appearing - is it because those groups are outside the _Jira OU, and if so, is there a workaround?

2 answers

1 accepted

Accepted Answer
1 vote

All groups that are found will appear as groups in JIRA's User Management Section. If you only wanted a small subset of the groups to be used, you could provide their CN as additional parameters in the Group Filter Query. e.g.

(&(objectCategory=Group)(CN=JIRA_*))

I moved all the JIRA_ groups into the Groups folder and deleted the JIRA folder, then updated my AD configuration in JIRA accordingl and applied the group filter that you suggest; but the end result is still the same. Users who are explicitly assigned to a JIRA_ group appear in those groups in JIRA, but users who are implicitly assigned to a JIRA_ group by virtue of being in a non-JIRA_ group assigned to a JIRA_ group do not.

I don't know whether this is a limitation of LDAP as a whole, or Atlassian's implementation of the AD support. It's beginning to sound like we will have to swallow the extra administration overhead, and assign users to JIRA Users as well as Users, for example.

In the end I moved the JIRA groups into the same folder as the rest of my groups, and explicitly assigned the users to the JIRA groups. Applying your filter change means only the JIRA groups show up in JIRA, which is good enough for me.

Hi David,

In order to get the nested group working fine, the groups search filter configured on your end need to be able to search the nested group as well. Hence please ensure that the configured Base DN and search filter is able to retrieve your nested group.

Hope it helps.

Cheers,
Septa Cahyadiputra

So if my AD setup is something like this:

Base
--Users
--Groups
---External Testers
---Internal Testers
---Contractors
---Devs
---Admins
---Users
--JIRA
---JIRA_Testers
---JIRA_Devs
---JIRA_Admins
---JIRA_Users

and I set my Base DN to Base, my User DN to Users and my Group DN to JIRA, I get my current situation. If I make the groups External Testers and Internal Testers to members of JIRA_Testers, then currently no-one who is in those groups will actually be displayed as such.

In short, I don't want the groups in Base/Groups to appear in JIRA, but I want those groups to be assigned to JIRA-specific groups. Is this at all possible, and if so, what changes do I need to make to my DN queries?

I realize I'm more than five years late, but maybe this can help someone else to understand the limitations in play here. I was in the exact same situation.

I had the group Employees (OU=Security Groups) belonging to the group Jira Users (OU=Jira,OU=Security Groups). However, I only wanted group in OU Jira to be displayed in Jira. Unfortunately I had to back down and explicitly add users to the group Jira Users.

Nested groups only work, if the parent group(s) of a nested group are also available/displayed in Confluence.

https://community.atlassian.com/t5/Answers-Developer-Questions/Getting-Users-from-Nested-Groups-in-AD/qaq-p/470840

Suggest an answer

Log in or Sign up to answer
Community showcase
Posted Sep 25, 2018 in Jira

Atlassian Research Workshop opportunity on Sep. 28th in Austin, TX

We're looking for participants for a workshop at Atlassian! We need Jira admins who have interesting custom workflows, issue views, or boards. Think you have a story to sha...

434 views 7 5
Join discussion

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you