Specifying an Additional Group DN causes memberships to be ignored in Active Directory

Environment

Confluence 5.6.5

Directory Structure:

• Base DN: DC=corp,DC=local
• Location of Groups: OU=Confluence,DC=corp,DC=local
  • Groups include confluence-users and confluence-administrators, among others
• Users are members of groups at that location

Steps to Reproduce

• Configure a connection to Active Directory, with DC=corp,DC=local as your base DN
• Set OU=Confluence as your Additional Group DN
• Save and Synchronise Confluence

Expected Result

• All users will be synchronised in
• Memberships from Active Directory will be preserved - if a user is a member of confluence-users in Active Directory, that user should be a member of confluence-users in Confluence.

Actual Result

• All users will be synchronised in
• Memberships from Active Directory will not be present - users sync'd in will not be members of specific groups.

Possible Workaround

Performing a test as a particular user will force the memberships for that user to be synchronised in.

Workaround:

Remove the additional Group DN from the configuration, and synchronise Confluence against the directory - memberships will be preserved.

Note: You can use LDAP Filters to ensure only the correct users and groups are brought into Confluence