Unable to find the groupname of the principal error when connecting to an OpenLDAP/FedoraDS directory
Platform notice: Server and Data Center only. This article only applies to Atlassian products on the Server and Data Center platforms.
Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
This is for an outdated version of Hipchat Server
This article applies to a version of Hipchat Server which will be deprecated soon. After that period the version will no longer be supported.
You should upgrade to a more recent version of Hipchat Server as soon as you can to take advantage of new features, and security and bug fixes.
Symptoms
You are trying to set up an LDAP connector in Hipchat server, connecting to an OpenLDAP/FedoraDS server. After the sync is completed, the users and groups have been imported into Hipchat successfully, but the group memberships are not there, e.g. the groups contain no users, and all users are not members in their respective groups.
The following appears in the atlassian-crowd.log:
[ldap.mapper.entity.LDAPGroupAttributesMapper] The following record does not have a groupname: {ou=ou: Groups, objectclass=objectClass: organizationalUnit, top}
[atlassian.crowd.directory.DbCachingRemoteDirectory] failed synchronisation complete in [ 75ms ]
[atlassian.crowd.directory.DbCachingDirectoryPoller] Error occurred while refreshing the cache for directory [ 10000 ].
com.atlassian.crowd.exception.OperationFailedException:
org.springframework.ldap.UncategorizedLdapException: Unable to find the groupname of the principal.
at com.atlassian.crowd.directory.SpringLDAPConnector.searchEntitiesWithRequestControls(SpringLDAPConnector.java:416)
Diagnosis
This problem should only occur when you are attempting to connect to OpenLDAP. Also, your LDAP configuration is making use of the Posix Schema:
"ldap.group.filter": "(objectclass=posixGroup)"
"ldap.group.name": "cn"
"ldap.group.objectclass": "posixGroup"
Cause
First Causes:
You are configuring an LDAP type which is incompatible with the LDAP schema, e.g. you should use the OpenLDAP (Read-only Posix Schema) directory type instead of OpenLDAP.
Second Causes:
You are using Posix Schema with Group attributes in Full Distinguish Name (DN), e.g. uniqueMember: uid=test123,ou=group,dc=abc,dc=com.
Resolution
For the First Causes:
Use the OpenLDAP (Read-only Posix Schema) directory type in Hipchat, instead of OpenLDAP.
For the Second Causes:
Use the Generic Directory Server directory type in Hipchat, instead of FedoraDS (Read-only Posix Schema).