Is it possible to Sync users with the same ID from different LDAP Directories

[Jeff Santos]

I have 3 LDAP directories synchronized on Jira.

The problem is that we have some useres with the same Account ID on more than one directory.

In one of them, the accounts are always disabled, but Jira won't sync the second one because of the first.

Do we have any workaround?

Thanks in advance! 

[Jeff Santos · Accepted solution]

I solved the problem by including a filter on the directories using the UserAccount control attribute from AD.

Now, Jira only get the active accounts of each directory.

Thanks for the help!

[Dave Theodore [Coyote Creek Consulting]]

Jira starts at the top of the list of User Directories and works down through the list. If a user appears in the directory, it stops looking at other directories, as it assumes that is the (only) one that the user is a member of.  

If you sort the LDAP directory with disabled users to the bottom, that will be the last one to be checked. Assuming that there are no active users in that directory that are inactive in one of the ones above it, things should work the way you want. Test this in a development environment before doing it in production! Never test things like this for the first time in production!

[Jeff Santos]

Hi Dave,

Thanks for the help.

I'd like Jira understand that it should only consider the enabled user, regardless of the directory it is in. However, if the enabled user is in the second directory, it will not be synchronized, and the disabled user will be kept. I also cannot switch them because unfortunately I have the same situation on both directories.

[Dave Theodore [Coyote Creek Consulting]]

Can you delete or rename the inactive users in LDAP? That's going to be your best bet