Unable to find the groupname of the principal error when connecting to an OpenLDAP/FedoraDS directory
Symptoms
You are trying to set up an LDAP connector in JIRA, connecting to an OpenLDAP/FedoraDS server. After the sync is completed, the users and groups have been imported into JIRA successfully, but the group memberships are not there, e.g. the groups contain no users, and all users are not members in their respective groups.
The following appears in the atlassian-jira.log:
[ldap.mapper.entity.LDAPGroupAttributesMapper] The following record does not have a groupname: {ou=ou: Groups, objectclass=objectClass: organizationalUnit, top}
[atlassian.crowd.directory.DbCachingRemoteDirectory] failed synchronisation complete in [ 75ms ]
[atlassian.crowd.directory.DbCachingDirectoryPoller] Error occurred while refreshing the cache for directory [ 10000 ].
com.atlassian.crowd.exception.OperationFailedException:
org.springframework.ldap.UncategorizedLdapException: Unable to find the groupname of the principal.
at com.atlassian.crowd.directory.SpringLDAPConnector.searchEntitiesWithRequestControls(SpringLDAPConnector.java:416)
Diagnosis
This problem should only occur when you are attempting to connect to OpenLDAP. Also, your LDAP configuration is making use of the Posix Schema:
"ldap.group.filter": "(objectclass=posixGroup)"
"ldap.group.name": "cn"
"ldap.group.objectclass": "posixGroup"
Cause
First Causes:
You are configuring an LDAP type which is incompatible with the LDAP schema, e.g. you should use the OpenLDAP (Read-only Posix Schema) directory type instead of OpenLDAP.
Additionally, this may also be related to this bug report here: JRA-30737 - Getting issue details... STATUS
Second Causes:
You are using Posix Schema with Group attributes in Full Distinguish Name (DN), e.g. uniqueMember: uid=test123,ou=group,dc=abc,dc=com.
Resolution
For the First Causes:
Use the OpenLDAP (Read-only Posix Schema) directory type in JIRA, instead of OpenLDAP.
For the Second Causes:
Use the Generic Directory Server directory type in JIRA, instead of FedoraDS (Read-only Posix Schema).
Related Content