<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>Hi,</div><div><br data-mce-bogus="1"></div><div>i tried many linear combinations of setup options when i tied our JIRA to ldap.</div><div>First it was tied to openldap with user auth only.</div><div>Once we started to use IPA, i changed. Using the base config of FedoraDS</div><div>was chosen becuase IPA is based on it as well. We don't want any of our </div><div>service actively modifying ldap, so read-only posix schema was the choice.</div><div><br data-mce-bogus="1"></div><div>As for group matching. Accounts tree will not work, don't know why, it </div><div>just did not work for us. Use compat tree, it is there for these occasions.</div><div><br data-mce-bogus="1"></div><div>On the membership schem settings:</div><div style="padding-left: 30px;" data-mce-style="padding-left: 30px;">Group member attribute: memberUid<br></div><div style="padding-left: 30px;" data-mce-style="padding-left: 30px;">User membership attribute: memberOf</div><div style="padding-left: 30px;" data-mce-style="padding-left: 30px;">Use the user membership attribute: no tick</div><div><br data-mce-bogus="1"></div><div>For this setup you need a service user, because <span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;">memberUid </span>attributes of users</div><div>are not visible for a single user in the ldap schema - don't remember why.</div><div>We needed that for user filter as well, so we have chosen to use it this way.</div><div><br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div><br></div><div data-marker="__SIG_PRE__"><div><small style="font-size: 10pt; font-family: 'Segoe UI', 'Lucida Sans', sans-serif; background-color: #fdfdfd;" data-mce-style="font-size: 10pt; font-family: 'Segoe UI', 'Lucida Sans', sans-serif; background-color: #fdfdfd;"><span color="#077179" face="Verdana" style="font-size: 10pt; color: #077179; font-family: Verdana;" data-mce-style="font-size: 10pt; color: #077179; font-family: Verdana;"><small style="font-size: 10pt;" data-mce-style="font-size: 10pt;"><b style="font-size: 10pt;" data-mce-style="font-size: 10pt;">Sándor Juhász</b></small></span></small><br style="font-size: 13px; font-family: 'Segoe UI', 'Lucida Sans', sans-serif; background-color: #fdfdfd;" data-mce-style="font-size: 13px; font-family: 'Segoe UI', 'Lucida Sans', sans-serif; background-color: #fdfdfd;"></div><div style="font-size: 13px; font-family: 'Segoe UI', 'Lucida Sans', sans-serif; background-color: #fdfdfd;" data-mce-style="font-size: 13px; font-family: 'Segoe UI', 'Lucida Sans', sans-serif; background-color: #fdfdfd;"><small style="font-size: 10pt;" data-mce-style="font-size: 10pt;"><span face="Verdana" style="font-size: 10pt; font-family: Verdana;" data-mce-style="font-size: 10pt; font-family: Verdana;"><span color="#666666" style="font-size: 10pt; color: #666666;" data-mce-style="font-size: 10pt; color: #666666;"><small style="font-size: 10pt;" data-mce-style="font-size: 10pt;">System Administrator</small></span><br style="font-size: 10pt;" data-mce-style="font-size: 10pt;"></span><span color="#fca311" style="font-size: 10pt; color: #fca311;" data-mce-style="font-size: 10pt; color: #fca311;"><small style="font-size: 10pt;" data-mce-style="font-size: 10pt;"><small style="font-size: 10pt;" data-mce-style="font-size: 10pt;"><span face="Verdana" style="font-size: 10pt; font-family: Verdana;" data-mce-style="font-size: 10pt; font-family: Verdana;"><b style="font-size: 10pt;" data-mce-style="font-size: 10pt;"><big style="font-size: 10pt;" data-mce-style="font-size: 10pt;">ChemAxon</big></b></span></small></small></span><span face="Verdana" style="font-size: 10pt; font-family: Verdana;" data-mce-style="font-size: 10pt; font-family: Verdana;"><span color="#fca311" style="font-size: 10pt; color: #fca311;" data-mce-style="font-size: 10pt; color: #fca311;"><small style="font-size: 10pt;" data-mce-style="font-size: 10pt;"> <b style="font-size: 10pt;" data-mce-style="font-size: 10pt;">Ltd</b>.</small></span><br style="font-size: 10pt;" data-mce-style="font-size: 10pt;"><small style="font-size: 10pt;" data-mce-style="font-size: 10pt;"><span color="#666666" style="font-size: 10pt; color: #666666;" data-mce-style="font-size: 10pt; color: #666666;"></span></small></span></small></div><div style="font-size: 13px; font-family: 'Segoe UI', 'Lucida Sans', sans-serif; background-color: #fdfdfd;" data-mce-style="font-size: 13px; font-family: 'Segoe UI', 'Lucida Sans', sans-serif; background-color: #fdfdfd;"><span style="color: #666666; font-size: 10pt; font-family: Verdana;" data-mce-style="color: #666666; font-size: 10pt; font-family: Verdana;">Building Hx, GraphiSoft Park, Záhony utca 7, Budapest, Hungary, H-1031</span></div><div style="font-size: 13px; font-family: 'Segoe UI', 'Lucida Sans', sans-serif; background-color: #fdfdfd;" data-mce-style="font-size: 13px; font-family: 'Segoe UI', 'Lucida Sans', sans-serif; background-color: #fdfdfd;"><span style="color: #666666; font-size: 10pt; font-family: Verdana;" data-mce-style="color: #666666; font-size: 10pt; font-family: Verdana;"><span style="color: #666666; font-family: Verdana; font-size: 13px; background-color: #fdfdfd;" data-mce-style="color: #666666; font-family: Verdana; font-size: 13px; background-color: #fdfdfd;">Cell: +36704258964</span></span></div></div><br><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>From: </b>"Christopher Lamb" <christopher.lamb@ch.ibm.com><br><b>To: </b>"Martin Kosek" <mkosek@redhat.com>, "Brian Topping" <brian.topping@gmail.com>, "Sandor Juhasz" <sjuhasz@chemaxon.com><br><b>Cc: </b>freeipa-users@redhat.com<br><b>Sent: </b>Wednesday, June 10, 2015 1:55:15 PM<br><b>Subject: </b>Re: [Freeipa-users] LDAP authentication for JIRA using FreeIPA<br></div><br><div data-marker="__QUOTED_TEXT__">Hi All<br><br>Thanks to Brian and Sandor for their input so far - this gives me another<br>approach to try.<br><br>From my side this is a work-in-progress report: we have got something<br>working, but are not quite happy with it.<br><br>Stepping back a bit: I suspect there are a number of integration approaches<br>that may (or may not) work. Atlassian offer several default ldap<br>configurations inc. the FedoraDS mentioned by Sando. Probably several of<br>these can be massaged / bullied to work with FreeIPA with varying degrees<br>of effort / pain.<br><br>There seem also to be several possible integration use-cases, ranging from<br>full bidirectional replication of ldap users and groups down to simple<br>"read-only* authentication only.<br><br>In our case we want to take a simple approach: in fact we have tried 2<br>methods so far.<br><br>1) We first tried a one-way replication of FreeIPA users and groups to<br>JIRA, as described here:<br><br>https://confluence.atlassian.com/display/JIRA/Connecting+to+an+LDAP<br>+Directory<br><br>We used the "A generic LDAP directory server" standard config with some<br>values changed for the FreeIPA equivalents.<br><br>While we were successfully able to connect from JIRA to FreeIPA, and users<br>replicated across, groups did not - it failed at the point of group<br>membership. Also the users could not login (but that is maybe because -<br>from a JIRA point of view - the users had no groups).<br><br>We did not spend long on this approach, so it is possible that with a<br>little more tweaking we could get it to work.<br><br><br>2) We next tried an even simpler approach - using LDAP only for<br>authentication.<br><br>https://confluence.atlassian.com/display/JIRA/Connecting+to+an+Internal<br>+Directory+with+LDAP+Authentication<br><br>Under this approach, when a user first tries to logon to JIRA the user is<br>authenticated and replicated to JIRA. Groups remain local the JIRA<br>directory (although a default group e.g. jira-users can be setup.)<br><br>This approach is suitable when only a subset of LDAP users need JIRA<br>access. Being one-way there should be no danger of JIRA screwing the LDAP.<br><br>While we can successfully authenticate FreeIPA users (and thus login and<br>work in JIRA) with this approach, so far we have not been able to get the<br>email address to replicate from FreeIPA to JIRA (and without working email<br>notifications JIRA is rendered as useful as a chocolate teapot)<br><br>We will continue experimenting (we now have a suggested config from Sandor<br>below as a further variant).<br><br>Once we get something satisfactory working I would be pleased to contribute<br>to a wiki-page on the topic.<br><br>Cheers<br><br>Chris<br><br><br><br><br>From: Martin Kosek <mkosek@redhat.com><br>To: Brian Topping <brian.topping@gmail.com>, Sandor Juhasz<br> <sjuhasz@chemaxon.com><br>Cc: freeipa-users@redhat.com<br>Date: 10.06.2015 12:13<br>Subject: Re: [Freeipa-users] LDAP authentication for JIRA using FreeIPA<br>Sent by: freeipa-users-bounces@redhat.com<br><br><br><br>Cool, I am glad you made this working. BTW, would any of you mind<br>volunteering<br>and helping the FreeIPA community with contributing a HOWTO article on "how<br>to<br>configure FreeIPA and Jira"? It is still missing in FreeIPA.org wiki.<br><br>All we have right now is the link to this discussion, that Petr Spacek<br>added to<br>http://www.freeipa.org/page/HowTos#Web_Services<br><br>It would be really nice to also have a real page that others can follow and<br>use.<br><br>Thank you!<br>Martin<br><br>On 06/10/2015 11:29 AM, Brian Topping wrote:<br>> FYI, that mirrors my configuration. Not sure if this was covered<br>previously, but for my setup, only JIRA connects to IPA. All the other<br>atleasian products contact JIRA for their information.<br>><br>> Cheers, Brian<br>><br>>> On Jun 10, 2015, at 12:47 AM, Sandor Juhasz <sjuhasz@chemaxon.com><br>wrote:<br>>><br>>> Hi,<br>>><br>>> here are our working configurations. Might be useful.<br>>> We use compat tree for auth.<br>>> We use user in group matching.<br>>> We use group filter for login authorization.<br>>> We use FedoraDS as ldap connector on JIRA's side.<br>>> We don't use pw change or user create in IPA from JIRA side.<br>>> Watch out not to have matching local users/groups or you will suffer<br>bigtime.<br>>> Initially it was setup not to use ldap groups, but was changed<br>afterwards by<br>>> creating all new groups in ldap for this purpose and readding the users.<br>>> We use ldap service user for binding -<br>https://www.freeipa.org/page/Zimbra_Collaboration_Server_7.2_Authentication_and_GAL_lookups_against_FreeIPA<br>.<br>>><br>>> Attributes:<br>>> "autoAddGroups": ""<br>>> "com.atlassian.crowd.directory.sync.currentstartsynctime": "null"<br>>> "com.atlassian.crowd.directory.sync.issynchronising": "false"<br>>> "com.atlassian.crowd.directory.sync.lastdurationms": "373"<br>>> "com.atlassian.crowd.directory.sync.laststartsynctime": "1433920165776"<br>>> "crowd.sync.incremental.enabled": "false"<br>>> "directory.cache.synchronise.interval": "3600"<br>>> "ldap.basedn": "dc=<OURDOMAIN>"<br>>> "ldap.connection.timeout": "0"<br>>> "ldap.external.id": ""<br>>> "ldap.group.description": "description"<br>>> "ldap.group.dn": "cn=groups,cn=compat"<br>>> "ldap.group.filter": "(&(objectClass=posixgroup)(|<br>(cn=<COMPANYGROUP>)(cn=<TEAMGROUPS>)(cn=<JIRAGROUP>)))"<br>>> "ldap.group.name": "cn"<br>>> "ldap.group.objectclass": "groupOfUniqueNames"<br>>> "ldap.group.usernames": "memberUid"<br>>> "ldap.local.groups": "false"<br>>> "ldap.nestedgroups.disabled": "true"<br>>> "ldap.pagedresults": "false"<br>>> "ldap.pagedresults.size": "1000"<br>>> "ldap.password": ********<br>>> "ldap.pool.initsize": "null"<br>>> "ldap.pool.maxsize": "null"<br>>> "ldap.pool.prefsize": "null"<br>>> "ldap.pool.timeout": "0"<br>>> "ldap.propogate.changes": "false"<br>>> "ldap.read.timeout": "120000"<br>>> "ldap.referral": "false"<br>>> "ldap.relaxed.dn.standardisation": "true"<br>>> "ldap.roles.disabled": "true"<br>>> "ldap.search.timelimit": "60000"<br>>> "ldap.secure": "false"<br>>> "ldap.url": "ldap://<IPAURL>"<br>>> "ldap.user.displayname": "cn"<br>>> "ldap.user.dn": "cn=users,cn=accounts"<br>>> "ldap.user.email": "mail"<br>>> "ldap.user.encryption": "sha"<br>>> "ldap.user.filter":<br>"(&(objectclass=posixAccount)(memberOf=cn=<JIRAGROUP>,cn=groups,cn=accounts,dc=<OURDOMAIN>))"<br><br>>> "ldap.user.firstname": "givenName"<br>>> "ldap.user.group": "memberOf"<br>>> "ldap.user.lastname": "sn"<br>>> "ldap.user.objectclass": "person"<br>>> "ldap.user.password": "userPassword"<br>>> "ldap.user.username": "uid"<br>>> "ldap.user.username.rdn": ""<br>>> "ldap.userdn":<br>"uid=<OURSERVICEUSER>,cn=sysaccounts,cn=etc,dc=<OURDOMAIN>"<br>>> "ldap.usermembership.use": "false"<br>>> "ldap.usermembership.use.for.groups": "false"<br>>> "localUserStatusEnabled": "false"<br>>><br>>> Sándor Juhász<br>>> System Administrator<br>>> ChemAxon Ltd.<br>>> Building Hx, GraphiSoft Park, Záhony utca 7, Budapest, Hungary, H-1031<br>>> Cell: +36704258964<br>>><br>>> From: "Martin Kosek" <mkosek@redhat.com><br>>> To: "Christopher Lamb" <christopher.lamb@ch.ibm.com>,<br>freeipa-users@redhat.com<br>>> Sent: Wednesday, June 10, 2015 9:22:03 AM<br>>> Subject: Re: [Freeipa-users] LDAP authentication for JIRA using FreeIPA<br>>><br>>> On 06/08/2015 06:44 PM, Christopher Lamb wrote:<br>>>><br>>>> Hi All<br>>>><br>>>> we are interested to know if anybody has succeeded (or for that matter<br>>>> failed) in using FreeIPA to provide user authentication for Atlassian<br>>>> products such as JIRA or Confluence?<br>>>><br>>>> Somewhere in an Atlassian ticket I saw that FreeIPA is not officially<br>>>> supported, so I guess that should set our expectations .....<br>>>><br>>>> If anyone has succeeded, then of course any tips on how best to do so<br>would<br>>>> be fantastic!<br>>><br>>> I saw reply in the threads, so it should be covered.<br>>><br>>> BTW, please add +1s to respective Jira tickets to add proper FreeIPA<br>support.<br>>> It would be really cool if Jira would know FreeIPA out of the box and<br>could<br>>> connect to it natively!<br>>><br>>> --<br>>> Manage your subscription for the Freeipa-users mailing list:<br>>> https://www.redhat.com/mailman/listinfo/freeipa-users<br>>> Go to http://freeipa.org for more info on the project<br>>> --<br>>> Manage your subscription for the Freeipa-users mailing list:<br>>> https://www.redhat.com/mailman/listinfo/freeipa-users<br>>> Go to http://freeipa.org for more info on the project<br>><br>><br><br>--<br>Manage your subscription for the Freeipa-users mailing list:<br>https://www.redhat.com/mailman/listinfo/freeipa-users<br>Go to http://freeipa.org for more info on the project<br></div></div></body></html>