[Other doc versions]
You can connect Stash to external user directories. This allows you to use existing users and groups stored in an enterprise directory, and to manage those users and groups in one place.
User management functions include:
It is important to understand that these are separate components of a user management system. You could use an external directory for any or all of the above tasks.
There are several approaches to consider when using external user directories wth Stash, described briefly below:
You should consider connecting to an LDAP directory server if your users and groups are stored in an enterprise directory.
There are two common ways of using an external LDAP directory with Stash:
Stash is able to connect to the following LDAP directory servers:
You can delegate Stash user and group management, as well as user authentication, to an Atlassian JIRA instance. This is a good option if you already use JIRA in your organization. Note that Stash can only connect to a JIRA server running JIRA 4.3 or later.
You should consider using Atlassian Crowd for more complex configurations with a large number of users.
See Connecting Stash to JIRA for user management for configuration instructions.
You can connect Stash to Atlassian Crowd for user and group management, as well as for user authentication.
Crowd is an application security framework that handles authentication and authorisation for your web-based applications. With Crowd you can integrate multiple web applications with multiple user directories, with support for single sign-on (SSO) and centralised identity management. See the Crowd Administration Guide.
You should consider connecting to Crowd if you want to use Crowd to manage existing users and groups in multiple directory types, or if you have users of other web-based applications.
See Connecting Stash to Crowd for configuration instructions.
When Stash is connected directly to multiple user directories, where duplicate user names and group names are used across those directories, the effective group memberships that Stash uses for authorisation can be determined using either of these two schemes:
See Effective memberships with multiple directories for more information about these two schemes.
A Stash admin can change the membership scheme used by Stash using the following commands:
To change to aggregating membership, substitute your own values for
<base-url> in this command:
To change to non-aggregating membership, substitute your own values for
<base-url> in this command:
Note that these operations are different from how you make these changes in Crowd. Note also that changing the aggregation scheme can affect the authorisation permissions for your Stash users, and how directory update operations are performed.