LDAP groups synchronization with OpenLDAP

Symptoms

1. LDAP groups synchronization is enabled.
2. Example ldap-config.properties contents: java.naming.provider.url=ldap://<...>:389/dc=<...>,dc=local java.naming.security.principal=cn=<...>,ou=People,dc=<...>,dc=local java.naming.security.credentials=<...> teamcity.users.base=ou=People teamcity.users.login.filter=(&(objectClass=posixAccount)(!(businessCategory=disabled))(uid=$capturedLogin$)) teamcity.users.username=uid teamcity.options.users.synchronize=true teamcity.users.filter=(&(objectClass=posixAccount)(!(businessCategory=disabled))) teamcity.options.groups.synchronize=true teamcity.groups.base=ou=Groups teamcity.groups.filter=(objectClass=posixGroup) teamcity.options.createUsers=true teamcity.options.deleteUsers=true teamcity.options.syncTimeout=60000 teamcity.groups.property.member=memberUid teamcity.property.distinguishedName=dn teamcity.users.property.memberId=uid teamcity.users.property.displayName=cn teamcity.users.property.email=mail teamcity.groups.fetchOnlyMappedGroups=true
3. teamcity.groups.fetchOnlyMappedGroups=true is used in the ldap-config.properties file to sync only selected groups.
4. Example mapping in the ldap-mapping.xml file: <group-mapping teamcityGroupKey="TEST" ldapGroupDn="cn=grp_teamcity_test,ou=Groups,dc=<...>,dc=local"/>
5. The groups synchronization doesn't work. The TeamCity groups are not synchronizing with the LDAP server.
6. teamcity-ldap.log includes the messages like: Found 0 search results for search base='ou=Groups', filter='(&(objectClass=posixGroup)(dn=CN=grp_teamcity_test,OU=Groups,DC=<...>,DC=local))', scope=2, attributes=[uid, mail, memberUid, dn, cn] Could not find LDAP entry by DN 'CN=grp_teamcity_test,OU=Groups,DC=<...>,DC=local' during fetching mapped groups from LDAP, ignoring

Cause

When TeamCity runs LDAP groups synchronization with teamcity.groups.fetchOnlyMappedGroups=true, it looks up the mapped groups via the DN.

OpenLDAP doesn't support such lookups. Related issue: Do not require LDAP entry to contain attribute(distiguishedName) with DN when fetchOnlyMappedGroups is used (openLDAP case).

Resolution

1. Set teamcity.groups.fetchOnlyMappedGroups=false.
2. To sync only the selected groups, do one of the following:
   • On OpenLDAP's side, place the groups that need to be synchronized inside another group. Use this group as teamcity.groups.base .
   • Use teamcity.groups.filter to filter out the groups that need to be synchronized.

The above will synchronize filtered-out groups.

However, the group membership synchronization still may not work correctly, as described in LDAP group membership synchronization with OpenLDAP.

Additional information

A working example of ldap-config.properties file to synchronize TeamCity users and groups with OpenLDAP is available in Configuring TeamCity to synchronize users and groups with OpenLDAP.