-
Bug
-
Resolution: Fixed
-
High
-
5.14.1, 6.1.1
-
Severity 1 - Critical
-
11
-
Summary
Bamboo does not display all users coming from LDAP if amount of users exceeds MaxPageSize defined in Active Directory.
Environment
- Bamboo v5.14.1
- Windows Active Directory
Steps to Reproduce
- create a new OU, adding 1501 users:
dn: CN=bamboo.user0000,OU=users,OU=ps8102,DC=atlassian,DC=local cn: bamboo.user0000 memberOf: CN=bamboo-win-ad,OU=groups,OU=ps8102,DC=atlassian,DC=local sAMAccountName: bamboo.user0000
dn: CN=bamboo.user1500,OU=users,OU=ps8102,DC=atlassian,DC=local cn: bamboo.user1500 memberOf: CN=bamboo-win-ad,OU=groups,OU=ps8102,DC=atlassian,DC=local sAMAccountName: bamboo.user1500
- connect Bamboo to the Windows AD:
<bamboo-home>/xml-data/configuration/atlassian-user.xml, atlassian-user-custom.xml
<atlassian-user> <repositories> <!-- LDAP repository --> <ldap key="ldapRepository" name="myLdapRepository" cache="true"> <host>thanos.atlassian.local</host> <port>636</port> <securityPrincipal>CN=admin.user,CN=Users,DC=atlassian,DC=local</securityPrincipal> <securityCredential>admin.password</securityCredential> <securityProtocol>ssl</securityProtocol> <securityAuthentication>simple</securityAuthentication> <baseContext>DC=atlassian,DC=local</baseContext> <baseUserNamespace>OU=users,OU=ps8102,DC=atlassian,DC=local</baseUserNamespace> <userSearchAllDepths>true</userSearchAllDepths> <userSearchFilter>(&(objectCategory=Person)(sAMAccountName=*))</userSearchFilter> <usernameAttribute>sAMAccountName</usernameAttribute> <firstnameAttribute>givenName</firstnameAttribute> <surnameAttribute>sn</surnameAttribute> <emailAttribute>mail</emailAttribute> <baseGroupNamespace>OU=groups,OU=ps8102,DC=atlassian,DC=local</baseGroupNamespace> <groupSearchAllDepths>true</groupSearchAllDepths> <groupSearchFilter>(objectClass=group)</groupSearchFilter> <groupnameAttribute>cn</groupnameAttribute> <membershipAttribute>member</membershipAttribute> </ldap> <!-- Default bamboo user repository --> <hibernate name="Hibernate Repository" key="hibernateRepository" description="Hibernate Repository" cache="true"/> </repositories> </atlassian-user>
- search for users by hitting http://localhost:8085/admin/user/viewUsers.action?usernameTerm=&fullnameTerm=&emailTerm=&startIndex=990 in the web browser.
As a result, Bamboo lists the users up until 1000.
Expected Results
- Bamboo should paginate results over MaxPageSize
Actual Results
- Bamboo displays only the amount records set up in MaxPageSize
Notes
| Property | Default | Description |
|---|---|---|
| MaxPageSize | 1000 | This value controls the maximum number of objects that are returned in a single search result, independent of how large each returned object is. To perform a search where the result might exceed this number of objects, the client must specify the paged search control. This is to group the returned results in groups that are no larger than the MaxPageSize value. To summarize, MaxPageSize controls the number of objects that are returned in a single search result. |
Extracted from https://support.microsoft.com/en-us/kb/315071
Workaround
- Increase MaxPageSize in Active Directory
- review and update the MaxPageSize in Windows AD. Followed this documentation (https://support.microsoft.com/en-us/kb/315071)
- reconnect Bamboo with LDAP by selecting Custom user repository under Bamboo administration >> Security >> User repositories
- search for users by hitting http://localhost:8085/admin/user/viewUsers.action?usernameTerm=&fullnameTerm=&emailTerm=&startIndex=1190 in the web browser.
As a result, Bamboo listed the users up until ~1200.
- review and update the MaxPageSize in Windows AD. Followed this documentation (https://support.microsoft.com/en-us/kb/315071)
- Connect LDAP to Crowd/JIRA and connect this with Bamboo instead
[BAM-18051] Bamboo does not paginate records over MaxPageSize
@Krystian what is ETA for Bamboo 6.6? we are waiting for this feature too.
Bamboo team is reworking user authentication and management. New solution will be based on Embedded Crowd and will provide user experience similar to what Bitbucket Server and Jira provide.
Embedded Crowd will be available in Bamboo 6.6
toolservpf I've read https://getsupport.atlassian.com/servicedesk/customer/portal/10/BSP-35776 and I think your case (unable to find user using the new Permissions UI) is a combination of this issue (BAM-18051) and https://jira.atlassian.com/browse/BAM-18755. We'll be backporting https://jira.atlassian.com/browse/BAM-18755 to 6.2 branch soon and I think this will solve your problem. Please watch the other ticket as well and try the fixed version when it will be released.
Our production instance is stil running on 5.15.3, and does not have this issue. (we also opened a support case for this: https://getsupport.atlassian.com/servicedesk/customer/portal/10/BSP-35776)
toolservpf this particular issue is not a recent regression. We identified this to be a limitation of a LDAP library that Bamboo is using. Can you please let us know what Bamboo version are you using? Is this problem not appearing on your environments?
We see this also in Version 6.2.2 in our testing environment.
Although we should upgrade (test and prod) soon because of https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-12-13-939939816.html ...
I'd also like an update on this. I recently worked around this issue by modifying the base user namespace, but this will quickly become unusable again as long as only a maximum of 1000 records can be returned.
Permissions cannot be granted to users that are not found in the first 1000 records as they are not found in the search and copy/pasting into the user search permissions box does not work.
Any update on this issue? Work around provided here are not viable in an enterprise environment
- You can not expect the firm to change their policy in order to get Atlassian Bamboo to work (because of some bug/restriction you have in your product)
- We changed from Crowd to LDAP because of the performance issue we have faced with crowd.
zoom.license@zoomint.com we don't publish planned dates for releases. I'd suggest taking a look at Bamboo release cadence and extrapolate - your margin of error will be about a month.