youngmon/atlassian-qna huggingface dataset:
After i switch to SSL,Why can't i login in to Crowd console as admin? ops!!!!
Asked by tom shi:

crowd version: 2.12.0

<https://confluence.atlassian.com/display/CROWD028/Configuring+Crowd+to+Work+with+SSL>

cfg the crow to work with SSL(According to the above link)

bug it alway pop-up 'Connection to authentication server failed. Please review the logs for more information.'

I'm going crazy


Answers:
author: Edwin Kyalangalilwa
body: Check the crowd.properties file and make sure everything is correct

<https://confluence.atlassian.com/crowdkb/how-to-change-the-crowd-base-url-245827278.html>

And check the logs, you might see an IP that isn't allowed to authenticate with your Crowd application. If so, simply add the IP to the **remote addresses** tab in the Crowd application.


author: lpater
body: Hi Tom,

Are you trying to used a self-signed certificate, or one issued by a Certificate Authority (CA)?

Are there any errors logged in Crowd logs about this? Make sure you have updated the crowd.properties file with the crowd.server.url pointing to the https:// url.

Also of note, Crowd 3.0 is now available, and it slightly simplifies the process - it reduces some internal complexity, and eliminates the need for crowd.properties entirely. You might want to give that version a go.
Crowd admin without admin console
Asked by S?nke G?decke:

Hi there,

we got a serious problem with our crowd installation. When we login with our crowd-admin we can only use the self-service module and not the admin console. I tried to look into this problem but did not found anything that I could fix by myself. The only information I got is that our crowd-admin is still in the crowd-administrators group. I checked it with the following MySQL query:

select u.id, u.user_name, u.directory_id from cwd_user u join cwd_membership m on u.id=m.child_id join cwd_group g on m.parent_id=g.id join cwd_directory d on d.id=g.directory_id where g.group_name = 'crowd-administrators' and d.directory_type='INTERNAL';


Answers:
author: S?nke G?decke
body: Well, nevermind. I fixed it by myself.

The problem was that the directory_id field in the cwd_app_dir_group_mapping table didn't match the app_dir_mapping_id field.

I figured it out by comparing the ids from

select \* from cwd_directory;

and

select \* from cwd_app_dir_group_mapping;

and

    select m.id, m.application_id, m.directory_id from cwd_app_dir_mapping m join cwd_directory d  on m.directory_id = d.id join cwd_application a  on m.application_id >= a.id   where d.directory_type='INTERNAL' and a.application_type = 'CROWD';<code></code>

I figured it mostly out by changing some of the querys from the article [restoring passwords to recover admin user rights](https://confluence.atlassian.com/crowdkb/restoring-passwords-to-recover-admin-user-rights-283642653.html)

comments: author: Marcin Kempa
body: Hi [@S?nke G?decke](/t5/user/viewprofilepage/user-id/1045361)

I am glad that you were able to solve this issue. However I am wondering how did you run into such problems? Would you mind describing it in more detail?

If you like we can discuss this outside atlassian community. Here is my email: mkempa@atlassian.com

Best Regards,

Marcin Kempa, Crowd Dev Lead
disable usage of verify-password=false
Asked by John A.:

Hi--

We would like to disable the usage of the verify-password parameter in the POST usermanagement/1/session endpoint of Crowd's restful service.

We'd like to force all authentications against our Crowd service to include the authenticated user's password.

Is this possible?


Answers:
author: lpater
body: Hi John,

The validate-password parameter of the usermanagement/1/session resource you mention is a part of Crowd's Single Sign-On protocol, and can be used by connected applications to perform user authentication without requiring the password (for example based on a remember-me cookie).

This API can only be called by an application connected to Crowd (and not normal users). Such applications are considered to be trusted, and have access to the user directories associated with them.

There is currently no way to prevent an application from using this api in Crowd itself (and it would probably affect the SSO functionality within the application). Instead you can consider disabling functionalities in the application that would use this API (like remember-me logins), to enforce authentication using a password.
migrate local group to CROWD
Asked by Andrey Ozerov:

hi

How i can did migration local group from Confluence/Jira/Crucible/Bamboo in CROWD.

I try did it in data base(SQL), but now i can find information about ID column CWD_MEMBERSHIP table - Where are it from? Where save last number? What is happend if i add rows in thise table with my numbers in ID column?


Answers:
author: Jeremy M
body: Dear Andrey,

There is a full guide on this topic here;

[Migrate Local Group Memberships Between Directories](https://confluence.atlassian.com/confkb/migrate-local-group-memberships-between-directories-289277857.html)

What database are you using? And are you using the steps provided in the above documentation?

Friendly Regards,

Jeremy Mooiman

comments: author: Andrey Ozerov
body: 1) Oracle

2) not all. Not find in CROWD - import groups, only users.


author: Andrey Ozerov
body: I try to make group csv-file, but i cant add only group.. With users only from crowd-console. I not needed to add users, only groups, because all users from LDAP


author: Andrey Ozerov
body: Thank, i can.

People not add , but grops with all users to be add.


Tags: crowd-administration
SSO is not working with JIRA and Confluence
Asked by Omara Williams:

I have setup Crowd and JIRA and Confluence according to the instructions in:

<https://confluence.atlassian.com/crowd/getting-started-with-crowd-197298051.html>

I can login to Crowd , JIRA and Confluence OK with the same user

All users are now in the Crowd Directory

However if I login to JIRA and then change to Confluence, I am presented with the Log in Page , as if SSO is not working

I was expecting that once I am logged in JIRA , when I point my browser to Confluence or Crowd, the login would happen automatically through SSO

I am not using proxies, and I have option "Require Consistent Client IP Address" disabled

Please could you give some suggestions as to why this should be the case?

Many thanks in advance

Omara


Answers:
author: AnnWorley
body: It sounds like you have the first part done, which is making sure you can log into the applications with your Crowd credentials. Did you see the documentation on working with the **seraph-config.xml** and **crowd.properties** files to enable SSO for JIRA and Confluence? In case you didn't see them, here are the instructions:

JIRA: [2.2 Configure JIRA to use Crowd's Authenticator to enable SSO (Optional)](https://confluence.atlassian.com/crowd/integrating-crowd-with-atlassian-jira-192625.html#IntegratingCrowdwithAtlassianJIRA-2.2ConfigureJIRAtouseCrowd'sAuthenticatortoenableSSO(Optional))

Confluence: [2.2 Enable SSO integration with Crowd (Optional)](https://confluence.atlassian.com/crowd/integrating-crowd-with-atlassian-confluence-198573.html#IntegratingCrowdwithAtlassianConfluence-2.2EnableSSOintegrationwithCrowd(Optional))

comments: author: Omara Williams
body: Hi Ann

Thanks for your answer

I have enabled SSO for JIRA and Confluence following the instructions suggested above

The problem is that I still have to login to each application by entering the credentials each time, so if I am looged in Crowd and point my browser to JIRA URL I have to enter the credentials again and if I then go to Confluence URL , I have to enter the credentials again.

I can see in the crowd logs that all applications are using the seraph authenticator

So what I am missing?

I look forward to your reply

Omara


author: Maheswari
body: Hi Omara

Did you fix your issue. I am facing the same problem.

please help
Does auto add user to Crowd groups only work for first time authentication?
Asked by HN:

The Crowd documentation [here](https://confluence.atlassian.com/crowd/automatically-assigning-users-to-groups-194806197.html) has instructions to confiugure the AD delegate directory so that on user login it will auto add user to groups specified.

I tried this with my account and it does not appear to work (I can't see the *jira-users* group in my list of groups).

In crowd it says "**When a user in this directory authenticates successfully for the first time**, they will be automatically added to the following groups:" but no where in the document does it say it is only for first-time logins.

Can I get some clarification on:

1. Does this only for new users who have not logged in previously?

1. Is the expectected behaviour to see a new user (never authenticated) in the {{jira-users}} group on first login?

2. If this only works for users who have never authenticated before, is there an option to simulate it within Crowd?


Answers:
author: AnnWorley
body: I am happy to provide clarification where I can.

1- The sentence "When a user in this directory authenticates successfully for the first time, they can be automatically added as members of existing groups." is supposed to convey that it only applies for users who have never logged in before. The reason it's like that is to give admins the ability to take a user out of one of the groups and not worry about them being re-added on next login.

2- A user who has never logged in before should be added to the groups you set under Options\>Default Group memberships

3- I am not 100% sure what you mean by simulating the default group memberships. You can definitely add the users manually to the groups. Do you have a need to bulk add quite a few users to particular groups?


Tags: active-directory

crowd-administration

group

login
Added too many users for current licence, how can i remove some to get back under limit
Asked by PGWWebMaster:

Managed to manually add too many users for the current licence.

Now I am unable to access crowd to disable the extra profiles.

How can i remove the new users?


Answers:
author: AnnWorley
body: You may apply an evaluation license without logging in. Here are some articles that can help with the predicament:

[How to log into Crowd when the number of users for the license has been exceeded](https://confluence.atlassian.com/crowdkb/how-to-log-into-crowd-when-the-number-of-users-for-the-license-has-been-exceeded-644416441.html)

[Users are unable to log in after updating the license](https://confluence.atlassian.com/crowdkb/users-are-unable-to-log-in-after-updating-the-license-223223576.html)

I look forward to hearing how it goes.
Atlassian crowd integration as auth provider within apache http server - not working on RHEL7/Ap 2.4
Asked by clemens.utschig-utschig@boehringer-ingelheim.com:

[https://confluence.atlassian.com/crowd/integrating-crowd-with-apache-9961902.html](https://confluence.atlassian.com/crowd/integrating-crowd-with-apache-9961902.html?)

is running on totally outdated infrastructure -\> and we could not make it work on RHEL7 / Apache 2.4

When will this be updated .. it's very critical for us.


Answers:
author: AnnWorley
body: Sorry for the slow response - please see this guide:

[Proxying Atlassian server applications with Apache HTTP Server (mod_proxy_http)](https://confluence.atlassian.com/kb/proxying-atlassian-server-applications-with-apache-http-server-mod_proxy_http-806032611.html)

The link in your question is broken so I think the doc I linked is the updated replacement.


Tags: apache
Change Crowd Password Reset Token Expiration period
Asked by Ming Ho:

The default is 24hr. how can i change it to a custom value?


Answers:
author: Marcin Kempa
body: Hi [@Ming Ho](/t5/user/viewprofilepage/user-id/510469)!

Unfortunately currently there is no way for changing default expiration period for password reset tokens.

There is a public facing feature request for this particular setting <https://jira.atlassian.com/browse/CWD-4703>. Please add your comment there as it would be really valuable for the Crowd team to understand your usecase and requirements.

Best Regards,

Marcin Kempa


author: Edwin Kyalangalilwa
body: Try editing or adding this in the crowd-webapp/WEB-INF/classes/crowd-ehcache.xml file and restart.

Change timeToLiveSeconds value.

![Screen Shot 2017-08-04 at 18.27.21.png](https://community.atlassian.com/t5/image/serverpage/image-id/4122i54DE5D3CB880A386/image-size/large?v=v2&px=999 "Screen Shot 2017-08-04 at 18.27.21.png")

comments: author: Marcin Kempa
body: [@Edwin Kyalangalilwa](/t5/user/viewprofilepage/user-id/255918) this cache is no longer in Crowd since version 2.8.0. That being said this won't work for newer versions of Crowd.

Regards,

Marcin Kempa


author: Edwin Kyalangalilwa
body: [@Marcin Kempa](/t5/user/viewprofilepage/user-id/671367)Thank you for the clarification.


Tags: crowd-administration
Adding users to Crowd from a AD directory
Asked by Quin Kan:

Hello,

I am new to Atlassian.

In Crowd, we have created a Directory (called it D), that is "Delegated authentication directory", and that is tied to our Microsoft Active Directory.

When I do a "Add user" to D, it shows a screen with fields for email address, user name, password ...

I thought we can just search the user, by email say, and add them to D.

With password is being a required field, does it that only the users themselve can add themselve to D, and we as admin cannot add users?

Or there is a way to add users or import users from the Microsft Active Directory without knowing the users' password?

Thank you

Q


Answers:
author: Lars Olav Velle
body: I\`ll start with a question. What are you using Crowd to? (Why are you using Crowd?)

-Lars


Tags: active-directory

user
Adding users to Crowd from a AD directory
Asked by Quin Kan:

Hello,

I am new to Atlassian.

In Crowd, we have created a Directory (called it D), that is "Delegated authentication directory", and that is tied to our Microsoft Active Directory.

When I do a "Add user" to D, it shows a screen with fields for email address, user name, password ...

I thought we can just search the user, by email say, and add them to D.

With password is being a required field, does it that only the users themselve can add themselve to D, and we as admin cannot add users?

Or there is a way to add users or import users from the Microsft Active Directory without knowing the users' password?

Thank you

Q


Answers:
author: AnnWorley
body: With a delegated directory the user is automatically added when they log in - you don't have to add them. With a connector directory the users are synchronized over in batches periodically.

Please see this [article](https://confluence.atlassian.com/confkb/the-difference-between-connector-and-delegated-ldap-user-directories-648544872.html ) - it refers to Confluence but is accurate for Crowd, too.

Please review these docs for Crowd, they should help you understand your options:

[Configuring a Delegated Authentication Directory](https://confluence.atlassian.com/crowd/configuring-a-delegated-authentication-directory-128287004.html)

[Configuring an LDAP Directory Connector](https://confluence.atlassian.com/crowd/configuring-an-ldap-directory-connector-18579550.html)

Please let me know any follow up questions.

comments: author: Quin Kan
body: Thank you Ann!

I read up on the articles you provided, and found they contain very useful information to help us learning more of the Atlassian tools!
Get user email using REST API
Asked by Andrej Gavrilov:

Hi All,

I am building a webform and have auto authentication using CROWD once authenticated I need to get that users email. Can someone point me towards the right direction on how would I go getting users email.

Thank you.


Answers:
author: Mallmann
body: Hi, Andrej.

You should be able to retrieve the user details by running a get call against this URL:

```
http://YOUR-CROWD-SERVER:8095/crowd/rest/usermanagement/1/user?username=USERNAME
```

To authenticate the call you need to use the Crowd application name and its password, not your user's credentials.

Depending on the version of Crowd you're using, you can retrieve this info from the \<crowd-home\>/crowd.properties file:
> application.name
>
> application.password

Note that this will not retrieve only the e-mail address, but you should be able to parse the results (even with a grep in a Unix terminal) and filter only the email address. :)  

I hope it helps, let me know if you have any questions.

- Mallmann


Tags: crowd-development

developer

rest
What is the right way to create the Crowd SSO cookie in custom .Net application
Asked by Rizwan Basha:

I am trying to create a Crowd client for a custom .Net application. And from other questions on this forum I understand that I need to create a cookie for the token returned by SSO Authentication Crowd REST API. And that I need to submit ValidationFactors with these 2 specific items: "remote_address" and "X-Forwarded-For". I found this information in this post: <https://community.atlassian.com/t5/Answers-Developer-Questions/SSO-Between-Confluence-and-Custom-Web-Application/qaq-p/509239>.

My code creates the SSO cookie accordingly. However, JIRA and Confluence do not recognize the cookie created by my custom .net application; but they recognize each other's cookies. So after logging in on the custom application, I would have to again login to JIRA.

Has anyone accomplished this in the recent versions of Crowd? Any ideas please?

Thanks,  
Rizwan Basha


Answers:
author: Jackson Ong
body: HI, I have a similar issue.

My application : SSL and authenticates to crowd. (No problem)

Confluence : uses actual port 8090, but uses url rewrite to run on SSL.

So, in actual fact both application are on SSL, only that confluence uses ARR or url rewrite. When I access via ++**https**++ to confluence , it does not work, but if access ++**via port 8090**++ , it works. e.g <https://knowledge.example,com> will not work, <http://knowledge.example.com:8090> will work. After accessing via 8090, <https://knowledge.example.com> will log on.

I have few other issue before maybe you should check following as well:

1. If your custom application is on a load balancer, you will use X-forward-for to get client ip, if you have no load balancer, you will only use remote_addr.

2. The other thing, you can try direct access via the confluence port 8090, instead of through a url rewrite.

I am still trying to figure out why url rewrite does not work.


Tags: .net

rest-api
How can I change the notification on "An Issue is Created" email to be that of the reporter?
Asked by Peter Gagne:

Notifications from newly created Customer Portal Requests are being received by our agents as **FROM: jira@\<domain-name\>.atlassian.net** How can I change this to have the Sender be the Reporter?


Answers:
author: Franti?ek ?pa?ek _MoroSystems_
body: Hi,

sadly this is not possible, mainly due to the ability of Jira process replies to notifications, which are added as comments to issues notifications are coming from.

If you want to reply to the sender, just reply to the incoming notification - your reply will be automatically added to the system as a comment and customer will get his notification for your comment too. This can easily mimick sending emails between all parties participating on the request, while at the same time keeping whole history directly in the ticket (and thus easily searchable etc.).


author: Adolfo Casari
body: [@Peter Gagne](/t5/user/viewprofilepage/user-id/4876592)JSM has queues that your agents can use to see and organize incomming requests.


author: ?ukasz Modzelewski _TTPSC_
body: > "You can configure the sender email address for a Jira Cloud project. This will also serve as the reply address for responses to notifications, which can work in conjunction with [Creating issues and comments from email](https://confluence.atlassian.com/adminjiracloud/creating-issues-and-comments-from-email-779288896.html).
>
> When you set the *sender address* for a project, all notifications are sent from this address. This setting is specific to the project and won't affect the configuration of other projects."

Source: <https://support.atlassian.com/jira-cloud-administration/docs/configure-email-notifications/>

Based on that, it's not dynamic and would affect replies also breaking some functionalities


Tags: cloud

jira-cloud

jira-service-management

jira-service-management-cloud
Workflow Step Properties are not working for me am I doing something wrong?
Asked by mrollf:

I have a UAT Workflow step with properties that look as such. ![image.png](https://community.atlassian.com/t5/image/serverpage/image-id/341720i1B4BAD332836606C/image-size/large?v=v2&px=999 "image.png")  

The Idea is to block any editing of the issue while in UAT Status unless you are a member of the project roll 10244.   

My issue is that Anyone can go in and edit any and all of the fields while this is in the UAT Step still. Am I doing something wrong?


Answers:
author: Franti?ek ?pa?ek _MoroSystems_
body: Hi [@mrollf](/t5/user/viewprofilepage/user-id/5407950)

I think you are tripling the same thing here. The last one should be enough to have to do what you desire.

I have just tested in one of my workflows - I have added only "jira.permission.edit.projectrole" with value "10004" which is my ID for project role "Developers", removed myself from this role and I was not able to edit the issue in that status.

Also remember to publish the workflow with properties you have entered, its one of the common mistakes to not publish the workflow after you do the change. It happens to me from time to time too.. :-)

Have a nice day!

comments: author: mrollf
body: I was not publishing It Thank you so much! I guess I thought It would just work because it took me to another screen and didn't ask me to save. I see my mistake and publishing the draft fixed it thank you!


Tags: cloud

jira-service-management

jira-service-management-cloud

jira-software

workflow