youngmon/atlassian-qna huggingface dataset:
Fetch more parameters from Active Directory to Crowd to have complete user profile and filtering.
Asked by Ruwan Mettananda:

When we are creating users in Active Directory, there are lot of attributes we are adding to user.

1. User-name

2. First-Name

3. Last-Name

4. Initials

5. Password

6. E-Mail

7. Company name

8. Company address etc.

But when the user is synced to Crowd, only following set of data are available to access from Crowd side.

1. User-name

2. Display Name (First Name + Last Name)

3. E-Mail

Can we retrieve more details for the user which are available in Active Directory side (such as Company name) to the Crowd side. We are planing to grant access to different applications (JIRA, Confluence, Bamboo etc) using this data.


Answers:
author: Felipe Kraemer
body: Hi Ruwan,

I believe what you want to achieve has been suggested in this feature request:

<https://jira.atlassian.com/browse/CWD-1052>

As can be seen in the issue above, at this time the functionality you're requesting is not yet possible in Crowd.

Feel free to [vote](https://confluence.atlassian.com/display/JIRA/Watching+and+Voting+on+an+Issue) for the issue, add it to your watch list in order to be notified on its progress, and leave a comment there describing your use-case the more detailed the possible. This will help our development team to build a solution that meets better your needs.

If you want to know more about how we prioritise feature requests, take a look at our [policy](https://confluence.atlassian.com/display/DEV/Implementation+of+New+Features+Policy).

If this answer was helpful, please allow me to ask you to mark my answer as accepted in order to have it in the top of the thread, also helping other customers.

Thanks in advance!

Kind regards,  
Felipe Kraemer


Tags: active-directory

crowd-administration
Accidentally removed the crowd-administrators group. What can I do?
Asked by Doug Hughes:

I accidentally deleted the crowd-administrators group from my Crowd install. This immediately removed my permissions to administrate the system. I am now locked out from it. Is there any way to restore this group and my user's association? Or do I need to basically do a DB restore or clean install?

Thanks,

Doug


Answers:
author: Jobin Kuruvilla [Adaptavist]
body: Try this: <https://confluence.atlassian.com/display/CROWDKB/Restoring+Passwords+To+Recover+Admin+User+Rights#RestoringPasswordsToRecoverAdminUserRights-Step4.IfNoLocalUsersExist>

You might want to use another existing group or add a group similar to how you add a user.

comments: author: Doug Hughes
body: Thank you. I ended up doing a DB restore before I had a chance to try this out. The information looked good, so I've marked it as accepted.


Tags: crowd-administration
Use Crowd as a group directory in Outlook?
Asked by Philip Schlesinger:

Hi all,

We use Crowd as a proxy ("delegated authentication directory"?) for our corporate Active Directory domain. That way, we manage group membership lists instead of going through corporate IT every time we need a group membership change.

Whenever we're going to bring down a Crowd-linked application (such as JIRA), we of course want to email all active users to alert them of the expected down period. So far, we've just queried the JIRA database for a list of email addresses, copy/paste into an email, and send...

Instead of this manual process, is there instead a way to have Outlook use Crowd as a group directory -- and thus allow us to just send an email to "crowd/jira-users"?


Answers:
author: Nic Brough -Adaptavist-
body: That would be quite useful, but you'd need to have a connector for Outlook to enable it to read Crowd data - I don't think anyone has written one yet.


Tags: crowd-administration
Automated Deployment of Crowd on EC2
Asked by mark.stephens:

Our team is running the latest version of Crowd on EC2. Currently we follow the steps below to deploy crowd to an EC2 server.

How can I automate steps 5 - 8?

1) Upload [Crowd.tar.tz](http://Crowd.tar.tz) file to an EC2 instance

2) Unzip file

3) Configure Crowd HOME directory by modifying a Crowd configuration file

4) Start Crowd by running Crowd startup command

5) To configure Crowd, launch the new Crowd URL from a web browser, get the server ID from Crowd's web page

6) Using the Server ID, login to Atlassian's website to request a temporary license key. To do so, you will need to answer a few questions from Atlassian on why you need a temporary Crowd license key

7) Back to Crowd's web page, enter the new key generated by Atlassian

8) Launch a separate web browser, login to old Crowd app, export the latest database to a xml file, and then import the xml file into new Crowd via the new Crowd web page

9) Request a SSL Cert to allow https access.

10) Request Crowd Domain changes

11) Transfer existing Crowd license from old Crowd to the new Crowd


Answers:
author: Timothy
body: You need to run your scripts to be able to do that. You can try Selenium or any of it's alternatives.


Tags: automation

aws

continuous-delivery
send e-mail to crowd group
Asked by Ryan Morton:

I would like to be able to send an e-mail to a crowd group - is this supported natively, through a plugin, or through integration with a 3rd party SMTP application?


Answers:
author: Ryan Morton
body: Thanks - I have that configured and working successfully. Let me give an example:

If I have a crowd group named "email-distro" with 5 people, is there a way to configure crowd so that I can send an e-mail to [crowd+email-distro@domain.tld](mailto:crowd+email-distro@domain.tld) or something similar?

I currently have to maintain a separate mapping outside of crowd (not ideal) and rewrite `/etc/aliases` on my mail server to hack around this.


author: salehparsa
body: Hi Ryan,

You can configure mail server in Crowd with the steps in [this documentation](https://confluence.atlassian.com/display/CROWD/Configuring+your+Mail+Server). Once you configure it you can send email to the Crowd users in special events such as when user request password reset :smile:

Hope it helps.

Saleh
CROWD SSO
Asked by Young__Hahn:

Hi

I am trying to use SSO in CROWD so that I don't have to type in my id and password every time I do something.

I did look at the documentations for SSO and did exactly what was on the documentations.

Such as editing the xml file `crowd.properties`.

However, it is still not working.

Every time I log on to JIRA and try to go to Admin section, it is asking me to log in again

---------------- {#toc-hId-1649415017}
--------------------------------------

Administrator Access {#toc-hId--902741944}
------------------------------------------

If you were sent to this page from a link obtained from an untrusted source please proceed with caution or validate the link source before continuing.

You have requested access to an administrative function in Confluence and are required to validate your credentials below.

-----------------------

Isn't SSO for this? so that you don't have to sign in all the time?

My applications are installed in AWS with ec2 instances.

I am using IP:8080 for JIRA and IP:8095 for confluence.

I am guessing it might be because I don't have a domain name.. I am using private IP for ec2 instances.

Also.. If I do use SSO to log in to JIRA, I don't have to login again in Confluence right?

I didn't link JIRA and Confluence together.. but I linked both of them to CROWD.

Crowd contains user information of JIRA and Confluence in ALL directories.

Thank you


Answers:
author: Timothy
body: > I am using IP:8080 for JIRA and IP:8095 for confluence.

For Crowd's SSO to work, you need to be on the same domain to work.
> Also.. If I do use SSO to log in to JIRA, I don't have to login again in Confluence right?

Yes. That is what Crowd SSO provides.

comments: author: Young__Hahn
body: Another quick question.When I log in to JIRA and click on user management option on JIRA, it asks me to log in again (Confirm the password).. Do I have to do this all the time even with SSO? or is this because I don't have domain? Thank you


author: Timothy
body: That is a standard functionality of JIRA where administrators will still be questioned for password.


Tags: crowd-administration
Supported LDAP to connect with Crowd to support nested groups
Asked by Natalie Wenz:

Hello everybody,

we are planning to install Crowd and to connect to LDAP. One of the main requirements in this projects is that are nested groups are supported in LDAP.

We are planning to create the users and groups within in Crowd and synchronize them into LDAP. So we need write access to our LDAP server.

Does anyone have experiences with that scenario? We haven't choose a LDAP yet. Do you know an open source LDAP that supports nested groups and are able to connect to Crowd?

Thanks in advance

Best regards

Natalie


Answers:
author: Rodrigo Girardi Adami
body: Hi Natalie,

Crowd supports nested groups in LDAP. There is a option that you must turn on to enable this. I do recommend to check [this documentation](https://confluence.atlassian.com/display/CROWD/Nested+Groups+in+Crowd) which explains how to setup nested Groups in crowd.

I hope this helps!

Cheers,

Rodrigo


Tags: crowd-administration
Crowd and Active Directory connection
Asked by Ruwan Mettananda:

We are planning to migrate our Crowd users to Active Directory. How does Crowd and Active Directory connection configure?

Is there any guide?


Answers:
author: Felipe Kraemer
body: Hi Ruwan,

You need to configure a Delegated Authentication Directory in Crowd:

<https://confluence.atlassian.com/display/CROWD/Configuring+a+Delegated+Authentication+Directory>

If this answer was helpful, please allow me to ask you to mark my answer as accepted in order to have it in the top of the thread, also helping other customers.

Thanks in advance!

Kind regards,  
Felipe Kraemer

comments: author: Ruwan Mettananda
body: Hi Felipe, Yes your suggestion is helpful for us. I am wondering about associating users to the groups based on their E-Mail domain, without associating them to a different directory.Is there any way to achieve this in Crowd.Is there any configuration need to be happen in AD side? ThanksRuwan


Tags: active-directory

crowd-administration

user
How to model our access control requirements with Crowd?
Asked by Geoff Bland:

I've been asked to look at Crowd to replace our current access control mechanism.

I'm having some trouble getting my head around how we can use Crowd to meet our requirements so would appreciate some advice about how to model this in Crowd.

Our current access control is based on a matrix of groups, users and permissions. We have 5,000 users about 1,000 groups and each group has 7 permissions; ADMIN, MANAGE, FWD, RWD, TYPE, VIEW, READONLY. The ADMIN permission is special as it means this user can add/change/remove users in this group, all the other permissions are meaningful to what our application allows users to do.

So for example, for GROUP_999:

* Alice is allowed ADMIN, MANAGE, FWD, RWD, TYPE, VIEW, READONLY,
* Bob is allowed MANAGE, FWD, RWD, TYPE, VIEW, READONLY,
* Claire is allowed TYPE, VIEW, READONLY,
* Dave is allowed READONLY,
* Eric is allowed FWD, RWD.

These users can also have different permissions on other groups too.

Crowd seems to allow use to manage users and groups but does not seems to allow us the level we need for what we're calling permissions. I can see that we could create 7 groups for each of our application groups (GROUP_999_ADMIN, GROUP_999_MANAGE, GROUP_999_FWD, etc) but that seems clunky.


Answers:
author: Timothy
body: Crowd does not provide permissions to applications. Crowd is a user, group and memberships which are then sycned to the applications linked to it. It is up to the applications that link to Crowd to apply the permissions.

comments: author: Geoff Bland
body: Thanks for the quick answer, I suspected as much \& good to know I wasn't missing something.

So to confirm my understanding, using the example above, I can use Crowd to lookup user/principle Bob and see that he belongs to the group GROUP_999.

But then it is up to my application to determine what Bob is allowed to do in GROUP_999.


author: Timothy
body: Yup. That's the way it should work.
LDAP filter with Crowd
Asked by Ruwan Mettananda:

I want to filter the users in my Active Directory to a new directory in Crowd.

1. Create a new directory in Crowd to users in "ABC" company. (Users have @abc.com domain)
2. Create a new directory in Crowd to users in "XYZ" company. (Users have @xyz.com domain)

I have create a following filter and create a new directory. But it seems that it does not working.

(\&(objectCategory=person)(objectClass=user)(mail=\*@abc.com))

Where is the problem in this filter?


Answers:
author: Rodrigo Girardi Adami
body: Hi Ruwan,

This filters seems to be correct. What I recommend to you is to double check if the object class and object category are correct in the LDAP server. Try to take an LDIF as example from the user you want to filter and check these attributes.

Also, try to set the maii as (mail=\*[abc.com](http://abc.com)) removing the @ sign just for testing purposes. It should work afaik but, making tests using other variables is a valid testing course.

The filter must be placed in the user filter part as well.

I hope this helps!

Cheers,

Rodrigo


Tags: crowd-administration
license limit exceeded - Crowd prevents from login
Asked by Klaus Gentzsch:

I tried to change ldap authorization... now I received a system message:   

*This is a reminder that you have reached 15.203 users of your 500 user license.*   
*Once you exceed your license limit, Crowd will prevent any users from logging in (including administrators).*   

## THIS was NOT intended  
we have around 130 active users  

But now I cannot login to crowd anylonger - and even not undo the fault (only half an hour since the mail was sent) - Crowd redirects all to: /crowd/console/license.action  

HOW can I get back - I have NO account data,  
cause the our former colleague has left the company.

Is there a workaround? Hints welcome :wink:


Answers:
author: Deividi Luvison
body: Hey Klaus,

In that case go to [my.atlassian.com](http://my.atlassian.com) and click on generate a new evaluation license, with that you can use the 1 month unlimited access to have access to crowd again as described in below KB:

<https://confluence.atlassian.com/display/CROWDKB/Users+are+Unable+to+Log+in+After+Updating+the+License>

As Crowd counts the number of users based on the "Can Login List" for the integrated applications (Crowd console -\> Applications -\> an application -\> Groups), you will need to check if any of those groups have the proper number of users.

Did you had any changes on LDAP/AD where a new group was added to all your company users?

Or maybe someone created a new drectory to pull all users and automatically added your users to a group that have the can log in permission.  
Usually when we have this kind of scenario those are the most indicated as culprits.  
Hope it helps.  
Thanks and Regards,  
David\| The Engineer that like Windows for realsies.


author: Klaus Gentzsch
body: great! that's the missing link :smile:

I made a backup of the cfg.xml - got a trial license - got it running again - got rid of the wrong directory settings - and switched back to old cfg.xml - looks good

next week, I'll find out what our account data are...

comments: author: Deividi Luvison
body: Great to hear that :). Mind marking my first reply as answered your question so we can remove this question from the un answered section?


author: Klaus Gentzsch
body: Hello David,

that's a good idee, but the form asks for a SERVER ID

and I know that there is one - but right now crowd redirects every access to the license.action page

Is there another change to find out my server id???

Thanks. BRs Klaus

comments: author: Deividi Luvison
body: In Crowd-HOME\\crowd.cfg.xml, in there you will have the crowd.server.id tag :).


Tags: crowd-administration

licence
Crowd not sending emails over SMTP or JNDI - Invalid HELO Name
Asked by Joshua Bayfield:

Hello everyone,

I've been trying to get Crowd to send emails recently, and neither SMTP or JNDI is working.

Consistently there is an 'Invalid HELO Name' error, and I can't seem to find where the HELO name is defined. Any ideas how I can resolve that?

Thank you!

Josh


Answers:
author: Nic Brough -Adaptavist-
body: Usually means the name of the email server you have defined is wrong and hence cannot be reached by the client. Or your mail server is configured with a name that is wrong for the server.


author: rrudnicki
body: Hi,

Yes, for some reason your server isn't being able to authenticate on the address. To make sure where is the problem (port number, email, password) you can test this by command line:

```
telnet &lt;email-server&gt; &lt;port-number&gt;AUTH LOGINHELO &lt;YOUR-DOMAIN&gt;mail from: &lt;your-email&gt;rcpt to: &lt;destination-email&gt;data.quit
```

Hope this helps.

Renato Rudnicki


author: Radu Dumitriu
body: Invalid HELO name usually comes because SMTP \*requires\* AUTH. Check your config \& see RFC2821 4.1.1.1: <https://tools.ietf.org/html/rfc2821#section-4.1.1.1>

comments: author: Joshua Bayfield
body: The SMTP server definitely requires auth, and I've declared it as so. Still no dice.


Tags: crowd-administration
Need to recover admin access
Asked by Nathan Curry:

I have an issue accessing my Crowd installation administratively. I had recently upgraded my Crowd installation from 2.6.0 to 2.8.0 and found that my user account from AD no longer has access to the administrative portion of the site. I checked the crowd application and noticed that the two directories (AD and internal) both looked as if they were disabled so I enabled the AD directory and the group associated with it. I was able to login still but had no admin access but now the crowd admin user from the internal directory does not have access to login at all.

My question is, is there is a way to enable a directory or provide admin access to my user account by manipulating the MySQL database?


Answers:
author: Giuliano C.
body: Hey Nathan,

In order to put the internal directory in first position and also reset the password for the administrator, you might been interested to follow the procedures from the KB article below:

\* [Restoring Password to Recover Admin Rights](https://confluence.atlassian.com/display/CROWDKB/Restoring+Passwords+To+Recover+Admin+User+Rights)

Let us know if it helps you to get access to the instance back, Nathan.

Kind Regards,   
Giuliano Tenedini  
Confluence/Crowd Support
Crowd/Microsoft AD: User entering incorrect password in Jira causes account to be locked in AD
Asked by Ben Scutt:

Hi,

We have recently moved from using an Internal Crowd Directory to using a Microsoft AD connector for all of our Atlassian users.

I've just had a report of a user who changed thier password in AD and then tried to login to JIRA with the new password. This failed (I guess it hadn't syncronised yet). I performed a full syncronisation with "incremental sync" disabled. The user reported that thier AD account was locked, but after being unlocked in AD they could log into Jira.

Can failed password entries in Crowd/JIRA etc cause an AD account to be locked when syncronisation occurs?

And are password updates not included in incremental syncs?

I have left "incremental sync" disabled for now. Would password changes be reflected quicker in the Atlassian applications if I disabled the Cache in Crowd as well? We have about 1800 users.

Thanks,

Ben

<br />


Answers:
author: yoanto wakimin
body: Same issue here.

There should be similar password policies like internal crowd directories -- with at least maximum password attempts.


Tags: crowd-administration
Recommended Directory / Group / Permission for Super Admins in an Atlassian Suite
Asked by J Boyer:

Hello,

I have setup Crowd, and have integrated this with Stash. I will be deploying and integrating Crowd with the other apps in the Atlassian Suite as well (Crucible, Jira, Confluence, Bamboo, a few custom apps, etc). Crowd will be used for SSO, 2FA, and to simplify managing users across the suite of apps.

I think it is relatively clear how to setup users/groups/permissions for the regular users.. I am planning on a Directory for all company users, and groups to delegate permissions for authenticating with each app.

Here is where I get less certain, and where I would appreciate insights from your experience: What is a recommended setup for managing administrative access to each of these apps?

1) Should I ensure a Super Admin User exists in each app's Internal User Directory, and use this to configure the app if Crowd is unavailable?

2) How would I delegate administrative permissions (over each app, not Crowd) to Users in the Crowd User Directory?

Thanks!


Answers:
author: Timothy
body: > Should I ensure a Super Admin User exists in each app's Internal User Directory, and use this to configure the app if Crowd is unavailable?

Yes. If you don't have this, when Crowd dies, you'll have a mess on your hands.
> How would I delegate administrative permissions (over each app, not Crowd) to Users in the Crowd User Directory?

Crowd will sycn the users to each of the application. Users and groups in the app will be show with the label of "Crowd User". They are just like any any app user and group where you can use them in schemes.

comments: author: J Boyer
body: If I have a user defined in an App's Internal User Directory, and another User with the same name in the Crowd directory, is there a _first match wins_ I need to be aware of?


author: J Boyer
body: On the second question, I'm not sure the answer provided is sufficiently clear, though I am having a difficult time coming up with a more nuanced version of the question. I will research some more first.


author: Timothy
body: bq. is there a _first match wins_ I need to be aware of?If there is a duplicate usernames, the order of your User Directory takes precedence.


Tags: crowd-administration
Crowd Implementation with server/cloud hybrid
Asked by NicholasL:

Hello!

We have a JIRA/Confluence cloud instance as well as a local Stash and Bamboo instance. I was wondering if we could use our own local crowd server to manage users between all 3?

Also, does crowd support saml?


Answers:
author: Diego Berrueta
body: Hi @Nicholas Leonard. At the moment it is not possible to use Crowd to synchronise and manage user bases between local installations and Cloud instances.

Regarding SAML support, please see the notes at <https://jira.atlassian.com/browse/CWD-1822>.


Tags: crowd-administration