You can connect Fisheye to external user directories. This allows you to use existing users and groups stored in an enterprise directory, and to manage those users and groups in one place.

User management functions include:

• Authentication: determining which user identity is sending a request to Fisheye.
• Authorization: determining the access privileges for an authenticated user.
• User management: maintaining profile information in user's accounts.
• Group membership: storing and retrieving groups, and group membership.

It is important to understand that these are separate components of a user management system. You could use an external directory for any or all of the above tasks.

There are several approaches to consider when using external user directories wth Fisheye, described briefly below:

License considerations

When connecting Fisheye to an external directory, be careful not to allow access to Fisheye by more users than your Fisheye license allows. If the license limit is exceeded, users will not be able to use the application and Fisheye will display a warning banner. You can manage which users have access to Fisheye, using the global permission screen.

LDAP

You should consider connecting to an LDAP directory server if your users and groups are stored in an enterprise directory.

There are two common ways of using an external LDAP directory with Fisheye:

• For full user and group management, including for user authentication — see Connecting to an existing LDAP directory for instructions. 
• For delegated user authentication only, while using Fisheye's internal directory for user and group management — see Delegating authentication to an LDAP directory for instructions.

Fisheye is able to connect to the following LDAP directory servers:

• Microsoft Active Directory
• Apache Directory Server (ApacheDS) 1.0.x and 1.5.x
• Apple Open Directory (Read-Only)
• Fedora Directory Server (Read-Only Posix Schema)
• Novell eDirectory Server
• OpenDS
• OpenLDAP
• OpenLDAP (Read-Only Posix Schema)
• Generic Posix/RFC2307 Directory (Read-Only)
• Sun Directory Server Enterprise Edition (DSEE)
• Any generic LDAP directory server

Jira applications

You can delegate Fisheye user and group management, as well as user authentication, to a Jira application. This is a good option if you already use a Jira application in your organization. Note that Fisheye can only connect to a Jira application server running Jira 4.3 or later.

You should consider using Atlassian Crowd for more complex configurations with a large number of users. 

See Connecting to Jira for user management for configuration instructions.

Crowd

You can connect Fisheye to Atlassian Crowd for user and group management, as well as for user authentication.

Crowd is an application security framework that handles authentication and authorization for your web-based applications. With Crowd you can integrate multiple web applications with multiple user directories, with support for single sign-on (SSO) and centralized identity management. See the Crowd Administration Guide.

You should consider connecting to Crowd if you want to use Crowd to manage existing users and groups in multiple directory types, or if you have users of other web-based applications.

See Connecting to Crowd for configuration instructions.

Multiple directories

When Fisheye is connected directly to multiple user directories, where duplicate user names and group names are used across those directories, the effective group memberships that Fisheye uses for authorization can be determined using either of these two schemes: 

• 'aggregating membership'
• 'non-aggregating membership'. 

See Effective memberships with multiple directories for more information about these two schemes.

Note that:

• Aggregating membership is used by default for new installations of Fisheye.
• Authentication, for when Fisheye is connected to multiple directories, only depends on the mapped groups in those directories – the aggregation scheme is not involved at all.
• The directory order is significant during the authentication of the user, in cases where the same user exists in multiple directories. When a user attempts to log in, the application will search the directories in the order specified, and will use the credentials (password) of the first occurrence of the user to validate the login attempt.
• For inactive users, Fisheye only checks if the user is active in the first (highest priority) directory in which they are found for the purpose of determining authentication. Whether a user is active or inactive does not affect how their memberships are determined.
• When a user is added to a group, they are only added to the first writeable directory available, in priority order.
• When a user is removed from a group, they are only removed from the group in the first directory the user appears in, when non-aggregating membership is used. With aggregating membership, they are removed from the group in all directories the user exists in.
• When using Single Sign-On with Crowd and multiple Crowd directories:
  • signed-in users will be validated against the first Crowd directory the user is in
  • users that haven't signed in yet, but have a valid Crowd SSO cookie will be validated against all configured Crowd directories in order

A Fisheye admin can change the membership scheme used by Fisheye using the following commands:

• To change to aggregating membership, substitute your own values for <username>, <password> and <base-url> in this command:

  curl -H 'Content-type: application/json' -X PUT -d '{"membershipAggregationEnabled":true}' -u <username>:<password> <base-url>/rest/crowd/latest/application 

• To change to non-aggregating membership, substitute your own values for <username>, <password> and <base-url> in this command:

  curl -H 'Content-type: application/json' -X PUT -d '{"membershipAggregationEnabled":false}' -u <username>:<password> <base-url>/rest/crowd/latest/application 

Note that these operations are different from how you make these changes in Crowd. Note also that changing the aggregation scheme can affect the authorization permissions for your users, and how directory update operations are performed.