youngmon/atlassian-qna huggingface dataset:
How to use a client token to authenticate on crowd server
Asked by theo:

Hello,

Actually, I have a web service which is requested by my website, and I would like to use this web service to request an other web service which need crowd authentication.

The clients have a crowd token given by an other website which authenticate them on the crowd server and i would like to use this token on my web service to authenticate them on the crowd server. And by this way the web service can do request by their access and their name.

But it work if I use the session.post to create a token with their user password, but if i copy past or get the token from the authentication website it didn't work.

It's close from this organization: ![](https://confluence.atlassian.com/crowd/files/179445277/240584407/10/1347923201901/SSO+Happy+Path.png)

I'm sorry if it isn't very well explained, don't hesitate to ask me if you have any question.

Thanks in advance.


Answers:
author: Bruno Vincent
body: Hi [@theo](/t5/user/viewprofilepage/user-id/3271860)

Let's sum up what you have here:

```
User's Browser -> Web application -> Web Service A -> Web Service B
```

What you are facing here is what is detailed in the 'Cause' section of [this KB](https://confluence.atlassian.com/crowdkb/crowd-sso-not-working-when-using-more-than-one-proxy-826868834.html).

From Web Service B's perspective, requests come from Web Service A's IP address, whereas the Crowd token that was initially generated was tied to your user's IP address.

You have two options here:

* Option #1: uncheck 'Require Consistent Client IP Address' in Crowd's console as detailed [here](https://confluence.atlassian.com/crowd/session-configuration-17956967.html)
* Option #2: add the IP addresses of Web application and Web Service A to the list of trusted proxy servers in Crowd's console and make sure to add the user's IP address, Web Application's IP address and Web Service A's IP address (in that order) to the X-Forwarded-For header as detailed [here](https://confluence.atlassian.com/crowd/configuring-trusted-proxy-servers-158107219.html)
User authentication by REST with php
Asked by emile bergin:

I have created a website that has been added to atlassian / crowd and I would like my users to be authenticated by REST a crowd. I can not find a simple method.

Can you help me ?


Answers:
author: Bruno Vincent
body: Hi [@emile bergin](/t5/user/viewprofilepage/user-id/3258912)

Please take a look at Crowd's REST API documentation:

* <https://docs.atlassian.com/atlassian-crowd/3.4.0/REST/#usermanagement/1/authentication>
* <https://docs.atlassian.com/atlassian-crowd/3.4.0/REST/#usermanagement/1/session-authenticateUser>


Tags: authentication
Groups affecting discrete Confluence or Jira permissions
Asked by Jim Weaver:

The Crowd documentation seems to be unclear on this point. It states that groups can be created and managed in Crowd, and these groups can be used to allow access to individual applications such as Jira and Confluence.

What about cases where you have fine-grained permissions to deal with by group rather than just "access"? If I want a team, let's say "team1," to have access to certain spaces in Confluence, or ability to act as a developer on a particular set of projects in Jira, is it possible to manage this in a Crowd-driven way?

If I create a group entirely in Crowd, assign users to it, and they login to Confluence or Jira, are those groups visible to Confluence and JIra to use for permissions / authorization rather than just authentication?

If a group exists in Crowd, when on the SPace permissions page in Confluence, is that group visible to grant permissions to in a non-user-specific way? In other words, would I be able to add "team1" as a permissions row for a space and tick permission check-boxes for that group?

My guess is - not possible - otherwise it seems like this capability would be very much featured in the Crowd docs.


Answers:
author: Bruno Vincent
body: Hi [@Jim Weaver](/t5/user/viewprofilepage/user-id/1156939)

Crowd currently provides centralized user and group management, not centralized permissions management.

That means that any user or group you see and manage in Crowd will be synchronized to the corresponding connected applications (e.g Jira, Confluence) but apart from the right to login you still have to manage what you call 'fine-grained permissions' in the applications themselves.

That being said, Atlassian [announced](https://community.atlassian.com/t5/Crowd-articles/Looking-back-on-2018-Crowd-highlights/ba-p/981685) that "surfacing cross-product information such as license usage or permissions directly in Crowd" is on their radar.

comments: author: Jim Weaver
body: Heya Bruno - thanks!

From your description - I think that's what I'm looking for.

If a group created in Crowd is visible as a group on permissions screens in Confluence and Jira, then you can use Crowd groups rather than Jira-visible-only or Confluence-visible-only groups to assign permissions in those respective applications - removing the need to repeatedly create and define membership of the "team1" group, for example, in Jira, Confluence, Bamboo, etc.

If you use a lot of Atlassian apps, having to maintain groups and group membership in and of itself becomes a chore - so a key benefit of Crowd may just be reducing that overhead.

j
crowd admin
Asked by atsflex:

What is the admin login for Crowd latest version 3.4? I tried admin/admin, but I wasn't successful. Is there something I am missing? Thanks in advance!


Answers:
author: Stephen Hodgson
body: The first admin username and password is specified by you during the setup wizard (see [https://confluence.atlassian.com/crowd/running-the-setup-wizard-192479.html#RunningtheSetupWizard-Step8.DefaultAdministrator)](https://confluence.atlassian.com/crowd/running-the-setup-wizard-192479.html#RunningtheSetupWizard-Step8.DefaultAdministrator)

If you know the username or email address you used for that user, you could recover the account by using the "Forgot your password?" link. Otherwise, you'll either have to uninstall/reinstall or follow Atlassian's password recovery doc: <https://confluence.atlassian.com/crowdkb/restoring-passwords-to-recover-admin-user-rights-283642653.html>
How to integrate crowd with Active Directory.
Asked by Sarika Shingate:

How to integrate crowd with Active Directory.


Answers:
author: Bruno Vincent
body: Hi [@Sarika Shingate](/t5/user/viewprofilepage/user-id/2538631)

Please read the Microsoft Active Directory section on this page: <https://confluence.atlassian.com/crowd/configuring-an-ldap-directory-connector-18579550.html>
How to Integrate Crowd SSO 2.0 With GitLab
Asked by coderfox:

GitLab accepts standard SAML SSO, but Crowd SSO 2.0 does not provide emailAddress or UID to the SAML response. I have read that providing SAML attribute requires IdP (Crowd) configuration.

I wonder if I can do any configuration to set Crowd SSO 2.0 return the emailAddress attribute to SAML SP. Thanks for your possible help.


Answers:
author: mfominov
body: [Related issue](https://jira.atlassian.com/browse/CWD-5528)  


author: Lokesh Naktode_miniOrange
body: Hi [@coderfox](/t5/user/viewprofilepage/user-id/3235734)

Crowd SSO 2.0 is in its initial phase and right now it does not provide any configurable option to customize attributes (user profile information )to be sent in the SAML Response to Service Provider Application(for e.g. Gitlab)

We can provide you a crowd plugin which will make crowd as SAML Identity Provider (works separately with Crowd SSO 2.0) and also support an option to customize the attributes including NameID to be sent in the SAML Response.

Feel free to get in touch if you need more details. You can reach out to us at atlassiansupport@miniorange.com or through our customer portal.

I work for the miniOrange. One of the top SSO vendor in the Atlassian Marketplace.

Thanks,  
Lokesh


Tags: gitlab
Removing the 'crowd' Context from the Application URL
Asked by Vin?cius Ferr?o:

Someone was able to remove the /crowd in the URL of Crowd?

Followed the instructions from: <https://confluence.atlassian.com/crowd/removing-the-crowd-context-from-the-application-url-223217080.html>

But it simply does not work as expected.


Answers:
author: Vin?cius Ferr?o
body: It was my bad. The default settings includes a /\> at the end of the \<Host\> directive.

The documentation should point at this, so other guys don't have the same issue.

Removing the /\> at end of \<Host\> and closing with \</Host\> solves the issue.
Help with creating a proper password policy for Crowd users
Asked by Christian Palacios:

Hi there,

We want all of our users to to be forced to change their password and with that, we also want to implement a password policy. We understand that we can set up a regular expression so that the passwords meet certain criteria, but we want help on how to do that properly. If this is possible, then we can send over the requirements we need.

Thanks,

-Christian


Answers:
author: Andy Heinzer
body: Hi Christina,

The password complexity enforcement is something that can be configured in regards to an internal user directory within Crowd. This is mentioned in [Configuring an Internal Directory](https://confluence.atlassian.com/crowd/configuring-an-internal-directory-18579551.html). This feature has been available since Crowd 2.5.2.

However this functionality does not yet extend itself to user accounts that come from LDAP connected directories. There is a feature request for those other account types in [CWD-2304](https://jira.atlassian.com/browse/CWD-2304). I'm not sure if your user accounts are all in internal user directories to Crowd or if perhaps some of these are coming from a syncing LDAP directory.

With that stated, I'd be happy to try to help you craft a regex statement if I can know more about your requirements here. One of my favorite tools for determining if the regex I use works as expected is to use the site <https://regexr.com/>

It allows you to enter in all kinds of text below your expression and you can very clearly see which entries match your query because they get highlighted on the fly.

Andy


Tags: reset
Got "debug smtp: auth ntlm failed" with Exhchange Server
Asked by SYREA:

Crowd connect to Exchange Server failed as above.

How to solve this.


Answers:
author: Nic Brough -Adaptavist-
body: This usually means you have given incorrect credentials to the email server. Check what you have configured in the mail server settings. With exchange, a common error is to only provide a user name, or an email address - you need to give it the full domain credentials including the domain.

comments: author: SYREA
body: Thanks, Nic.

1?The credential is right(because confirmed in OWA), usually I use mail address, and even try AD\\User format;

2?The reason is Exchange 2016 default SMTP in port 25, named as "Default Frontend MAIL", in security setting does not include "Exchange users", check it will works;

3?Another way is create a new "receive connector" in port 587 for kind of these uses.

Thanks, again.


author: Nic Brough -Adaptavist-
body: So you had configured Exchange to reject the login as invalid? And now fixed that?


author: SYREA
body: 1?That's Exchange 2016 default settings;

2?Problem solved now.

Thanks.
Can I setup Crowd DR site?
Asked by ilya_musayev:

How do I go about about setting up Crowd services for DR Site?

My layout is 2 datacenters, 2 node in each, shared NFS (replicated from Active Site to DR).


Answers:
author: sara
body: Just adding ,I believe crowd has a shared home ,you can set up a filer level(eg:snapmirror) replication for this.For DB you can configure a slave setup for DR site.

Rest all files you have to manually copy and set the DR site.The concept of DR is to make the service up without dataloss in case of a catstrophe.So you have to include all the files that are needed for crowd to start and function in case your main site is not available.
Error in log: credentials in request: true , allowed via CORS: false
Asked by Sonja_Linsi:

Hello

Various actions in the Crowd web interface generates this and similar errors:

2019-05-22 13:15:46,085 http-nio-8095-exec-17 WARN \[common.security.jersey.XsrfResourceFilter\] Additional XSRF checks failed for request: <http://deutz.domain.ch:8095/crowd/rest/admin/1.0/mail/configuration> , origin: <https://jira.domain.ch> , referrer: <https://jira.domain.ch/crowd/console/secure/admin/mailserver.action> , credentials in request: true , allowed via CORS: false

It happens when clicking on password reset, sending test email, create support.zip.

Base URL of crowd is <https://jira.domain.ch/crowd> and the hostname is deutz.domain.ch.

Crowd is running in following environment:

* Application serverApache Tomcat/8.5.40
* Crowd version 3.4.4 Build number1069 Build date2019-05-02
* Java version 1.8.0_152
* PostgreSQL 9.6
* OS: Debian 4.9
* Does anyone know how to fix this problem.

Thank you and best regards

Sonja


Answers:
author: sara
body: This is due to cross origin headers.This can be fixed by enabling cors in web.xml in tomcat.

comments: author: Sonja_Linsi
body: Hi Sarath

Thank you for the hint. I tried it with this cors Filter incrowd/install/apache-tomcat/conf/web.xml but didn't work i have still the same error:

\<filter-class\>org.apache.catalina.filters.CorsFilter\</filter-class\>

\<init-param\>

\<param-name\>cors.allowed.origins\</param-name\>

\<param-value\>/\*\</param-value\>

\</init-param\>

\<init-param\>

\<param-name\>cors.allowed.methods\</param-name\>

\<param-value\>GET,POST,HEAD,OPTIONS,PUT\</param-value\>

\</init-param\>

\<init-param\>

\<param-name\>cors.exposed.headers\</param-name\>

\<param-value\>Access-Control-Allow-Origin,Access-Control-Allow-Credentials\</param-value\>

\</init-param\>

\<init-param\>

\<param-name\>cors.support.credentials\</param-name\>

\<param-value\>true\</param-value\>

\</init-param\>

\<init-param\>

\<param-name\>cors.preflight.maxage\</param-name\>

\<param-value\>1800\</param-value\>

\</init-param\>

\</filter\>

\<filter-mapping\>

\<filter-name\>CorsFilter\</filter-name\>

\<url-pattern\>/\*\</url-pattern\>

\</filter-mapping\>


author: sara
body: This can also be configured in proxy by allow origin tag.
approval email customer notifications
Asked by Wayne Yang:

i have one approval but approval email customer notifications cant received mail![?? 2024-09-05 ??5.16.53.png](/t5/image/serverpage/image-id/345708i546849899869316A/image-size/large?v=v2&px=999 "?? 2024-09-05 ??5.16.53.png")


Answers:
author: Rilwan Ahmed
body: Hi [@Wayne Yang](/t5/user/viewprofilepage/user-id/5546697) ,

1. Did you add approval step in workflow ?  
   <https://support.atlassian.com/jira-service-management-cloud/docs/add-an-approval-to-a-workflow/>
2. Ask approver to check all folders in the email app including junk/spam folders


author: YY Brother
body: Hi [@Wayne Yang](/t5/user/viewprofilepage/user-id/5546697)

??????????????

???????????????????????????????????????????????

???????????????????? Rilwan ????????  
Thanks,

YY?


Tags: cloud

jira-service-management

jira-service-management-cloud
Change ticket closing time
Asked by Jens Prokoph:

Hello, In our system it is set up as follows: when a ticket is solved it gets the status 'Successfully solved' and Jira sets the ticket to the final status 'Closed' after 10 days Is there a way to set this up and set it for workflows in the project?


Answers:
author: Walter Buggenhout
body: Hi [@Jens Prokoph](/t5/user/viewprofilepage/user-id/5564635),

I don't think I fully understand what you are asking for. From what you describe, it looks as if you have an automation rule working on your JSM project that uses a scheduled trigger (e.g. it runs every day at a specific time), looks up the issues that have been in status *"Successfully Solved"* for at least 10 days and then performs an action to transition those issues to status closed.

The search I refer to will probably look somewhat like this:
>
> ```
> Project = <Your JSM Project> AND status = "Successfully Solved" AND
> status changed to "Successfully Solved" before -10d
> ```

You can set up a similar automation rule to do similar things in other projects / for other workflows, as long as you modify the query to find the issues and the status you want to transition them into to your other project or workflow.

Hope this helps!

comments: author: Jens Prokoph
body: Yes exactly, we have a global rule in the automation that sets the tickets to a status after 10 days from which they can no longer be changed/reopened. But now we have a project where the time is to be set to 21 days. I can also set this via my own automation, but the global automation always beats the project's own automation. So I have the problem that I always have to adjust the global automation and set the filters so that this new project is not included.


author: Jovin
body: Hey [@Jens Prokoph](/t5/user/viewprofilepage/user-id/5564635)

Sounds like you need to modify the existing automation to look only at a specific project so it stops looking at the new project.

You'll find this setting in the "Rule Details" section of the rule, but you'll need to be in Global Administration for this to work (there is a link on the Rule Details tab that'll take you there).


author: Walter Buggenhout
body: Well, indeed. That is a consequence of applying different (business) rules in different places.

Depending on how many projects you may have in place, you might consider setting up similar automation rules in each project. Or you might add a condition to the global automation rule (*Field Value \> Project is not one of \> list the projects that do not match the 10d rule)* so the status change is skipped for the exception projects.

I would rather recommend though (from a business and manageability perspective) to avoid these different approaches. Why would one customer need 21 days before you automatically closing their issues while 10 days seems to be enough for everyone else?


author: Jens Prokoph
body: Unfortunately, this is a customer matter from our partner with whom we work via a Jira to Jira interface and otherwise there would be major problems with the status value exchange


Tags: cloud

jira-service-management

jira-service-management-cloud
"Something is Wrong" when attempting to create and switch on an Email Integration
Asked by oliver_mills:

Good afternoon,  

I am trying to set up an email integration within Jira Service management, however when attempting to switch it on I recieve the error "Something is wrong.... Page cannot be displayed".  

Would any of you fine folk be able to give any pointers on this?  

Thanks in advance![JIRASMIntError.png](/t5/image/serverpage/image-id/345696iF5D8B9AF550E3A0F/image-size/large?v=v2&px=999 "JIRASMIntError.png")  

<br />


Answers:
author: Sebastian Krzewi?ski
body: Hi [@oliver_mills](/t5/user/viewprofilepage/user-id/5584738)

You need to raise a support request to Atlassian support. They will have ability to check logs.

Regards,

Seba

comments: author: oliver_mills
body: Hi Seba,   

Thank you I will do just that.  

Thanks for the quick response :)  

Cheers


Tags: cloud

jira-service-management

jira-service-management-cloud
Validation for decline the approval
Asked by Mar Angelo L_ Tareno:

How can I add a validation for approver.

The approver needs to add comment first before decline the approval of ticket?


Answers:
author: Mayuresh Kamble
body: Hi [@Mar Angelo L_ Tareno](/t5/user/viewprofilepage/user-id/5544846) ,

Currently this functionality is not available in Jira cloud and there is a open feature request for the same which you can vote and watch - <https://jira.atlassian.com/browse/JSDCLOUD-3855>  
I tried adding a Comment field required validator for for the approval transition in the workflow but the screen does not pop up and the ticket gets transitioned to the relevant status mentioned in the approval step.

Regards,  
Mayuresh


author: Vijay Dadi
body: [@Mar Angelo L_ Tareno](/t5/user/viewprofilepage/user-id/5544846) ,

At the transition step in workflow, use a validator field and add a comment to be blank fo rvalidation.

Vijay


author: Sebastian Krzewi?ski
body: Hi [@Mar Angelo L_ Tareno](/t5/user/viewprofilepage/user-id/5544846)

For me it looks that you can use Field validator on transiton and you can use pick comment.

Regards,

Seba

comments: author: Mar Angelo L_ Tareno
body: It doesn't work, I decline it on the request portal.

here's what I did on the workflow.  
is there any warning after clicking the decline button to tell the user need to add comment first? Per approver need to add a comment  
![Screenshot 2024-09-05 152732.png](https://community.atlassian.com/t5/image/serverpage/image-id/345699iB20D6FE265DA3D68/image-size/large?v=v2&px=999 "Screenshot 2024-09-05 152732.png")


Tags: cloud

jira-service-management

jira-service-management-cloud
display the third field on forms based on the values selected in two dropdown fields?
Asked by Prabhu Chilukuri:

Hi All,

Is there a method to display the third field on forms based on the values selected in two dropdown fields?

Thanks!  


Answers:
author: Vijay Dadi
body: Hello [@Prabhu Chilukuri](/t5/user/viewprofilepage/user-id/3414934) ,

You can make use of cascading field, that will solve your issue.

Regards,

Vijay

comments: author: Prabhu Chilukuri
body: Hi [@Vijay Dadi](/t5/user/viewprofilepage/user-id/5408989) ,

However, I am utilizing Forms. Are there alternative methods available?

Thanks,

Prabhu


author: Vijay Dadi
body: Cascading fields are not supported in forms. Need to find an alternative solution. If I do, will update this thread.

Vijay


Tags: cloud

jira-service-management

jira-service-management-cloud
When a customer responds to an issue, it is creating a new ticket each time
Asked by Peter Bailey:

We have setup Jira to create an issue when an email is received. The problem is when a user sends a reply/response, it creates another new issue.

Is there a way to strip out the "Re:" part of the title to add it to the existing issue upon receiving the email?


Answers:
author: Peter Bailey
body: So the former Jira administrator had set it up without enabling the

##### Allow all emails that contain a valid issue key to be added as a comment to the issue? {#toc-hId--1424319436}

rule. I will let you know how it goes... Thanks for everyone's quick responses.

comments: author: Khuram Khalil
body: did that work? im having the same issue but for internal users


author: Susan Waldrip
body: Hi [@Peter Bailey](/t5/user/viewprofilepage/user-id/5584733) , Welcome to the Community! One thing you might verify is whether the customer is replying to the JSM (system) emails or are they using the ORIGINAL email to reply? We had that problem with customers who didn't get formal training and just contacted them to let them know. Good luck!


author: Nikola Perisic
body: Welcome to the community [@Peter Bailey](/t5/user/viewprofilepage/user-id/5584733) ! Do you have any automation rules set up? Usually, this is something that shouldn't happen. Even if you reply to the request.


author: Dirk Ronsmans
body: Hey [@Peter Bailey](/t5/user/viewprofilepage/user-id/5584733) ,

The Re: part shouldn't trigger a new ticket. Normally if the issue key is in the subject the mail is added to the issue as a comment.

Can you validate that the issue key is in the subject of the reply mail?

<https://support.atlassian.com/jira-service-management-cloud/docs/allow-external-emails-to-be-added-as-comments-on-issues/>


Tags: cloud

jira-service-management

jira-service-management-cloud