Managing multiple directories
Managing 500+ users across Atlassian products?
Find out how easy, scalable and effective it can be with Crowd!
See centralized user management.
Configuring the Directory Order
You can change the order of your directories as defined to Jira. Select 'User Directories' from the Jira administration menu and click the blue up- and down-arrows next to each directory.
In situations where users are unable to change their passwords, check that a Delegated Authentication Directory is not the highest in the order of User Directories. As a workaround, you can change the order of User Directories, or alternatively use a connection to a LDAP directory instead.
Make sure to read the rest of this page to understand what effect the directory order will have on authentication (login) and permissions in Jira, and what happens when you update users and groups in Jira.
Effect of Directory Order
This section summarizes the effect the order of the directories will have on login and permissions, and on the updating of users and groups.
Login
The directory order is significant during the authentication of the user, in cases where the same user exists in multiple directories. When a user attempts to log in, the application will search the directories in the order specified, and will use the credentials (password) of the first occurrence of the user to validate the login attempt.
Permissions
The directory order is significant when granting the user permissions based on group membership. If the same username exists in more than one directory, the application will look for group membership only in the first directory where the username appears, based on the directory order.
Example:
- You have connected two directories: The Customers directory and the Partners directory.
- The Customers directory is first in the directory order.
- A username
jsmithexists in both the Customers directory and the Partners directory. - The user
jsmithis a member of groupG1in the Customers directory and groupG2in the Partners directory. - The user
jsmithwill have permissions based on membership ofG1only, notG2.
Updating Users and groups
If you update a user or group via the application's administration screens, the update will be made in the first directory where the application has write permissions.
Example 1:
- You have connected two directories: The Customers directory and the Partners directory.
- The application has permission to update both directories.
- The Customers directory is first in the directory order.
- A username
jsmithexists in both the Customers directory and the Partners directory. - You update the email address of user
jsmithvia the application's administration screens. - The email address will be updated in the Customers directory only, not the Partners directory.
Example 2:
- You have connected two directories: A read/write LDAP directory and the internal directory.
- The LDAP directory is first in the directory order.
- Since you can create users in both directories, you can choose the directory in which you want to perform the update.