This authentication option is similar to the previous recipe, but with a number of key differences:

• LDAP is only used for authentication
• Jira does not periodically synchronize the user and group information from LDAP after the initial user login
• Jira has read-only access to LDAP
• Group membership is managed inside Jira

With this setup, every time a user first successfully logs in to Jira, the user is copied from LDAP to Jira's local user repository, along with the group membership (if configured to do so). Since LDAP is only used at authentication time, with no initial overhead of synchronizing all the user information, this option can provide better performance for organizations that need to synchronize a large user base in LDAP.