Confluence user management best practice: JIRA+LDAP or just LDAP?

[Mike]

We've got JIRA 6.1 running with authentication delegated to LDAP, read only. We'd now like to add the latest Confluence version to the mix and it seems there are a couple options:

1. Delegate Confluence user management to LDAP read only, with the same config we're using in JIRA
   • This was the only option on older versions of Confluence/JIRA as discussed in the docs
   • Since LDAP integration is read only, it may be simper to do it this way and avoid un extra service call everytime a user is authenticated (Confluence -> LDAP rather than Confluence -> JIRA -> LDAP)
2. Delegate Confluence user management to JIRA, which is delegating user management to LDAP
   • This seems to be possible on newer versions, as this diagram shows
   • This would eliminate the need to configure LDAP twice

Is there a best practice for this? Are their additional strengths/weaknesses of each option?

[Bruna Griebeler · Accepted solution]

Hello Mike.

I Agree with Tiago, the first option is a better practice because it will maintain LDAP as the User Manager, centralising it.
The only strengths by using Jira for user management is if don't have an LDAP.
Another option that could be good now that you have Confluence and Jira, is to add Crowd in case you want to enable SSO (Single Sign On).
In that case, when you have LDAP, Crowd, Jira and Confluence (because of SSO), then we recommend to set LDAP -> Crowd and then Crowd -> Jira and Crowd -> Confluence.

About Crowd: https://www.atlassian.com/software/crowd/overview

About SSO: https://confluence.atlassian.com/display/CROWD/Overview+of+SSO<br< a="">>
Cheers!

[Tiago Comasseto]

Hi Mike, I'd suggest opition 1. It may be a bit more complicated, but it would avoid an extra cache that is not necessary.

Cheers