nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Ignoring disabled users in LDAP Active Directory

GilK

Hi,

Our Jira and LDAP Active Directory (Microsoft) are integrated.

As a company policy, we never delete users from our AD, but disable them.

However, in Jira I see all users (both enabled and disabled).

How do I configure my Jira to ignore disabled users?

Thanks,

Janiv.

Accepted answers

David at David Simpson Apps

You could perhaps filter by the LDAP attribute userAccountControl...

Based on Microsoft Support's explanation:

The attribute that holds this information is the userAccountControl attribute. This attribute is composed of a combination of different flags. The flag for setting the object that you want to disable is UF_ACCOUNTDISABLE, which has a value of 0x02 (2 decimal). The bitwise comparison filter that specifies userAccountControl with the UF_ACCOUNTDISABLED bit set would resemble this:

(!(UserAccountControl:1.2.840.113556.1.4.803:=2))

...would be all accounts that are not disabled.

So, in JIRA Admin | Users | User Directories

Select your AD configuration then expand the User Schema Settings heading

In the User Object Filter field, paste something like...

(&amp;(objectCategory=Person)(sAMAccountName=*)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))

This is the default filter for AD with the additional filter added.

Or the selected field here:

All comments

David at David Simpson Apps

You could perhaps filter by the LDAP attribute userAccountControl...

Based on Microsoft Support's explanation:

The attribute that holds this information is the userAccountControl attribute. This attribute is composed of a combination of different flags. The flag for setting the object that you want to disable is UF_ACCOUNTDISABLE, which has a value of 0x02 (2 decimal). The bitwise comparison filter that specifies userAccountControl with the UF_ACCOUNTDISABLED bit set would resemble this:

(!(UserAccountControl:1.2.840.113556.1.4.803:=2))

...would be all accounts that are not disabled.

So, in JIRA Admin | Users | User Directories

Select your AD configuration then expand the User Schema Settings heading

In the User Object Filter field, paste something like...

(&amp;(objectCategory=Person)(sAMAccountName=*)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))

This is the default filter for AD with the additional filter added.

Or the selected field here:

GilK

Thanks,

Where do I put this string in Jira?>

Thanks again,

David at David Simpson Apps

See the update above

Sorin Sbarnea (

The interesting question is how to disable Jira users which are disabled in active directory (to see them as disabled)

Sorin Sbarnea (

I already tried this and ended up having bigger problems: this filter removes people from the LDAP results and due to this Jira will remove all their group memberhips. That's by (bad) design, and even if the account is re-enabled, the users group membership is not going to be restored.

If jira would just diable the users it would be OK, but that's not what it really does.

Note: this is also happening if they forgot to change their password every 3 months! Try to scale the problem to >100 users and you are already a doomed jira admin.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

active-directory

ldap