Unable to find the groupname of the principal error when connecting to an OpenLDAP/FedoraDS directory

Platform Notice: Data Center Only - This article only applies to Atlassian products on the Data Center platform.

Note that this KB was created for the Data Center version of the product. Data Center KBs for non-Data-Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.

*Except Fisheye and Crucible

Summary

Symptoms

You are trying to set up an LDAP connector in JIRA, connecting to an OpenLDAP/FedoraDS server. After the sync is completed, the users and groups have been imported into JIRA successfully, but the group memberships are not there, e.g. the groups contain no users, and all users are not members in their respective groups.

The following appears in the atlassian-jira.log:

[ldap.mapper.entity.LDAPGroupAttributesMapper] The following record does not have a groupname: {ou=ou: Groups, objectclass=objectClass: organizationalUnit, top}
[atlassian.crowd.directory.DbCachingRemoteDirectory] failed synchronisation complete in [ 75ms ]
[atlassian.crowd.directory.DbCachingDirectoryPoller] Error occurred while refreshing the cache for directory [ 10000 ].

com.atlassian.crowd.exception.OperationFailedException: 
org.springframework.ldap.UncategorizedLdapException: Unable to find the groupname of the principal.
	at com.atlassian.crowd.directory.SpringLDAPConnector.searchEntitiesWithRequestControls(SpringLDAPConnector.java:416)

Diagnosis

This problem should only occur when you are attempting to connect to OpenLDAP. Also, your LDAP configuration is making use of the Posix Schema:

"ldap.group.filter": "(objectclass=posixGroup)"

"ldap.group.name": "cn"

"ldap.group.objectclass": "posixGroup"

Cause

First Causes:

You are configuring an LDAP type which is incompatible with the LDAP schema, e.g. you should use theOpenLDAP (Read-only Posix Schema) directory type instead of OpenLDAP.

Additionally, this may also be related to this bug report here: JRASERVER-30737 - Better handler the error when using "top" as objectclass filter in the LDAP user directory settings.

Second Causes:

You are using Posix Schema with Group attributes in Full Distinguish Name (DN), e.g. uniqueMember: uid=test123,ou=group,dc=abc,dc=com.

Solution

Resolution

For the First Causes:

Use theOpenLDAP (Read-only Posix Schema) directory type in JIRA, instead of OpenLDAP.

(Auto-migrated image: description temporarily unavailable)

For the Second Causes:

Use the Generic Directory Server directory type in JIRA, instead of FedoraDS (Read-only Posix Schema).

Atlassian Support