Question

A caveat to begin with – I don’t actually know if what I want to do is possible, particularly because I’m not well versed with LDAP/Active Directory or JIRA.

I’m trying to integrate my shiny new installation of JIRA with my existing active directory. What I want to do is set up some specific JIRA groups (e.g. in London\Security Groups\JIRA*) and then have JIRA only import the users who have membership of those groups. However, in the directory set up page in JIRA, I don’t understand how to do this. It seems to indicate that I can import users and groups, but not users from groups.

What am I missing? (apart from expert level knowledge of AD!)

Update

Under my domain, I have an organisational structure like this:

London\Users

London\Security Groups\JIRA

Under the latter organisational unit, I have a security group called “jira-users”. The former contains all users.

So far I’ve tried the following queries and none of them have worked :

(all prefixed with &(objectCategory=Person)(sAMAccountName=*)")

memberof=CN=jira-users,ou=London,ou=Security Groups,ou=JIRA,dc=mycompany,dc=local

memberof=CN=JIRA,ou=London,ou=Security Groups,dc=mycompany,dc=local

(prefixed with just &(objectCategory=Person)")

memberof=CN=jira-users,ou=London,ou=Security Groups,ou=JIRA,dc=mycompany,dc=local

Completed

The query that works is this :

memberof=CN=jira-users,OU=JIRA,OU=Security Groups,OU=London,DC=mycompany,DC=local

I hadn’t realised that for a folder structure that is logically, left to right, London\Security Groups\JIRA, the organisational units need to be listed in reverse order.

Further Update

This only works when using the DirectorySearcher class for some reason, e.g.

DirectoryEntry rootEntry = new DirectoryEntry("LDAP://dc=mycompany,dc=local");
DirectorySearcher srch = new DirectorySearcher(rootEntry);
srch.SearchScope = SearchScope.Subtree;
srch.Filter = "(&(objectCategory=Person)(sAMAccountName=*)(memberof=CN=jira-users,ou=London,ou=Security Groups,ou=JIRA,dc=mycompany,dc=local))";
SearchResultCollection results = srch.FindAll();

This doesn’t work in the LDAP explorer tool and subsequently, not in JIRA itself.

Last Update

So…for JIRA, you need to reverse the order AND remove the wildcard. Working query in the end is :

(&(objectCategory=Person)(memberof=CN=jira-users,OU=JIRA,OU=Security Groups,OU=London,DC=mycomapny,DC=local))

Answer 1

When you are setting up the user directory look under the User Schema settings. You should see a “User Object Filter” field. In there you should be able to add something like this:

(memberOf=cn=jira-users,ou=London,dc=mydomain,dc=com)

This will allow you to filter based on a specific LDAP group. Of course you will need to edit the values above to reflect your own environment.