Connecting to an internal directory with LDAP authentication
Find out how easy, scalable and effective it can be with Crowd!
See centralized user management.
Overview
For all of the following procedures, you must be logged in as a user with the Jira system administrator global permissions.
An internal directory with LDAP authentication offers the features of an internal directory while allowing you to store and check users' passwords in LDAP only. Note that the 'internal directory with LDAP authentication' is separate from the default 'internal directory'. On LDAP, all that the application does is to check the password. The LDAP connection is read only. Every user in the internal directory with LDAP authentication must map to a user on LDAP, otherwise they cannot log in.
When to use this option: Choose this option if you want to set up a user and group configuration within your application that suits your needs, while checking your users' passwords against the corporate LDAP directory. This option also helps to avoid the performance issues that may result from downloading large numbers of groups from LDAP.
Connecting Jira to an internal directory with authentication
To connect to an internal directory but check logins via LDAP:
- In the upper-right corner of the screen, select Administration
> User Management.
- In the sidebar, select User Directories.
- Select Add directory and select the Internal with LDAP authentication type.
- Enter the values for the settings, as described below.
- Save the directory settings.
- Define the directory order by clicking the blue up- and down-arrows next to each directory on the User directories screen. We recommend that the 'Internal Directory with Authentication' is at the top of the list. Here is a summary of how the directory order affects the processing:
- The order of the directories is the order in which they will be searched for users and groups.
- Changes to users and groups will be made only in the first directory where the application has permission to make changes.
- Add your users and groups in Jira. See Managing users and Managing groups.
Server settings
Setting | Description |
|---|---|
Name | A descriptive name that will help you to identify the directory. Examples:
|
Directory Type | Select the type of LDAP directory that you will connect to. If you are adding a new LDAP connection, the value you select here will determine the default values for some of the options on the rest of screen. Examples:
|
Hostname | The host name of your directory server. Examples:
|
Port | The port on which your directory server is listening. Examples:
|
Use SSL | Check this box if the connection to the directory server is an SSL (Secure Sockets Layer) connection. Note that you will need to configure an SSL certificate in order to use this setting. |
Username | The distinguished name of the user that the application will use when connecting to the directory server. Examples:
|
Password | The password of the user specified above. |
Copying users on first login
Setting | Description |
|---|---|
Copy User on Login | This option affects what will happen when a user attempts to log in. If this box is checked, the user will be created automatically in the internal directory that is using LDAP for authentication when the user first logs in and their details will be synchronized on each subsequent log in. If this box is not checked, the user's login will fail if the user wasn't already manually created in the directory.
|
Update User attributes on Login | Whenever your users authenticate to the application, their attributes will be automatically updated from the LDAP server into the application. After you select this option, you won't be able to modify or delete your users directly in the application.
|
Default Group Memberships | This field appears if you check the Copy User on Login box. If you would like users to be automatically added to a group or groups, enter the group name(s) here. To specify more than one group, separate the group names with commas. Each time a user logs in, their group memberships will be checked. If the user does not belong to the specified group(s), their username will be added to the group(s). If a group does not yet exist, it will be added to the internal directory that is using LDAP for authentication.
|
Synchronize Group Memberships | This field appears if you select the Copy User on Login checkbox. If this box is checked, group memberships specified on your LDAP server will be synchronized with the internal directory each time the user logs in.
|
Schema settings
Setting |
Description |
|---|---|
Base DN |
The root distinguished name (DN) to use when running queries against the directory server. Examples:
|
User Name Attribute |
The attribute field to use when loading the username. Examples:
|
User schema settings (used when copying users on first login)
Setting |
Description |
|---|---|
Additional User DN |
This value is used in addition to the base DN when searching and loading users. If no value is supplied, the subtree search will start from the base DN. Example:
|
User Object Class |
This is the name of the class used for the LDAP user object. Example:
|
User Object Filter |
The filter to use when searching user objects. Example:
|
User Name RDN Attribute |
The RDN (relative distinguished name) to use when loading the username. The DN for each LDAP entry is composed of two parts: the RDN and the location within the LDAP directory where the record resides. The RDN is the portion of your DN that is not related to the directory tree structure. Example:
|
User First Name Attribute |
The attribute field to use when loading the user's first name. Example:
|
User Last Name Attribute |
The attribute field to use when loading the user's last name. Example:
|
User Display Name Attribute |
The attribute field to use when loading the user's full name. Example:
|
User Email Attribute |
The attribute field to use when loading the user's email address. Example:
|
Group schema settings (used when enabling 'synchronize group memberships')
Setting | Description |
|---|---|
Group Object Class | This is the name of the class used for the LDAP group object. Examples:
|
Group Object Filter | The filter to use when searching group objects. Example:
|
Group Name Attribute | The attribute field to use when loading the group's name. Example:
|
Group Description Attribute | The attribute field to use when loading the group's description. Example:
|
Diagrams of possible configurations
Diagram: Jira connecting to an LDAP directory for authentication only.
Diagram: Jira connecting to an LDAP directory for authentication only, with each user copied to the internal directory when they first log in to Jira.
Related topics
- Configuring the internal directory
- Connecting to an LDAP directory
- Connecting to an internal directory with LDAP authentication
- Configuring the JNDI LDAP connection pool
- Connecting to Crowd or another Jira application for user management
- Managing multiple directories
- Migrating users between user directories
- Synchronizing data from external directories