LDAP synchronization does not load any group member

[Alexander Alexander]

Hi,
we use confluence 3.5 together with LDAP user directory. User and groups are synchronized but the groups do not show any member.
We are able to login with our LDAP accounts but without any group membership.
Our LDAP is a OpenLDAP system.

After synchronization confluence has all groups and members from LDAP, but groups don't contain any member.

Why does confluence not load the members from the member-Attribute?

Thanks in advance.

[Brian Hill]

The posixGroup (memberUid) and groupOfNames (member) are mutually exclusive object classes. memberUid is just a login name - not an entire DN the way member is.

The question for Atlassian support how they support the posixGroup config if they even do.

Has anyone figured this out yet?

[JamieA]

I think your user membership attribute is wrong, I don't see how it could be uid. It should be memberOf or something.

Try unchecking that option.

[Alexander Alexander]

We use static group configuration, when group's members contains into group, not into user (dynamic group configuration).

Also I tried setup configuration with unchecked and cheched option. I tried both, but result is same (

[JamieA]

I would create a support ticket, I'd be interested to hear what Atlassian support say about this. Sorry not to be of more help.

[Alexander Alexander]

Thank you.

Can you post the link of support ticket. I also will check it state.

[JamieA]

Sorry, I meant that I advise you to create a support ticket, and then post back here if you get useful information.

[JamieA]

How do you mean "member-Attribute"? AFAIK the member attribute for OpenLDAP is uniqueMember. If you have member, you need to change that in in Membership Schema Settings.

Can you double-check the actual attribute in your schema, and the settings in jira.

[Alexander Alexander]

Jamie, thank you for answer.

I set next parameters in LDAP User Directory in section "Membership Schema Settings":

Group Members Attribute: memberUid

User Membership Attribute: uid

Use the User Membership Attribute: When finding the user's group membership

And after this settings members didn't load in group.

[JamieA]

What does the ldif for a group look like. does it have attributes called memberUid?

My settings are:

Group Members Attribute: uniqueMember

and the checkbox unchecked. You may have your openldap set up different from mine of course, so only looking at the ldif for a group will tell us.

[Alexander Alexander]

ldif of group:

dn: cn=block_ip,ou=dev,ou=Group,dc=example,dc=com
objectClass: posixGroup
objectClass: top
cn: block_ip
description: users can use script block_ip
memberUid: daymon
memberUid: brian
memberUid: paul
memberUid: john
gidNumber: 14485

[JamieA]

Hrm I have the full DN for the users - perhaps it needs that? And do you have the revese lookup working, such that if you look at the ldif for a user it shows the groups they're in? I guess that needs to be tree if you have that checkbox checked.

I'm afraid I'm out of ideas, so you might need Atlassian support. But I wonder if it requires the full DN of the users rather than just the uid.

[Alexander Alexander]

ldif of user:

dn: uid=daymon,ou=staff,ou=users,dc=example,dc=com
objectClass: posixAccount
objectClass: top
objectClass: inetOrgPerson
gidNumber: 65534
givenName: Daymon
sn: Caulfield
displayName: daymon Caulfield
uid: daymon
homeDirectory: /home/daymon
loginShell: /bin/bash
mail: daymon@example.com.ua
cn: Daymon Caulfield
uidNumber: 56596
userPassword: {SHA}hashofholdensecretpass=