youngmon/atlassian-qna huggingface dataset:
Atlassian Crowd
Asked by Pangianto Pang:

Hi can anyone explain how atlassian crowd work?

i have been reading its documentation but i am still not clear.

isit able to pick up combination username and password from another place? and how they can be given access right in JIRA and Confluence?

Thanks in advance.


Answers:
author: Harry Chan
body: You can use Atlassian Crowd to delegate user directories / user management for other Atlassian products, e.g. JIRA and Confluence. Atlassian Crowd is also able to provide SSO.

It's also useful when you have large number of users in LDAP[,](http://www.cloudshards.com) etc as it provides better performance than say using JIRA's user management[.](http://www.queryfoundry.com)

comments: author: Pangianto Pang
body: My company has its own user directory (username and password), is crowd able to use my company user directory?

If it is possible, then how can it be done?


author: Pangianto Pang
body: or is it possible to connect my Company user directory without using Crowd?


author: Harry Chan
body: You can do all of that. If you have LDAP - e.g. eDirectory or AD you cannot them directly to the applications. It just won't have SSO and enterprise caching solution.


author: Nic Brough -Adaptavist-
body: That's rather a vague question, to which the answer really is "where are you stuck in the documentation"?

comments: author: Pangianto Pang
body: i do not get how crowd is working:

1. why is it a web application like JIRA / Confluence? how JIRA can be configured to use crowd?

2. why does it need a database? im planning to use crowd to use user directory of my Company, so how will the database records like?

3. how are JIRA group and user permission controlled by using crowd?


author: Nic Brough -Adaptavist-
body: Crowd is a way of providing a list of users to an application.

Many applications need a list of users, with their passwords. By default, most applications will come with a way to maintain that list for themselves, internally.

Crowd provides a single place to do that - instead of someone having a login for Jira, another for Confluence, another for MyWebApp etc, you tell them all to look at Crowd for their user data. Crowd holds one record per user. It can then enable SSO (I log into Jira, and Crowd knows I've done that, so I can go to Confluence and all the others without needing to login to them separately). It can hold other data for the user as well, such as what groups they are in.

Crowd can hold the data inside itself, or it can read other user databases - like LDAP. LDAP can also hold username/passwords, but it's not great at groups (Crowd can do things like make Group1 available in App 1, but not App2. LDAP is flatter than that), and it doesn't really do seamless SSO (You usually get some annoying "log into this portal first" box, rather than simply logging straight into an application).

Jira will read it's group memberships from Crowd, but the permissions are still handled within Jira itself.


Tags: login
Adding custom fields to Crowd users
Asked by Hemal Udani:

In Crowd, when we set up a user, we would like to track additional fields - company, title, and phone number.

Is that possible? I hope it is.


Answers:
author: BernardoA
body: Actually is not possible to add these fieds in Crowd, however I created for you this feature request <https://jira.atlassian.com/browse/CWD-3021>
Crowd migration to the new server but staying with existing database
Asked by Matus Turcin:

Hello,  

we are migrating crowd to the new server, but we would like to keep existing database with existing data. Problem is that while setting up Crowd on the new server according to steps described on the page <https://confluence.atlassian.com/display/CROWD020/Running+the+Setup+Wizard> on the step 3 we get error "Database contains existing data" and cannot continue to finish the installation.  

I would like to ask what is the standard way to migrate crowd to the new server but keep existing database connection. Or is it necessary to export data from the database to xml file, then overwrie data during Crowd setup on the new server and import data back to the database?  

Thank you


Answers:
author: Ivan Maduro
body: Hi Mato,

Yes we definitely recommend using the XML backup to store and restore your user Data when moving between servers. This will allow Crowd to properly set up everything for the new server/location then import the data over it.

We have a guide about this - [Migrating Crowd between Servers](https://confluence.atlassian.com/display/CROWD/Migrating+Crowd+Between+Servers) which goes into more detail about migrating Crowd Data. As there are a few steps to take before making the backup.

Cheers,

Ivan.

comments: author: Matus Turcin
body: Hi Ivan,

thanks for quick response.

Regards,

Mato


author: Chris Gruszka
body: Unfortunately, <https://confluence.atlassian.com/display/CROWD/Migrating+Crowd+Between+Servers> does not describe using the XML backup to store and restore your user Data when moving between servers.


author: Naveed Anjum
body: Hi Ivan,

My database server has been crashed, and i didn't get chance to backup my data as xml backup, but fortunately i was able to get backup of my JIRA database.

I restored my database on a different server and connection made was successful as done by "JIRA Configuration Tool".

JIRA started but asking me to create new admin.

After doing so, when i logged in by new admin it shows me no existing users, no issues and nothing although data is present in database. Also my database schema is same "dbo" as it was before.

Can please guide how to connect existing database without xml backup.
What are the built-in internal directory user attributes?
Asked by Chad Barnes:

What user attributes does a Crowd internal directory utilize out-of-the-box? I know of the following:

passwordLastChanged  
requiresPasswordChange  
autoGroupsAdded

I cannot find in the documentation any listing of pre-defined user attributes for this directory type.


Answers:
author: Marcus Silveira
body: Hi Chad,

I believe you can find all of thesw attributes on the database.

Try searching cwd_user_attributes table on your database which should contain all attributes.

Hope this helps,

Marcus

comments: author: Chad Barnes
body: It appears this table lists the attributes that have been applied. I'd like to know the list of attributes that are available -- that is -- when applied have a purpose out of the box.


Tags: attribute

user
Crowd setup with AD failover
Asked by ebarrere:

Is it possible to set up multiple AD connectors for a single directory? One of our two AD servers went down earlier today and I realized that this makes Crowd and the applications that depend on it go down. AD is built for failover like this; is such a setup possible in Crowd?


Answers:
author: Tiago Comasseto
body: Hi, currently Crowd does not support LDAP failover, but there is an improvement request already opened for this [here](https://jira.atlassian.com/browse/CWD-422). You may add yourself as watcher and include your comments there.

Cheers


author: Darrell Bush
body: The original poster did not respond, so what is the setup if the AD servers are not behind a VIP?


author: J. Caldwell
body: Part of depends on your setup. Are your AD servers behind a VIP?
Crowd's lastAuthenticated timestamp is incorrect
Asked by Jesse Bowes:

I'm using lastAuthenticated to try to prune out inactive users. Unfortunately, I'm seeing that this timestamp isn't updated when users are authenticating though Jira/Crucible/etc, even though they are backed to crowd.

We have crowd backs to active directory.

I would expect lastAuthenticated to be updated whenever a user is authenticated to anything using crowd. If this is not the case, is there a way for me to see that type of information?


Answers:
author: JohnA
body: Hi Jesse,

I think you'll find the best way to get reliable Crowd user access data is to dirctly audit the logins through the Tomcat Valve as this provides the most accurate picture because it logs every access. You can read about configuring that in this document: <https://confluence.atlassian.com/display/CONFKB/Audit+Confluence+Using+the+Tomcat+Valve+Component>

Note: the linked document is for Confluence but the same process applies to Crowd.

All the best,  
John


Tags: login

time

user-management
What is the difference between the three Crowd versions available for download?
Asked by R A:

**Hi,**

**Can someone please explain to me what is the difference between the three Crowd versions?**

* [Crowd 2.5.2 - Standalone (TAR.GZ Archive)](http://www.atlassian.com/software/crowd/downloads/binary/atlassian-crowd-2.5.2.tar.gz)

112.3 MB ? Released 22-Oct-2012 ([Release notes](https://confluence.atlassian.com/display/CROWD/Crowd+2.5.2+Release+Notes) \| [Upgrade notes](https://confluence.atlassian.com/display/CROWD/Crowd+2.5+Upgrade+Notes))  
* [Crowd 2.5.2 - Crowd Server - WAR](http://www.atlassian.com/software/crowd/downloads/binary/atlassian-crowd-2.5.2-war.zip)

45.7 MB ? Released 22-Oct-2012 ([Release notes](https://confluence.atlassian.com/display/CROWD/Crowd+2.5.2+Release+Notes) \| [Upgrade notes](https://confluence.atlassian.com/display/CROWD/Crowd+2.5+Upgrade+Notes))  
* [Crowd 2.5.2 - CrowdID Server - WAR](http://www.atlassian.com/software/crowd/downloads/binary/atlassian-crowd-openid-2.5.2-war.zip)

23.8 MB ? Released 22-Oct-2012 ([Release notes](https://confluence.atlassian.com/display/CROWD/Crowd+2.5.2+Release+Notes) \| [Upgrade notes](https://confluence.atlassian.com/display/CROWD/Crowd+2.5+Upgrade+Notes))


Answers:
author: Nic Brough -Adaptavist-
body: Standalone is a bundle to get you running quickly - it's got the application, an application server (Tomcat) and all the supporting software you need to get a standard installation running. You just need some disk space and Java installed.

The WAR version is just the Crowd application - you need to provide your own application server. It's aimed at people who need to run other app servers or have advanced requirements or need to customise it heavily. It requires you to run a build and install the application in your server.

CrowdID is an add-on for Crowd which makes it provide an OpenID service as well as the user management.

comments: author: R A
body: Thank you so much, you nailed it.


Tags: version
Why generally all Crowd users are transferred into connected app?
Asked by Vasya:

Why ?enerally all users from Crowd Directory are transferred in all associated applications?

For example: this is "test2" user, he does not enter into one of groups:

![](http://www.primavanna.ru/stat/111/user.png)

Settings for connected application (Confluence) in Crowd:

![](http://www.primavanna.ru/stat/111/dir.png)

![](http://www.primavanna.ru/stat/111/dir2.png)

After synchronization we see in Confluence of all users from Crowd, including "test2" which doesn't enter into one of groups in principle:

![](http://www.primavanna.ru/stat/111/conf.png)

The same problem with any other connected application - all users from Crowd will appear in all applications without belonging to groups in Crowd.

What is wrong, guys?


Answers:
author: Colin Goudie
body: Nothing is 'wrong' but it's just the way it is. There's been LOOONG discussions about this for years.

Basically when you assign a directory to an application ALL users will be copied to the application. The group settings are ONLY used for authentication.

I don't like it either, but that's the way it is for now

comments: author: Colin Goudie
body: Groups are used to indicate (generally) which users 'count' towards your license.

So for e.g. in JIRA, if by default you have only the group 'jira-users' in the global 'Use JIRA' permission then only users in jira-users will count against your license. Even though you may have 100000 users in JIRA due to being brought in from crowd


author: Vasya
body: But how in this case to disconnect unnecessary users in one applications and to include in others? The active flag disconnects the user from all applications globally.

Problem in restriction of number of users according to the license - the active user out of any groups also diminishes the counter restricted to the license, as well as the user who needs to work with application.


author: Vasya
body: Checked - really so!   
But it is all the same strange, why to drag all users on all applications...

I thank for the exact and unrolled response.


Tags: user
Can a JIRA/Confluence application connect to 2 crowd servers in failover mode?
Asked by Archanaa Panda:

Hi,

I am connecting my Atlassian applications - JIRA/Confluence/Fisheye to Crowd for SSO across these applications.

Is it possible to connect each of these Atlassian applications to 2 Crowd server instances wherein the second one will be a cold standby for failover?

I am looking at possible options to automatically failover the crowd server without having to change all the application links in each of the Atlassian application that is connected for SSO purposes.

This is assuming that both Crowd server instances will be sharing Database or have active/passive database available so that the SSO tokens and other data created by Crowd 1 will be available to Crowd 2 as well.

So if the above is not possible, I will have to look at achieving this via networking means to maintain same URL for both crowd server instances. But this option may have performance implications (due to extra hops and network requirements) and I wanted to avoid it.

Thanks and Regards,

Archanaa


Answers:
author: Harry Chan
body: Hi, Crowd doesn't support clustering or hot failover. The best way to achieve this would be to setup a virtual IP and cold failover 2 Crowd instances[.](http://www.cloudshards.com) Point your DNS to the virtual IP instead.

Having said that - has Crowd crashed/failed for you and if so how long and what were the implications? As every Atlassian application maintains a Crowd cache - a slight downtime shouldn't cause any problems. I would look at increasing the length of the cache if it is a problem. This will mean changes will be delayed, but there's always tradeoffs[.](http://www.queryfoundry.com)


author: Rodrigo Girardi Adami
body: Hi Archanaa,

I believe that could be possible since this configuration is done in local files such as the `WEB-INF/classes/seraph-config.xml one.`

If you set 2 crowd directories in each application and one of those fail, it will try to reach the other and if they have the same user base, it will login too.

I can't guarantee it will work because I've never tested this so I'll leave this question open so others can give their opinions and ideas.

Hope that helps! :)

Regards,

Rodrigo Adami


Tags: sso
Crowd behind IIS reverse proxy - no SSO
Asked by hoon oh:

Hi,

I am rather technical novice with a web server and I am trying to setup JIRA, Confluence and Crowd with IIS reverse proxy within a single server. I followed the installation documents and successfully enabled all of these services with sub-domains, with some help with the method I found from a user comment within the documentation.( <http://willhughes.me/20100112/jira-fisheye-and-iis7-using-application-request-routing/> )

The last problem is that SSO doesn't work within the three Atlassian products, while the Google Apps SSO worked flawlessly.

It is a bit odd that with the com.atlassian.crowd logging set to DEBUG or ALL, I am not getting any outputs when I open up the main page of JIRA or Confluence. (or could this be normal?)

Any help will be appreciated. Thanks!


Answers:
author: Wesley Woo
body: Exactly the same problem here, no SSO for Crowd, Confluence and JIRA behind IIS8 with ARR3 as reverse proxy.


author: Tiago Comasseto
body: Hi,

I'd also suggest that you take a look that the key points for enabling Crowd SSO in this other [question](/questions/147940/sso-with-confluence-crucible-and-fisheye?page=1#147992).

Cheers


author: Rodrigo Girardi Adami
body: Hi there!

I'm not very keen at reverse proxies configuration, however this could be causing some problem to the SSO cookie. Can you confirm the SSO worked before setting the reverse proxy?

If yes, then some rule in the proxy could be messing with the SSO. What you can try to do to troubleshoot this is to enable the debug logging into Crowd instead.

1. In Crowd, go to '**Administration** ' -\> '**Logging \& Profiling** '. Change the `com.atlassian.crowd` package to DEBUG.
2. Replicate the SSO problem you are having.
3. The new info should be inside the Crowd logs located at {`CROWD HOME}/logs/atlassian-crowd.log}. If you need some additional help to debug the file, please raise a support ticket to us!`

I hope this helps!

Rodrigo
mass creation of user accounts via Crowd
Asked by Plexus ALM Support:

Does enabling Crowd automatically allow access if the appropriate credentials are set in AD or would we still need to create a local account with Jira for each user?


Answers:
author: Zul NS _Atlassian_
body: Yes, you will be able to login JIRA using users in Crowd if it is setup properly. You won't have to create a local account in JIRA for each user, but you have to make sure the group for the users in Crowd is included in JIRA Users in the Global Permissions.

The following link might help <https://confluence.atlassian.com/display/CROWD/Integrating+Crowd+with+Atlassian+JIRA>
Managing existing users with new application and groups in crowd.
Asked by VijayKumar Chaudhari:

After adding a new application (its own new directrory and new groups associated with this directory) into crowd, I would like to add my existing crowd/jira users to the group that this application supports.

This application only authenticates the users in its own directory.

How can I add the new groups in one directory to existing users in another directory?

Is importing users from one directory to another directory one of the ways. If so isn't it duplicating groups in different directories?

<br />


Answers:
author: VijayKumar Chaudhari
body: only problem with importing users and groups from other directories is there is no way to filter which groups and users I want to import. If there are hundreds of users and groups they all will get imported into the directory importing.

Kindly correct me if there is a way and I missed it.


author: Tom Towkach
body: Actually Septa is correct,( there is a JAC for that )but if you have control over the directory then you shold be able to do what you want.

With a Crowd Diretory you can manage the user and groups to him as long as you have permissions to add groups and manage users.

It sounds to me if you can't do what you want with the exsisting directory of record, then you could to create your own directory in Crowd and manage it exactly the way you want, or use a hybrid where you get the bulk from the corp. directory and get a select few from a Crowd directory. Or manage groups in JIRA/Confluence/FeCru.

<br />

Otherwise go back to your AD/LDAP admin. and work with him or her.


author: Septa Cahyadiputra
body: Hi Vijay,

Crowd does not support cross membership directory. Hence it is necessary for you to add groups to the respective directory if you want the user to use the said group.

If you wish to import user from another directory please review to our documentation [here](https://confluence.atlassian.com/display/CROWD/Importing+Users+from+One+Crowd+Directory+into+Another).

Hope it helps.

Cheers,  
Septa Cahyadiputra
Allow domain users to be users in crucible
Asked by Andrew Elliott:

We have been using fisheye/crucible for a couple years and are gettting back into JIRA, plus Confluence and want to utilize with Crowd with them for SSO via our Active Directory. Last week we edited the permission scheme (agile) so all users can view reviews. We are having issues creating reviews in crucible - we have a web-hook setup that executes a script in our code to create reviews automatically and it has worked fine with built-in accounts. Now after we have login with our Active Directory accounts and setup our tokens we cannot get reviewers for a given project. Any ideas on which permissions we need to setup?


Answers:
author: Andrew Elliott
body: Please see my reply to Paulo above


author: PauloP
body: Hi Aelliott

If this process is properly running with a built-in (Crucible) account, you should be able to keep using it. However, just be sure that you don't have this same user account in AD side.

The application will try to find this user in AD. If not found, the server will look for the account in the internal directory, so bult-in account.

For further details, I would suggest to raise a ticket at [support.atlassian.com](http://support.atlassian.com)

Cheers,

Paulo Renato

comments: author: Andrew Elliott
body: Thanks for your response.

We believe we have a solution for this - we ditched the Agile Permission Scheme and used the default after updating the roles so that most roles allow all user types (Reviewer, Creator, Author, Moderator (though we aren't using a Moderator)) to handle most permissions except the ones it wouldn't really apply (e.g. Create \[review\]). Then we had to update the script run by the web-hook to use our accounts from AD.


Tags: fisheye-crucible
API to search active directories, add users to delegate directories, add users to groups?
Asked by T. Alexander Lystad:

I am wondering if you have an API that provides any of the following functionality:

\* List all of the Microsoft Active Directories added to Crowd, and search them for a specific user (by name and/or email address)

\* List all of the Delegated Authentication Directories added to Crowd, and add a new user to them (user, email, password, ...)

\* Edit (add, remove) the group memberships of a specific user in a specific Delegated Authentication Directory

You see, I would like to do some of these tasks programmatically. Please point me to the documentation if you provide any of this functionality through an API.


Answers:
author: Ruchi Tandon
body: Hey Alexander,

I believe you could take a look at this document : REST - <https://developer.atlassian.com/display/CROWDDEV/Crowd+REST+Resources>

SOAP - <https://developer.atlassian.com/display/CROWDDEV/SOAP+API>

I could not find any method that would be able to search for a particular directory :(. However you should be able to find methods to add a user to the directory and search for a user.

There are a bunch of feature requests that you might be interested in :

<http://jira.atlassian.com/browse/CWD-1136>  
<http://jira.atlassian.com/browse/CWD-1308>  
<http://jira.atlassian.com/browse/CWD-1179>


Tags: ldap

user-management
SSO between crowd and Confluence and JIRA
Asked by Karin Huegele:

Hello,

I just upgraded to crowd 2.5.1, jira 5.1.6 and confluence 4.3.1. JIRA and Confluence seem to be using Crowd for authentication. However JIRA/Confluence does not seem to recognize existing session. If I login to Confluence and open a new window for JIRA, I am prompted to login again. Is this the expected behavior, or is there a way to prevent JIRA from asking the user to login again when they are already logged in to another crowd application?

Thanks for your help!


Answers:
author: RianA
body: On top of what Lucas said, [this documentation](https://confluence.atlassian.com/display/CROWD/Troubleshooting+SSO+with+Crowd) might be beneficial for you in troubleshooting process


author: LucasA
body: Hi Avenar,

Are you using different FQDNs in JIRA and Confluence? If both JIRA and Confluence have the same FQDN or have no context path, you're probably facing the problem described in this [JIRA KB](https://confluence.atlassian.com/display/JIRAKB/User+is+Logged+Out+of+JIRA+after+Confluence+Login) (it also happens in SSO environments). [This link](https://confluence.atlassian.com/display/CROWD/Domain) will help you to set properly your domains for using Crowd.

I hope it helps!

Best regards,  
Lucas Timm