JIRA 7 has landed! Are you an existing JIRA user with questions about upgrading? Visit the Migration Hub for information about upgrading to new JIRA applications

Skip to end of metadata
Go to start of metadata


You have configured an internal directory and an LDAP directory with the permission "Read Only, with Local Groups" where you have configured the default group membership to be "jira-users". Configuration was successful and synchronization was without any problem. When you try to login as an LDAP user, it fails with the error "You do not have a permission to log in. If you think this is incorrect, please contact your JIRA administrators." When you try to associate the user with the jira-users group from the UI, you are faced with the error "You cannot add user 'xxxx' to group 'xxxxxx'. The user's directory is read only."


The following error appears in the log



The groups in the LDAP server are read-only and because you have placed the LDAP directory at the top position, the users from LDAP server take precedence with the groups duplicated across. Associating the user with LDAP group which is read only will fail.


  1. If you will want to have the groups in both the JIRA application and LDAP, then better just associate the users with the necessary group from LDAP right from the beginning.
  2. Enable write permission on the LDAP server and edit the directory to have the "read/write" permission.
  3. If the group that is duplicated in the JIRA application is not very useful in LDAP, you may want to consider deleting the group and then re-synchronize your directory.

(info) Please see our Troubleshooting LDAP User Management documentation for further assistance with diagnosing LDAP problems.

Help us improve!


Is this article helpful?
Is it well written?
Is the content complete?



  1. #3 of the resolution is unclear. If you delete the group will you not have the same problem?

  2. Another resolution to add to that list, as described in Unable to Add Users into a Group Due to Lack of Permission is to edit the LDAP directory from "Read Only" to "Read Only, with Local Groups" as this will allow your Active Directory credentials to be extended with groups in the JIRA Internal Directory.