Problem with directory Sync (Active Directory)

[Sven.H]

Hello everybody,

we have JIRA integrated with an Microsoft Active Directory and try to filter all disabled users with this option:

(!userAccountControl:1.2.840.113556.1.4.803:=2))

It works fine in any ldap browser but throws an error in JIRA

2016-01-12 08:02:52,763 atlassian-scheduler-quartz1.clustered_Worker-4 ERROR ServiceRunner [com.atlassian.scheduler.JobRunnerResponse] Unable to synchronise directory
com.atlassian.crowd.exception.OperationFailedException: java.util.concurrent.ExecutionException: com.atlassian.crowd.exception.OperationFailedException: org.springframework.ldap.InvalidSearchFilterException: Unbalanced parenthesis; nested exception is javax.naming.directory.InvalidSearchFilterException: Unbalanced parenthesis;...

Does somebody know about search filter restrictions within JIRA?

Thanks,

Sven

[Mike Friedrich · Accepted solution]

it says: Unbalanced parenthesis

And that is what is see too.

Our user filter:

"ldap.user.filter": "(&(objectCategory=Person)(sAMAccountName=*)(!(useraccountcontrol:1.2.840.113556.1.4.803:=2)))"

[Sven.H]

THX Mike, its wors now perfect. We forget the open bracket behind the "!" THX @ll for support.

[Nic Brough -Adaptavist-]

The "restriction" is that you need to get the filter correct - open and close all the brackets correctly.

[Dan Deftos]

What specifically are you attempting to accomplish with this filter? When a user is inactivated in AD it will update JIRA and inactivate the user in the JIRA user directory?

We are using Crowd and would like to do something like that (when user is inactivated in AD have it automatically update Crowd and inactivate the user) but have been unable to determine how to configure it correctly. I believe our stumbling block has been that we do NOT want edits in Crowd to update AD. 

Is what we are looking to do possible standardly? If not has anyone done any scripting or custom to accomplish this?