Same user in Several User Directories

[Annicka Rosengren]

Which problems can occur if the same userid is present in two different user directories?

[SarahA · Accepted solution]

Hallo Annicka and Rian :)

For detailed information about what the impact of having the same username in different directories, please refer to this document:

https://confluence.atlassian.com/display/DOC/Managing+Multiple+Directories

The document describes how the directory order affects the processing, in terms of:

• User authentication -- the password that is checked when the user logs in
• User permissions -- the groups that the user is considered to belong to
• User updates -- the directory that will be updated when an administrator makes changes to the user details in Confluence.

Things can become complex, and the document states that duplicate usernames across directories are not supported.

I hope this helps!

Cheers, Sarah

[RianA]

True, thanks for pointing out that documentation. Well as my experience as support having same username in across directories can still be done. Also, if you notice in the documentation in the Effect of directory order, it seems that it's possible to have same username on different directories, as it will take the first occurrence of the user to validate. Sorry for the confusion though.

[RianA]

Hi Annicka, If same users exist in different directories there won't be an issue. In Confluence's database it will be represented as two different users, however the ownership should be similar. The user's detail (including membership and password) will be taken based on the sequence of user directory in Confluence Admin. If the user is found from the first directory, the details will be taken from there.

Hope it helps.

[Radek Janata]

The only real thing we are experiencing is that all such usernames are duplicate (doubled) in all user picker custom fields (incl. system fields Reporter and Watchers; but not Assignee).

[Loic Yannou]

Hi everyone

Is there any trick in order to avoid this behaviour (duplicate usernames) ?

Best

[Radek Janata]

@Loic Yannou, you cannot order user directories to avoid duplicates. There are actually only two possible solutions in my mind:

1. have distinct (different) user base in these user directories. If you need to connect to the same LDAP, have different LDAP filters for each to retrieve users from different units or with different attributes.
2. if you need the second LDAP with the same users (e.g. as a backup user directory), setup the second user directory as delegated for authentication only. See Connecting to an internal directory with LDAP authentication.

[Application Services]

We use Crowd for JIRA accounts. Our Crowd has configured 3 directories, 1 local and 2 LDAP Delegated authentication directories'.

A user had account in one of these Delegated directory (one AD domain) and then his account was de-activated in AD and Crowd, and a new, with the same user id, was created in the other LDAP domain and in CROWD. 

JIRA was not always recognising the second account, and user was getting message access errors.

I had to rename the inactive account in Crowd and then the active would be corrctly recognised JIRA.

[Ting]

@Radek Janata  There was a bug reported for the duplicate entries are showing on the user picker fields.

JRASERVER-68456 - Duplicate users returned if a user exists in more than 1 directory.