Linking user directories with Active Directory
Asked by Behi Shamsai:

Good Afternoon,

I am trying to integrate Confluence with my Microsoft Active Directory, but i seem to be having issues. User are also unable to log in. I have a feeling that this issues are related.

Please assist me in setting up this connection.

When i perform the Remote Directory Connection Test, i get the following results:

---------------------------------------------

Test basic connection : Succeeded

Test retrieve user : Succeeded

Test user rename is configured and tracked : Succeeded

Test get user's memberships : Failed

Test retrieve group : Not performed

Test get group members : Not performed

Test user can authenticate : Succeeded

----------------------------------------------

Here is my configuration:

-----------------------

=== Directories configured ===  
Directory ID: 294913  
Name: Confluence Internal Directory  
Active: true  
Type: INTERNAL  
Created date: 2018-12-05 11:56:25.073  
Updated date: 2018-12-05 11:56:25.073  
Allowed operations: \[UPDATE_GROUP, UPDATE_ROLE_ATTRIBUTE, DELETE_GROUP, UPDATE_ROLE, DELETE_USER, CREATE_ROLE, CREATE_USER, DELETE_ROLE, UPDATE_USER_ATTRIBUTE, UPDATE_GROUP_ATTRIBUTE, UPDATE_USER, CREATE_GROUP\]  
Implementation class: com.atlassian.crowd.directory.InternalDirectory  
Encryption type: atlassian-security  
Attributes:  
"user_encryption_method": "atlassian-security"

Directory ID: 1179649  
Name: NRG Domain Controller  
Active: true  
Type: CONNECTOR  
Created date: Wed Dec 05 15:30:24 PST 2018  
Updated date: Wed Dec 05 17:29:32 PST 2018  
Allowed operations: \[UPDATE_GROUP, UPDATE_GROUP_ATTRIBUTE, DELETE_GROUP, UPDATE_USER_ATTRIBUTE, CREATE_GROUP\]  
Implementation class: com.atlassian.crowd.directory.MicrosoftActiveDirectory  
Encryption type: sha  
Attributes:  
"com.atlassian.crowd.directory.sync.issynchronising": "false"  
"com.atlassian.crowd.directory.sync.lastdurationms": "1969"  
"com.atlassian.crowd.directory.sync.laststartsynctime": "1544059770324"  
"crowd.sync.group.membership.after.successful.user.auth.enabled": "only_when_first_created"  
"crowd.sync.incremental.enabled": "true"  
"directory.cache.synchronise.interval": "3600"  
"ldap.basedn": "DC=ad,DC=nrgmr,DC=com"  
"ldap.connection.timeout": "10000"  
"ldap.external.id": "objectGUID"  
"ldap.filter.expiredUsers": "false"  
"ldap.group.description": "description"  
"ldap.group.dn": "OU=Geographic Locations"  
"ldap.group.filter": "(\&(objectClass=group)(cn=\*))"  
"ldap.group.name": "cn"  
"ldap.group.objectclass": "groupOfUniqueNames"  
"ldap.group.usernames": "member"  
"ldap.local.groups": "true"  
"ldap.nestedgroups.disabled": "true"  
"ldap.pagedresults": "false"  
"ldap.pagedresults.size": "1000"  
"ldap.password": \*\*\*\*\*\*\*\*  
"ldap.pool.timeout": "0"  
"ldap.propogate.changes": "false"  
"ldap.read.timeout": "120000"  
"ldap.referral": "false"  
"ldap.relaxed.dn.standardisation": "false"  
"ldap.roles.disabled": "true"  
"ldap.search.timelimit": "60000"  
"ldap.secure": "false"  
"ldap.url": "ldap://lax2nrgdc01:389"  
"ldap.user.displayname": "displayName"  
"ldap.user.dn": "OU=Geographic Locations"  
"ldap.user.email": "mail"  
"ldap.user.encryption": "sha"  
"ldap.user.filter": "(\&(objectCategory=Person)(sAMAccountName=\*))"  
"ldap.user.firstname": "givenName"  
"ldap.user.group": "memberOf"  
"ldap.user.lastname": "sn"  
"ldap.user.objectclass": "user"  
"ldap.user.password": "unicodePwd"  
"ldap.user.username": "cn"  
"ldap.user.username.rdn": "cn"  
"ldap.userdn": "ldap_service"  
"ldap.usermembership.use": "true"  
"ldap.usermembership.use.for.groups": "true"  
"localUserStatusEnabled": "false"


Answers:
author: Diego
body: Hello there!  
Behi, thanks for reaching out to our Community.  
There is a possibility that one or more users d**o not have any group memberships** in your LDAP. This can trigger the warning but as long as the authenticate, user rename, retrieve user and connection checks are good, **users should be able to login.**   

Looking at your settings, it seems that you are using **local groups** with the connector. You could try and **add one of the users that is unable to login** to the **confluence-users** group (this group has login permissions by default. This is the Can Use global permission). After adding the user to the group, check if the login procedure works.

To add the user you can proceed as follow:
> 1- Click Cog Icon \> General Configuration
>
> 2- Search for **Groups**in the left hand side
>
> 3- Search for the **confluence-users** group
>
> 4- Select the group
>
> 5- Click **Add Members**
>
> 6- Insert the username of one of the **affected users**
>
> **\*** You can also click the magnifying glass and search for the user
>
> 7- Click **Add**
>
> 8- Try to login after adding the user to the group

You can check further information about the Can use permission here:

**[Global Permissions Overview](https://confluence.atlassian.com/doc/global-permissions-overview-138709.html)**

More information about the Local Groups and LDAP:

**[Connecting to an LDAP directory](https://confluence.atlassian.com/doc/connecting-to-an-ldap-directory-229838241.html)**

Let us know if this helps you!


Tags: confluence-server

server