Bamboo can be integrated with LDAP for the authentication and authorisation of LDAP users. The Integrating Bamboo with LDAP instructions below describe how you can set this up. Please note that Bamboo does not currently support multiple LDAP servers. If you need to connect to multiple LDAP servers, please consider using Atlassian's Crowd.

Note that if you use Bamboo with LDAP, you cannot manage LDAP accounts or user groups from the Bamboo admin screens. LDAP user management is performed by editing a configuration file. See the Integrating Bamboo with LDAP instructions on this page.

(warning) In Bamboo versions prior to 1.2.2, it is not possible to perform XML backups of your Bamboo instance when integrated with LDAP. In Bamboo version 1.2.2 and later, exports are possible, but user data will not be included in the export.

(warning) Please note that once LDAP has been enabled, reverting back to local user management is not possible.

On this page:

Related pages:

Integrating Bamboo with LDAP

Step 1 – Compatability checks

You will need to confirm that your LDAP server is compatible and set up correctly before integrating it with Bamboo. Please check your LDAP server against the following requirements:

Step 2 — Backup your data

We strongly recommend that you backup your data before attempting LDAP integration.

Step 3 — Configure connection details

The LDAP server connection is specified by manually editing the file atlassian-user.xml.

To configure your connection details:*

  1. Edit the file .../{BAMBOO-HOME}/xml-data/configuration/atlassian-user.xml and configure the connection AD or LDAP.

  2. Check your configuration against the example connection details shown below.

    <ldap key="ldapRepository" name="LDAP Repository@hecate.atlassian.com" cache="true">
    <host>hecate.atlassian.com</host>
    <port>389</port>
    <securityPrincipal>cn=admin,dc=atlassian,dc=private</securityPrincipal>
    <securityCredential>secret</securityCredential>
    <securityProtocol>plain</securityProtocol>
    <securityAuthentication>simple</securityAuthentication>
    <baseContext>dc=atlassian,dc=private</baseContext>

....

  3. Please ensure that the following line is also active in your atlassian-user.xml(it should be there by default):

    <hibernate name="Hibernate Repository" key="hibernateRepository"  description="Hibernate Repository" />

Step 4 — Map the LDAP data tree

To map the LDAP Data Tree:

  1. To configure the mappings in atlassian-user.xml for either AD or LDAP, please see:

  2. Check your configuration against the example connection details shown below.

    ...

    <baseUserNamespace>dc=staff,dc=perftest,dc=atlassian,dc=private</baseUserNamespace>
    <baseGroupNamespace>dc=groups,dc=perftest,dc=atlassian,dc=private</baseGroupNamespace>
    <usernameAttribute>cn</usernameAttribute>
    <userSearchFilter>(objectClass=inetorgperson)</userSearchFilter>
    <firstnameAttribute>givenname</firstnameAttribute>
    <surnameAttribute>sn</surnameAttribute>
    <emailAttribute>mail</emailAttribute>
    <groupnameAttribute>cn</groupnameAttribute>
    <groupSearchFilter>(objectClass=groupOfNames)</groupSearchFilter>
    <membershipAttribute>member</membershipAttribute>
</ldap>

Filters: <userSearchFilter> and <groupSearchFilter> may use the AD specific filter syntax. Operators such as & need to be escaped.

<userSearchFilter>(&amp;(objectClass=inetorgperson)(memberOf=cn=bamboo-usr,ou=groups,DC=atlassian,dc=com))</userSearchFilter>

Depending on the LDAP server being used, different object types may have common objectClass values. In this case, please customize the User and Group filters so that Bamboo can fetch only the objects that are really useful for the application. If your directory server does not display the literal object LDIF details, you may want to use an LDAP browser tool like Apache Directory Studio to check if the filters are restricting the objects correctly based on one or more object attributes.

Step 5 — Optional LDAP settings

The following settings do not appear in the default atlassian-user.xml file. Their default values are as follows:

<poolingOn>true</poolingOn>
<maxSize>0</maxSize>
<initSize>10</initSize>
<prefSize>10</prefSize>
<debugLevel>none</debugLevel>
<securityProtocol>plain ssl</securityProtocol>
<authentication>simple</authentication>
<timeout>0</timeout>
<initialContextFactory>com.sun.jndi.ldap.LdapCtxFactory</initialContextFactory>
<batchSize>100</batchSize>
<timeToLive>0</timeToLive>
<userSearchAllDepths>true</userSearchAllDepths>
<groupSearchAllDepths>true</groupSearchAllDepths>


If you want to override these default values, you can specify any or all of them by adding them to the end of the atlassian-user.xml file. For example, to add your own value for the <initSize> setting, you would add an extra line before the </ldap> line:

...
    <groupnameAttribute>cn</groupnameAttribute>
    <groupSearchFilter>(objectClass=groupOfNames)</groupSearchFilter>
    <membershipAttribute>member</membershipAttribute>
    <initSize>20</initSize>
</ldap>

It is important that the connection pool timeout value be set to 0, as this will force Atlassian User (via the JNDI layer) to clean up lingering connections that have lived past one request. For more information about LDAP pools please see http://java.sun.com/products/jndi/tutorial/ldap/connect/config.html.

External User Management

You cannot manage LDAP accounts or user groups from Bamboo. Bamboo will continue to use local users and groups, even when LDAP is enabled. If you need to assign LDAP users to particular groups referenced by Bamboo (e.g. for permissions or notifications), the workaround is to assign your LDAP users to local Bamboo groups, and reference these groups rather than LDAP groups.

(warning) Please note that once LDAP has been enabled, reverting back to local user management is not possible.

  1. Navigate to Administration > User Repositories (under 'Security').

  2. Choose Custom user repository.

  3. Click Save.

Step 1 — Configuring Bamboo for External User Management

Please ensure that Read-only External User Management is turned OFF in Bamboo before assigning LDAP users to Bamboo groups. The Read-only External User Management check-box in Bamboo controls whether users and groups in Bamboo are editable. Setting this option to ON will make users and groups in Bamboo read-only (i.e. the implication being that you will be managing your users and groups externally).

(info) If you are using Crowd together with an LDAP, please read the documentation on Integrating Bamboo with Crowd to see our recommended settings for the Read-only External User Management check-box.

To disable Read-only External User Management:

  1. Click Administration in the top menu bar.
  2. Click Security Settings (under 'Security') in the left navigation panel.
  3. Clear the Read-only External User Management check-box.
  4. Click Save.

Step 2 — Assigning LDAP Users to Bamboo Groups

Once Bamboo is started with 'Read-Only External User Management' disabled, you can assign LDAP users to Bamboo groups. Please see Changing members of groups.
(warning) Please note, the 'View Users' and 'View Groups' screens in Bamboo currently will not list all of your LDAP users/groups (please see BAM-1963 for details).

Notes