User lookups fail with 'PartialResultExceptions' due to Active Directory 'Follow Referrals' configuration
Platform Notice: Data Center - This article applies to Atlassian products on the Data Center platform.
Note that this knowledge base article was created for the Data Center version of the product. Data Center knowledge base articles for non-Data Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Problem
Accessing LDAP, such as searching for users in JIRA, Confluence or Crowd (with AD integrated) fails with the exception below:
Caused by: javax.naming.PartialResultException [Root exception is javax.naming.CommunicationException: DomainDnsZones.example.net:389 [Root exception is java.net.ConnectException: Connection refused: connect]]Other root exceptions can be:
- javax.naming.PartialResultException
java.net.UnknownHostException
Description
Active Directory servers are integrated with DNS, and modify entries in the DNS server. They refer to themselves in the root of their LDAP tree. If the Confluence (or Crowd, or JIRA) server is pointed to the root of the LDAP tree, and "follow referrals" is turned on (which is the default), then:
- Confluence will search for users.
- The AD server will respond with users and the referral that's in the root of the LDAP tree, because there could be more users over there.
- Confluence will follow the referral. This will result in:
- A DNS lookup of the base DN (
dc=example,dc=commeans a lookup forexample.com) - A connection to port 389 or 636 at
example.com, which is back to the same server.
- A DNS lookup of the base DN (
- Confluence will continue and read the rest of the objects in the domain as normal.
Diagnosis
To check if this is the case,
- Turn off 'Follow Referrals' in the 'Advanced Settings' section of your User Directory configuration.
- Connect to the root DN of your LDAP server.
- If no errors show in the logs, then it's a DNS error.
Cause
JIRA, Crowd or Confluence can't perform a DNS lookup on the referral in the AD server root. Problems like this are most commonly caused by the server that Confluence is running on not having the same DNS server as the Active Directory server.
Resolution
Fixing a DNS Configuration Issue
- Configure the server that JIRA is running on to use the DNS server that the Active Directory server is integrated with.
- Double check if the DNS server address has been change recently. Since DNS server record the Confluence information, please delete Confluence address information from the DNS server to resolve the issue.
- If this is not possible, disable 'Follow Referrals' under the advanced settings of your user directory.
What are the implications of disabling 'Follow Referrals'?
- If you only have one domain, there should be no adverse effects.
- If you have multiple domains joined in a Forest, then any cross-domain memberships will not be resolved.
- If you must have cross-domain memberships and you can't fix the DNS issues, then you can point Confluence at your Global Catalog. This is read-only, but it does contain all users, groups, and memberships from across your Forest. Talk to your AD admin for Global Catalog connection details.