Bitbucket enterprise way - LDAP

Bitbucket is tool of choice in many large companies. One reason for that is it has nice integration with other part of ecosystem like Jira - most often.

By definition it’s ‘just another git server’. It has server side git and UI. Basic choice here to be taken is: SaaS (hosted within https://bitbucket.org) or Self-Hosted. With self-hosted comes following: “Single server or “data center” version?”

“Data Center” is suited for international organizations which would get profit from Mirrors.

Domain integration

In a larger company, Bitbucket is connected to the domain. The domain authenticates users, both for general access and for specific projects.

How to setup LDAP read?

Main page to answer that question would be: Connecting Bitbucket Server to an existing LDAP directory

Here beside creating read connection with LDAP would be to setup filter which will prevent user and group flood. By that I mean:

• Each Bitbucket user takes a license, so control who gets access. Not everyone in the company needs Bitbucket.

• Groups like distribution lists most often are not needed to be indexed by Bitbucket.

An open configuration loads Bitbucket without a good reason. Filter users and groups from the start.

Details

General configuration

From general useful options are:

• Nested Groups
• Filter out expired users
• Enable incremental synchronization

User settings

Important part here is: User Object Filter

(&(objectCategory=Person)(sAMAccountName=*)(|(memberOf:1.2.840.113556.1.4.1941:=CN=Bitbucket_Users_Login,OU=Groups,OU=Global,DC=domain,DC=com)))

Above filter out all users which are member of given group - in that case Bitbucket_Users_Login.

Group settings

Group Object Filter:

(&(objectCategory=Group)(extensionAttribute1=syncWithTool=*Bitbucket*))

Above will fetch all groups with attribute: ‘extensionAttribute1’ set to Bitbucket. Simple way to sync only those groups which were nominated to be used within Bitbucket.