JIRA 4.3 LDAP Migration from JIRA 4.1.1

[BroadcomS]

All our users (8000) are in at least two of the following groups jira-developers, jira-users and jira-external-users. When we create the users using LDAP Directory our local membership is lost. We can add the local membership to the LDAP query but no priviledges are granted until the user signs in. This is a pain because we have users all over the world. How can we retain local group member ship?

[AlexH · Accepted solution]

When you migrate from a version of JIRA before the "embedded crowd" change that was introduced in version 4.3 you have several options. All of those options are explained in great detail here: [http://confluence.atlassian.com/display/JIRA/JIRA+4.3+Upgrade+Guide#JIRA43UpgradeGuide-ChangestousermanagementinJIRA]

If you are switching to the "Full LDAP" option you will lose all your group membership and you will have to recreate it. There are several options on how to manage your new groups:

1. Create the groups in your AD/LDAP directory and manage membership there; JIRA will sync them and their membership assuming your group settings are correct in the User Directories.
2. Manage locally inside JIRA by enabling the "read-only with local groups" option and then recreate the groups inside JIRA.

In both cases I recommend using JIRA's remote API (https://developer.atlassian.com/display/JIRADEV/JIRA+RPC+Services and http://docs.atlassian.com/software/jira/docs/api/rpc-jira-plugin/latest/index.html?com/atlassian/jira/rpc/soap/JiraSoapService.html) to ease the transition. Write a remote api script using the JIRA.getGroup("group-name") to fetch the list of users in each group and write them out to a file in an easily parsable format (i.e. one username per line).

Then perform your upgrade. After the upgrade is complete you'll reload the group membership with another script:

1. For LDAP groups: You can format the list of users to be easily copy&pasted into your AD/LDAP admin gui tool for each group, or if you have api access to ldap have the script connect to ldap and create new groups with identical membership.
2. For local groups: Write another script that you'll run after the upgrade is completed and have it use the addUserToGroup method to re-populate your groups automatically.

[AlexH]

You might want to check out Bob Swift's excellent CLI interface to JIRA if you don't want to spend too much time writing these scripts: https://studio.plugins.atlassian.com/wiki/display/JCLI/JIRA+Command+Line+Interface

[BroadcomS]

Well copy & pasting group membership for 8000 users and 23000 groups is not my idea of fun. So it will definitly have to be a scripted solution. Thanks for the solution

[AlexH]

WOW! 23,000 groups? That is a crazy number of groups. I thought you had just 3 groups... which would have been easily C&P-able. heh.