Unable to find the groupname of the principal error when connecting to an OpenLDAP/FedoraDS directory
プラットフォームについて: Server および Data Center のみ。この記事は、Server および Data Center プラットフォームのアトラシアン製品にのみ適用されます。
Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Fisheye および Crucible は除く
This is for an outdated version of Hipchat Server
This article applies to a version of Hipchat Server which will be deprecated soon. After that period the version will no longer be supported.
You should upgrade to a more recent version of Hipchat Server as soon as you can to take advantage of new features, and security and bug fixes.
症状
You are trying to set up an LDAP connector in Hipchat server, connecting to an OpenLDAP/FedoraDS server. After the sync is completed, the users and groups have been imported into Hipchat successfully, but the group memberships are not there, e.g. the groups contain no users, and all users are not members in their respective groups.
atlassian-crowd.log に次のメッセージが表示される。
[ldap.mapper.entity.LDAPGroupAttributesMapper] The following record does not have a groupname: {ou=ou: Groups, objectclass=objectClass: organizationalUnit, top}
[atlassian.crowd.directory.DbCachingRemoteDirectory] failed synchronisation complete in [ 75ms ]
[atlassian.crowd.directory.DbCachingDirectoryPoller] Error occurred while refreshing the cache for directory [ 10000 ].
com.atlassian.crowd.exception.OperationFailedException:
org.springframework.ldap.UncategorizedLdapException: Unable to find the groupname of the principal.
at com.atlassian.crowd.directory.SpringLDAPConnector.searchEntitiesWithRequestControls(SpringLDAPConnector.java:416)
診断
This problem should only occur when you are attempting to connect to OpenLDAP. Also, your LDAP configuration is making use of the Posix Schema:
"ldap.group.filter": "(objectclass=posixGroup)"
"ldap.group.name": "cn"
"ldap.group.objectclass": "posixGroup"
原因
First Causes:
You are configuring an LDAP type which is incompatible with the LDAP schema, e.g. you should use the OpenLDAP (Read-only Posix Schema) directory type instead of OpenLDAP.
Second Causes:
You are using Posix Schema with Group attributes in Full Distinguish Name (DN), e.g. uniqueMember: uid=test123,ou=group,dc=abc,dc=com.
ソリューション
For the First Causes:
Use the OpenLDAP (Read-only Posix Schema) directory type in Hipchat, instead of OpenLDAP.
For the Second Causes:
Use the Generic Directory Server directory type in Hipchat, instead of FedoraDS (Read-only Posix Schema).