Associating users to group ends up with the error - You cannot add user xxxx to group xxxxxx. The user's directory is read only

Symptoms

You have configured an internal directory and an LDAP directory with the permission "Read Only, with Local Groups" where you have configured the default group membership to be "jira-users". Configuration was successful and synchronization was without any problem. When you try to login as an LDAP user, it fails with the error "You do not have a permission to log in. If you think this is incorrect, please contact your JIRA administrators." When you try to associate the user with the jira-users group from the UI, you are faced with the error "You cannot add user 'xxxx' to group 'xxxxxx'. The user's directory is read only."

The following error appears in the log

2011-09-19 16:36:56,087 http-844-7 ERROR anonymous 996x260x1 o8ghcl 127.0.0.1 /login.jsp [core.event.listener.AutoGroupAdderListener] Could not auto add user to group: Group <jira-users> is read-only and cannot be updated
com.atlassian.crowd.exception.ReadOnlyGroupException: Group <jira-users> is read-only and cannot be updated
 at com.atlassian.crowd.directory.DbCachingRemoteDirectory.addUserToGroup(DbCachingRemoteDirectory.java:487)
 at com.atlassian.crowd.core.event.listener.AutoGroupAdderListener.handleEvent(AutoGroupAdderListener.java:68)
 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
 at java.lang.reflect.Method.invoke(Method.java:597)
 at com.atlassian.event.internal.SingleParameterMethodListenerInvoker.invoke(SingleParameterMethodListenerInvoker.java:36)
...

Cause

The groups in the LDAP server are read-only and because you have placed the LDAP directory at the top position, the users from LDAP server take precedence with the groups duplicated across. Associating the user with LDAP group which is read only will fail.

Resolution

  1. If you will want to have the groups in both the JIRA application and LDAP, then better just associate the users with the necessary group from LDAP right from the beginning.
  2. Enable write permission on the LDAP server and edit the directory to have the "read/write" permission.
  3. If the group that is duplicated in the JIRA application is not very useful in LDAP, you may want to consider deleting the group and then re-synchronize your directory.

(info) Please see our Troubleshooting LDAP User Management documentation for further assistance with diagnosing LDAP problems.

Was this helpful?

Thanks for your feedback!

Why was this unhelpful?

Have a question about this article?

See questions about this article

Powered by Confluence and Scroll Viewport