How to configure the user object filter to search for users that belong to a group that starts with #
Platform Notice: Data Center - This article applies to Atlassian products on the Data Center platform.
Note that this knowledge base article was created for the Data Center version of the product. Data Center knowledge base articles for non-Data Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Purpose
Restrict the user object filter inside Fisheye/Crucible to look for users that belong to groups that start with a hash/ pound (#) inside Microsoft Active Directory (e.g. #fisheye-users, #crucible-users and etc):
Searching for the group attributes inside Microsoft Active Directory we can see the hash/ pound is escaped with a backslash (\) inside the Distinguished Name attribute.
Solution
It's necessary to escape the hash/ pound twice in the User Object Filter field under the User Schema Settings inside the LDAP User Directory configuration in Fisheye/Crucible. Here's an example:
If I want to restrict the search and look for users that belong to the #fecru-users group only (among other attributes) the following search filter needs to be used:
(&(sAMAccountName=*)(objectCategory=Person)(|(memberOf=CN=\\#fecru-users,OU=Groups,DC=CSSATLASSIAN,DC=internal)))
- If I try escaping the hash/ pound once (i.e. \#fecru-users) OR not escape it all (i.e. #fecru-users) the search does NOT work. Fisheye/Crucible will not find and sync the users that belong to the #fecru-users group.