Migrate users from external LDAP to internal JIRA

[Iurii Sokolov]

Hello everyone.

I would like to migrate all users from external directory to JIRA internal. JIRA is version 6.3, external directory is Microsoft AD read only with internal groups. I don't have option to migrate users on user management page. As I understand it's because JIRA doesn't have write permissions to LDAP. But since I don't know what it will write in LDAP during migration, I think it's too risky to just allow it. I found a way to change active user directory for Confluence by just replacing group ID in database. Will it work for JIRA? If yes, could anyone point me to detailed guide for that, please? Or, maybe, there is another solution for such situation?

Thanks in advance.

[Andy Heinzer · Accepted solution]

You could migrate users from a delegated LDAP directory to the Jira internal directory as per the instructions in Migrating users between user directories.   But please understand that this form of migration will delete the user accounts in LDAP and add them to Jira internal directory if successful.  That usually is not something I would recommend since LDAP/Active Directory is commonly used for many other systems to handle logins/authentication and not just for the the sake of Jira.

The alternative here is to create accounts in the Jira Internal user directory with the exact same usernames as the LDAP directory, and then order the Jira internal directory above that LDAP user directory in Jira. 

When a username exists in multiple user directories connected to Jira, that user can ONLY login using the credentials set for that account in the highest ordered directory where that username exists.

How many users do you have in AD that are currently using Jira?  Depending the number of users could determine the best course of action for getting all these accounts in the internal directory without directly effecting the LDAP/AD instance itself.

[Iurii Sokolov]

Thanks, Andrew.

Yes, it is highly unwanted to delete accounts from LDAP. Currently there are about 400 active users in Jira. I am now trying to do that trick, but with Jira.

[Andy Heinzer]

@Iurii Sokolov Please take a look at this kb, Migrate local group memberships between directories

I believe it has some steps you can take in order to copy these user accounts and their permissions from your existing directory in Jira, and then make use of the third party plugin Jira Command Line Interface to help bulk create these users in another user directory (such as the internal user directory of Jira).

[Dave Mathijs]

Hi @Andy Heinzer , I'm currently trying your instructions, but Jira won't simply allow me to create the a user with the same username in the Jira Internal Directory if it already exists in the external directory. Any workarounds?