Jira Cloud Users & Groups Provisioning: LDAP Directory Sync

 2.1 Application Configuration

• Navigate back to the Configured Application tab on the main dashboard and click the + Add New App button.
• From the Configure Application directory screen, locate and select LDAP as your chosen provider.

• In the REST API Configuration - LDAP wizard, enter the following details:

• Application Name: Enter a unique name to recognize this specific REST API configuration profile.
• Hostname: Enter the target IP address or server domain name for your directory server.
• Username: Input the primary administrative account DN or login email used to bind and execute lookups against the LDAP Directory.
• Password: Type the secure credential associated with your administrative username.
• Base DN: Specify the explicit root search path defining the organizational units and components where your active user directories reside.
• Port: Input the corresponding communication port required for your LDAP network path connection.
• Click the Next button to validate your connection parameters and proceed.

 2.2 Provisioning Options

In the Provisioning Operations section:

• User Operations: Enable Import Users to create users automatically if they do not exist in Jira. From the Deactivated User Action dropdown menu, select the action that should be taken when a user is unassigned or deactivated in your directory. In Custom Profile Attributes, choose and map granular schemas from your LDAP source directory during inbound cycles.

• Group Operations: Switch to Group Operations and enable Import Groups.
• Group operations can be performed either with On-the-Fly Group Mapping or Manual Group Mapping.
1. On-the-Fly Group Mapping: Select this tab to create groups dynamically as they are from the IdP to Jira Cloud if they do not exist in Jira and map the users accordingly.
   You can enable the Apply Regular Expressions on Group Names option to transform group names using Regex patterns before mapping them to Jira groups.
   Under Filter Incoming Groups, you can configure how you want to filter group names received from the provider.
2. Manual Group Mapping: To map groups from your IdP to Jira’s native groups, select this tab. When the sync executes, the users from respective groups of the IdP will be mapped to Jira groups as per configuration.


Keep Existing Groups

This setting controls how a user's Jira group memberships are managed during user provisioning and deprovisioning operations performed by the Identity Provider (IdP).



Enabled

For any new user added to IdP groups, it will be added to Jira groups. But if users are removed from IdP groups, Jira group memberships are preserved in the Jira directory.




Example:

• Current Jira groups: jira-software-users, jira-administrators
• Groups received from IdP: developers, employees
• Resulting Jira groups: jira-software-users, jira-administrators, developers, employees

No existing Jira group memberships are removed.




Disabled

During provisioning, deprovisioning, or user unassignment, all existing Jira group memberships are removed except those specified in the Exclude Groups list. During provisioning, the user is subsequently assigned only to the groups received from the Identity Provider (IdP).




Example:

• Current Jira groups: jira-software-users, jira-administrators, support-team
• Groups received from IdP: developers, employees
• Excluded groups: jira-administrators
• Resulting Jira groups after provisioning: jira-administrators, developers, employees

After provisioning, the groups jira-software-users and support-team are removed because they are not received from the IdP and are not included in the exclusion list.




Exclude Groups: Use the Exclude Groups option to specify Jira groups that should never be removed during provisioning or deprovisioning operations, such as jira-administrators or org-admins. These groups will always be retained regardless of the user's group assignments in the IdP.



• Scheduler Option: To sync the data dynamically on defined intervals, you can toggle Automate Synchronization to ON. Input your target processing interval frequency inside the Synchronization Cycle (Days) text field.

• Click Next to review your configuration.

 2.3 Review & Submit

• Once satisfied with the setup overview, click the Save Configuration button in the bottom-right corner to save your integration profile.