LDAP-Server removal and Personal Access Tokens

Last modified by DevOps-as-a-Service Operator on 2025/02/05 11:33

The LDAP-Server being part of the Identity and Access Management turned out to be unfortunately unstable for instances with 2000 users and more. LDAP is an old protocol anyway, and OpenID Connect is the better solution. Still, a lot of work had to be done to do completely without an LDAP-Server. Now we are migrating Jira, Confluence, and Bitbucket from LDAP backed user directories to local user directories which are managed by the DevOps Portal like it was always done for technical users. The SSO (single-sign-on) will not change, as it is already based on OpenID Connect provided by Keycloak.

As a consequence, we have to drop support for using user passwords to authenticate to APIs of Jira, Confluence, and Bitbucket. This especially also includes using git over HTTPS.

In the future, it will be required to use Personal Access Tokens instead of passwords. This will also increase the security of your account. Therefore, we advise you to start immediately using Personal Access Token where necessary.

Nothing will change for accessing the web user interfaces of these tools. Here you can simply stick to the established SSO (single-sign-on) which asks for your username and password for new sessions.

Warning

If you are using git over HTTPS to access Git repositories, then you need to create an HTTP access token on Bitbucket and use this token instead of your password inside your git client.

Technical users for Jira, Confluence, or Bitbucket which have been created using the DevOps Portal are not affected. They are especially designed for API access only and will continue to work as before.