You are viewing an old version of this page. View the current version.

Compare with Current View Page History

Version 1 Next »

JIRA and Confluence can do authentication against LDAP (e.g. Active Directory), using the standard Java JNDI library. When you're having LDAP connectivity problems, the ldapsearch command can sometimes be useful as a means of verifying your LDAP parameters.

Getting and configuring ldapsearch

On Ubuntu/Debian: 

apt-get install ldap-utils

On CentOS/RHEL:

yum install openldap-clients

Furthermore on CentOS/RHEL (6.4 at least), if you want SSL/TLS to work, you'll need to edit /etc/openldap/ldap.conf and add the lines:

## http://serverfault.com/questions/437546/centos-openldap-cert-trust-issues
TLS_CACERT /etc/pki/tls/certs/ca-bundle.crt

See the mentioned URL for why.

Sample query

If the Use SSL box is checked (typically port 636):

ldapsearch \
  -H ldaps://tx-dc2.corp.example.com:636 \
  -D 'CN=svcLDAPquery,CN=Managed Service Accounts,DC=corp,DC=example,DC=com' \
  -w s3cret \
  -b 'DC=corp,DC=example,DC=com' \
   sub 'OU=Internal,DC=corp,DC=example,DC=com' \
  -x -z5 \
  sAMAccountName

This query does a subtree ( sub ) search for all nodes below OU=Internal,DC=corp,DC=example,DC=com, returning the sAMAccountName (i.e. username) attribute for each. It is limited to 5 results ( -z5 ).

# ldapsearch -z5 -x -b "DC=corp,DC=example,DC=com" -D "CN=svcLDAPquery,CN=Managed Service Accounts,DC=corp,DC=example,DC=com" -w "s3cret" -s sub "(sAMAccountName=redradish)" -H ldaps://tx-dc2.corp.example.com sAMAccountName
# extended LDIF
#
# LDAPv3
# base <DC=corp,DC=example,DC=com> with scope subtree
# filter: (sAMAccountName=redradish)
# requesting: sAMAccountName
#

# Jeff Turner, CA-Users, CA, Internal, corp.example.com
dn: CN=Jeff Turner,OU=CA-Users,OU=CA,OU=Internal,DC=corp,DC=example,DC=com
sAMAccountName: redradish

# search reference
ref: ldaps://DomainDnsZones.corp.example.com/DC=DomainDnsZones,DC=corp,DC=ico
 ntrol,DC=com

# search reference
ref: ldaps://ForestDnsZones.corp.example.com/DC=ForestDnsZones,DC=corp,DC=ico
 ntrol,DC=com

# search reference
ref: ldaps://corp.example.com/CN=Configuration,DC=corp,DC=example,DC=com

# search result
search: 2
result: 0 Success

# numResponses: 5
# numEntries: 1
# numReferences: 3

LDAP's startTLS extension also allows a connection on port 389 to be upgraded to TLS ( ldapsearch -ZZ ) but I can find no evidence that JIRA/Confluence support this.

 

If you can see the existing JIRA/Confluence User Directory, the properties map to ldapsearch parameters as follows:

 

 

  • No labels