You have configured an internal directory and an LDAP directory with the permission "Read Only, with Local Groups" where you have configured the default group membership to be "jira-users". Configuration was successful and sysnchronization was without any problem. When you try to login as an LDAP user, it fails with the error "You do not have a permission to log in. If you think this is incorrect, please contact your JIRA administrators." When you try to associate the user with the jira-users group from the UI, you are faced with the error "You cannot add user 'xxxx' to group 'xxxxxx'. The user's directory is read only."
The following error appears in the log:
The groups in the LDAP server are read-only and because you have placed the LDAP directory at the top position, the users from LDAP server take precedence with the groups duplicated across. Associating the user with LDAP group which is read only will fail.
- If you will want to have the groups in both JIRA and LDAP, then better just associate the users with the necessary group from LDAP right from the beginning.
- Enable write permission on the LDAP server and edit the directory to have the "read/write" permission.
- If the group that is duplicated in JIRA is not very useful in LDAP, you may want to consider deleting the group and then re-synchronize your directory.
Please see our Troubleshooting LDAP User Management documentation for further assistance with diagnosing LDAP problems.