Uploaded image for project: 'Jira Server and Data Center'
  1. Jira Server and Data Center
  2. JRASERVER-64099

"Filter out expired users" Incremental Sync deletes users when Connected to Global Catalog

    XMLWordPrintable

    Details

      Description

      Problem

      When sync'ing JIRA with Active Directory's global catalog via incremental sync and "Filter out expired users" is enabled, we noticed that all users are deleted and re-created. This results in a loss of all local group membership details.

      Steps to Reproduce

      • Setup JIRA and add AD user directory
        • For the port, input 3268 for the Global Catalog
        • Choose to allow local groups
        • Ensure "Filter out expired users" is enabled
      • Save and sync - this will be a FULL sync as it is the first sync after the new configuration
      • Add some users to local groups
      • Sync with AD again - this time will be an INCREMENTAL sync
      • Notice that all users lose their local groups

      Investigation

      • When using INCREMENTAL sync with "Filter out expired users", JIRA's ldapsearch includes a check for accountExpires
      • accountExpires is not stored with Global Catalog: https://msdn.microsoft.com/en-us/library/ms675098(v=vs.85).aspx
        • In Global Catalog: False
      • This causes the search to return no results, causing JIRA to believe no users exist
      • Users are loosing session to login JIRA or got kick out

      Full Sync:

      2017-01-19 10:47:02,978 CrowdUsnChangedCacheRefresher:thread-1 DEBUG ServiceRunner     [c.a.crowd.directory.SpringLDAPConnector] Performing user search: baseDN = dc=example,dc=com - filter = (&(objectClass=user)(sAMAccountName=*))
      

      Incremental Sync:

      2017-01-19 13:00:25,745 Caesium-1-1 DEBUG ServiceRunner     [c.a.crowd.directory.MicrosoftActiveDirectory] Performing all objectGUID search: filter = (&(&(objectClass=user)(sAMAccountName=*))(|(accountExpires=0)(accountExpires>=131293332257440000)))
      

       

      Workaround

      • Disable "Filter out expired users"
      • Disable Incremental Sync in the JIRA to AD configuration
      • Or avoid connecting to the Global Catalog, connect to port 389

       

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              Unassigned Unassigned
              Reporter:
              dchan David
              Votes:
              3 Vote for this issue
              Watchers:
              17 Start watching this issue

                Dates

                Created:
                Updated: