Why does user login fail when running "test" on a user directory succeeds?

[Chad Barnes]

We have JIRA connected to Crowd. Our Crowd directory contains all of our users, and is working fine. However, I need to change the configuration of the directory and that can only be done if I am logged in via a different directory. So, I enabled the JIRA internal directory.

1. Enabled internal directory
2. Created user with unique name "jiraadmin"
3. Added user to new group "internal-admins"
4. Added group to "JIRA Users" and "JIRA System Administrators" permissions
5. Clicked "Test" on the internal directory and confirmed all "success" messages for jiraadmin
6. Tried logging in with jiraadmin - FAIL

2012-01-19 13:15:47,878 http-8080-7 anonymous 795x360x2 j7tfjy 131.198.224.155,198.151.224.26 /rest/gadget/1.0/login login : 'jiraadmin' tried to login but they do not have USE permission or weren't found. Deleting remember me cookie.

2012-01-19 13:15:47,905 http-8080-7 anonymous 795x360x2 j7tfjy 131.198.224.155,198.151.224.26 /rest/gadget/1.0/login The user ' jiraadmin ' has FAILED authentication. Failure count equals 11

I also tried the above steps with a new crowd directory. Same results. Test indicated success but actual login attempts failed. Only our one Crowd directory works.

Any thoughts on why unique users in the internal JIRA directory cannot log in?

[Chad Barnes · Accepted solution]

This behavior is due to our use of the SSO authenticator. The following warning was a clue, but does not entirely characterize the limitation:

It is possible to define multiple user directories in JIRA. However, if you enable SSO integration, you will only be able to authenticate as users from the Crowd server defined in the crowd.properties file.

More specifically, you will only be able to authenticate as users from the Crowd application defined in crowd.properties.

Therefore, when using SSO, you may only use a single directory as your JIRA authentication source.

[Jeremy Largman]

Thanks for posting your own answer Chad.

[Paul Boyum]

I ran into this same scenario with Confluence, thanks!

[meena radhakrishnan]

What is the syntax for listing the JIRA local users in crowd.properties?

I only see application.name and application.password being listed in the document.

thanks

[meena radhakrishnan]

I ended up creating a new Crowd Directory in JIRA with the desired configuration changes and disabled the previous Crowd directory and that did the trick.

[Chad Barnes]

Confirmed. No user named "jiraadmin" exists in any directory in crowd. Also, the internal JIRA directory is first in the list.

[Colin Goudie]

Can you confirm you DON'T have a jiradmin user in your crowd directory? and make sure your internal directory is first in the list.

Seems weird though, on first reading, sounds like you got everything