Status:
Current Test configuration for directories:
Current user:
Directory ID: 10100
Username: por.ch
Display name: Rolf Poser
Email address: rolf.poser@glencore.com
Directory 1:
Directory ID: 10100
Name: Delegated AnyAccess Authentication
Active: true
Type: DELEGATING
Created date: Thu Oct 01 08:05:45 UTC 2015
Updated date: Thu Mar 25 09:05:46 UTC 2021
Allowed operations: [CREATE_GROUP, CREATE_ROLE, CREATE_USER, DELETE_GROUP, DELETE_ROLE, DELETE_USER, UPDATE_GROUP, UPDATE_GROUP_ATTRIBUTE, UPDATE_ROLE, UPDATE_ROLE_ATTRIBUTE, UPDATE_USER, UPDATE_USER_ATTRIBUTE]
Implementation class: com.atlassian.crowd.directory.DelegatedAuthenticationDirectory
Encryption type: null
Attributes:
crowd.delegated.directory.auto.create.user: false
crowd.delegated.directory.auto.update.user: false
crowd.delegated.directory.importGroups: false
crowd.delegated.directory.type: com.atlassian.crowd.directory.MicrosoftActiveDirectory
ldap.basedn: DC=ANYACCESS,DC=NET
ldap.external.id: objectGUID
ldap.group.description: description
ldap.group.filter: (objectCategory=Group)
ldap.group.name: cn
ldap.group.objectclass: group
ldap.group.usernames: member
ldap.nestedgroups.disabled: true
ldap.pagedresults: true
ldap.pagedresults.size: 1000
ldap.password: ********
ldap.referral: true
ldap.secure: true
ldap.url: ldaps://ldap.met.ch.glencore.net:3269
ldap.user.displayname: displayName
ldap.user.email: mail
ldap.user.filter: (&(objectCategory=Person)(sAMAccountName=*))
ldap.user.firstname: givenName
ldap.user.group: memberOf
ldap.user.lastname: sn
ldap.user.objectclass: user
ldap.user.username: sAMAccountName
ldap.user.username.rdn: cn
ldap.userdn: CN=svc-bar-jiraldap,OU=Service Accounts,OU=Baar,OU=Europe,DC=ANYACCESS,DC=NET
ldap.usermembership.use: false
ldap.usermembership.use.for.groups: false
Directory 2:
Directory ID: 1
Name: Jira Internal Directory
Active: true
Type: INTERNAL
Created date: Wed Aug 31 16:53:41 UTC 2011
Updated date: Wed Aug 31 16:53:41 UTC 2011
Allowed operations: [CREATE_GROUP, CREATE_ROLE, CREATE_USER, DELETE_GROUP, DELETE_ROLE, DELETE_USER, UPDATE_GROUP, UPDATE_GROUP_ATTRIBUTE, UPDATE_ROLE, UPDATE_ROLE_ATTRIBUTE, UPDATE_USER, UPDATE_USER_ATTRIBUTE]
Implementation class: com.atlassian.crowd.directory.InternalDirectory
Encryption type: atlassian-security
Attributes:
user_encryption_method: atlassian-security
Current provisioning:
-
Create user manually in Jira assigned to LDAP integration
-
LDAP is used only for authentication at the moment
LDAP Query that used for another system to get “real” users:
2-phase approach (powershell script format):
-
Retrieve and filter relevant OUs:
#Get list of "Users" and "External Users" OU
$OUs = get-adobject -Filter "ObjectClass -eq 'organizationalunit'" `
| Where-Object { ($_.Name -like "*Users*") -or ($_.Name -like "*Glencore Remote Offices*") -and ($_.Name -notlike "*Administrative Users*") -and ($_.Name -notlike "*/Generic/*") -and ($_.Name -notlike "*/Test/*") } `
| Where-Object { ($_.DistinguishedName -notmatch '^(.*(user).*){2,}$') -and ($_.DistinguishedName -notlike "*Beijing*") }
2. Filter out irrelevant users by parsing through each OU:
#Create a RawUser table based on filters agreed with Corporate Apps Support team
foreach ($OU in $OUs) {
$RawUsers += Get-ADUser -SearchBase $OU -Filter { (enabled -eq 'true') -and (samaccountname -notlike "gen-*") -and (samaccountname -notlike "gen.*") -and (samaccountname -notlike "res-*")
-and (samaccountname -notlike "res.*") -and (samaccountname -notlike "svc-*") -and (samaccountname -notlike "svc.*") -and (samaccountname -notlike "zzt*") -and (samaccountname -notlike "*-sa")
-and (samaccountname -notlike "*-ra") -and (samaccountname -notlike "*-a") -and (samaccountname -notlike "*-t0") -and (samaccountname -notlike "*-t1") -and (samaccountname -notlike "*-t2")
-and (samaccountname -notlike "*-p") -and (samaccountname -notlike "zzz*") -and (mail -notlike "zzt.*") -and (GivenName -ne "Generic")
-and (mail -notlike "*@kazzinc.com") -and (mail -notlike "*@kazzinc.kz") -and (mail -notlike "*@kazzink.kz*") -and (mail -notlike "*@altyntau.com") -and (mail -notlike "*@kzhld.com")
-and (mail -notlike "*@kormin.ru") -and (mail -notlike "*@sinchiwayra.com.bo") -and (mail -notlike "*@illapa.com.bo") -and (mail -notlike "*@sanlucas.com.bo*")
-and (mail -notlike "*@ale.com.br") -and (mail -notlike "*@alesat.com.br")
-and (mail -notlike "*@nordicstorage.se")
-and (mail -notlike "*@mefasa.com") } `
-Properties CanonicalName,ObjectGUID,samAccountName,GivenName,middleName,sn,mail,DisplayName,c,co,st,l,office,streetAddress,company,department,title,Enabled,extensionAttribute2,msExchExtensionAttribute26,EmployeeID,whenCreated -ResultSetSize $null `
| where { ($_.mail -ne $null) -and ($_.GivenName -ne $null) -and ($_.Surname -ne $null) -and ($_.msExchExtensionAttribute26 -notlike "Agriculture*") }
}