LDAP group membership synchronization with OpenLDAP

Symptoms

1. The TeamCity groups synchronization with OpenLDAP was set up following the instructions from LDAP groups synchronization with OpenLDAP article.
2. Example ldap-config.properties contents: java.naming.provider.url=ldap://<...>:389/dc=<...>,dc=local java.naming.security.principal=cn=<...>,ou=People,dc=<...>,dc=local java.naming.security.credentials=<...> teamcity.users.base=ou=People teamcity.users.login.filter=(&(objectClass=posixAccount)(!(businessCategory=disabled))(uid=$capturedLogin$)) teamcity.users.username=uid teamcity.options.users.synchronize=true teamcity.users.filter=(&(objectClass=posixAccount)(!(businessCategory=disabled))) teamcity.options.groups.synchronize=true teamcity.groups.base=ou=Groups teamcity.groups.filter=(CN=grp_teamcity_test) teamcity.options.createUsers=true teamcity.options.deleteUsers=true teamcity.options.syncTimeout=60000 teamcity.groups.property.member=memberUid teamcity.property.distinguishedName=dn teamcity.users.property.memberId=uid teamcity.users.property.displayName=cn teamcity.users.property.email=mail teamcity.groups.fetchOnlyMappedGroups=false
3. Example mapping in the ldap-mapping.xml file: <group-mapping teamcityGroupKey="TEST" ldapGroupDn="cn=grp_teamcity_test,ou=Groups,dc=<...>,dc=local"/>
4. The groups (in this example, only one grp_teamcity_test group) are synchronized correctly.
5. But the group members are not getting synchronized. From the logs: Skipped 1 unknown member during membership synchronization of the remote group '{remoteId='cn=grp_teamcity_test,ou=Groups,dc=<...>,dc=local', groupKey='TEST', members=1}' as it is not present in the full list of users or groups. Ignored members: 'testuser'

Cause

It is caused by differences in how TeamCity maps users and available OpenLDAP attributes.

Related issue: Group membership synchronization with OpenLDAP.

Resolution

Change the teamcity.property.distinguishedName=dn to teamcity.property.distinguishedName=uid in the ldap-config.properties file.

Additional information

An example of a working configuration can be found in Configuring TeamCity to synchronize users and groups with OpenLDAP.