LDAP synchronization does not load any group member
Asked by Alexander Alexander:

Hi,  
we use confluence 3.5 together with LDAP user directory. User and groups are synchronized but the groups do not show any member.  
We are able to login with our LDAP accounts but without any group membership.  
Our LDAP is a OpenLDAP system.  

After synchronization confluence has all groups and members from LDAP, but groups don't contain any member.  

Why does confluence not load the members from the member-Attribute?

Thanks in advance.


Answers:
author: Brian Hill
body: The posixGroup (memberUid) and groupOfNames (member) are mutually exclusive object classes. memberUid is just a login name - not an entire DN the way member is.

The question for Atlassian support how they support the posixGroup config if they even do.

Has anyone figured this out yet?


author: JamieA
body: I think your user membership attribute is wrong, I don't see how it could be uid. It should be memberOf or something.

Try unchecking that option.

comments: author: Alexander Alexander
body: We use static group configuration, when group's members contains into group, not into user (dynamic group configuration).

Also I tried setup configuration with unchecked and cheched option. I tried both, but result is same (


author: JamieA
body: I would create a support ticket, I'd be interested to hear what Atlassian support say about this. Sorry not to be of more help.


author: Alexander Alexander
body: Thank you.

Can you post the link of support ticket. I also will check it state.


author: JamieA
body: Sorry, I meant that I advise you to create a support ticket, and then post back here if you get useful information.


author: JamieA
body: How do you mean "member-Attribute"? AFAIK the member attribute for OpenLDAP is uniqueMember. If you have member, you need to change that in in Membership Schema Settings.

Can you double-check the actual attribute in your schema, and the settings in jira.

comments: author: Alexander Alexander
body: Jamie, thank you for answer.

I set next parameters in LDAP User Directory in section "Membership Schema Settings":

**Group Members Attribute:** memberUid

**User Membership Attribute:** uid

**Use the User Membership Attribute:** When finding the user's group membership

And after this settings members didn't load in group.


author: JamieA
body: What does the ldif for a group look like. does it have attributes called memberUid?

My settings are:

**Group Members Attribute:** uniqueMember

and the checkbox unchecked. You may have your openldap set up different from mine of course, so only looking at the ldif for a group will tell us.


author: Alexander Alexander
body: ldif of group:

dn: cn=block_ip,ou=dev,ou=Group,dc=example,dc=com  
objectClass: posixGroup  
objectClass: top  
cn: block_ip  
description: users can use script block_ip  
memberUid: daymon  
memberUid: brian  
memberUid: paul  
memberUid: john  
gidNumber: 14485  

<br />


author: JamieA
body: Hrm I have the full DN for the users - perhaps it needs that? And do you have the revese lookup working, such that if you look at the ldif for a user it shows the groups they're in? I guess that needs to be tree if you have that checkbox checked.

I'm afraid I'm out of ideas, so you might need Atlassian support. But I wonder if it requires the full DN of the users rather than just the uid.


author: Alexander Alexander
body: **ldif of user:**

dn: uid=daymon,ou=staff,ou=users,dc=example,dc=com  
objectClass: posixAccount  
objectClass: top  
objectClass: inetOrgPerson  
gidNumber: 65534  
givenName: Daymon  
sn: Caulfield  
displayName: daymon Caulfield  
uid: daymon  
homeDirectory: /home/daymon  
loginShell: /bin/bash  
mail: daymon@example.com.ua  
cn: Daymon Caulfield  
uidNumber: 56596  
userPassword: {SHA}hashofholdensecretpass=  


Tags: ldap