youngmon/atlassian-qna huggingface dataset:
How to Get Token in Confluence synchronized User Directory with Crowd Server
Asked by TruongNN5:

In the my confluence have connected with Crowd server to synchronized User Directory, so i can use user was created from Crowd to login into confluence.

I know The Crowd REST API can get Token by username and password, **but i don't known get the token in Confluence when login.**Because, I want use the token to authentication for the application embedded Confluence by Macro.

Please help me.

Thanks


Answers:
author: Marcin Kempa
body: Hi [@TruongNN5](/t5/user/viewprofilepage/user-id/1168601),

It seems that you have a custom Confluence macro, probably provided by your plugin, that is pulling some data from external application. Since you have your Confluence connected to Crowd you would like to have your external application connected to Crowd as well so once users enter Confluence page they would be authenticated to the external app as well through Crowd SSO and would be able to access data in macro from that app. Is that a fair understanding of your problem?

If this is the case and you would like to be able to rely on Crowd SSO then all of your applications needs to be in the same domain as this mechanism relies on the HTTP cookies. [Here](https://confluence.atlassian.com/crowd/overview-of-sso-179445277.html) is Crowd SSO overview documentation, the guide about integrating custom application with Crowd is [here](https://confluence.atlassian.com/crowd/integrating-crowd-with-a-custom-application-192511.html). The REST documentation for Crowd SSO may be found [here](https://docs.atlassian.com/atlassian-crowd/3.1.2/REST/#usermanagement/1/session).

There also might be other approach to authenticate users with your external application using Application Links. You may find more about it [here](https://confluence.atlassian.com/doc/linking-to-another-application-360677690.html). If you would like use that in your plugin, [here](https://developer.atlassian.com/server/jira/platform/implementing-application-links-in-jira/) is developers docs for Jira, but this should be fairly similar in Confluence.

Hope that helps!

Marcin Kempa


author: James Richards
body: Hi Truong,

Are you talking about the JSESSIONID or if you're using Crowd then the crowd.token_key?

If you're using curl, you can run it with *--cookie-jar filename.txt* and save the cookies in a local file.

Usually REST calls use Basic Auth.

If you're taking about the XSRF check value you can also use *-H 'X-Atlassian-Token: no-check'* On the command line.

Hope this gives you some pointers.

Thanks,  
James


Tags: confluence

developer
CROWD DB user and password reset
Asked by Charlie:

Hi,

I need to reset the crowd DB user password soon, we're running crowd on RHEL 7.4, and MS SQL 2012 for the external database.

My questions is once the password is reset on the MS SQL side for the crowd DB user, where in the crowd server do I update the changed password? I've looked everywhere in the Crowd install directory and I'm not finding it. Every XML and config file I could find.

Thank you.


Answers:
author: Marcin Kempa
body: Hi [@Charlie](/t5/user/viewprofilepage/user-id/1167543),

Crowd stores password to the DB in the crowd.cfg.xml config file which can be found in Crowd's [home directory](https://confluence.atlassian.com/crowd/specifying-your-crowd-home-directory-132382981.html). Look for the entry:

```
<property name="hibernate.connection.password">secret</property>
```

Please test this first on some staging environment and create a backup of Crowd and it's home directory before proceeding.

After changing this password you may need to restart Crowd.

Hope that helps,

Marcin Kempa

comments: author: Charlie
body: Thank you very much I found it.


author: Rajan chaudhary
body: 3333
After disabling/enabling LDAP in Crowd , Jira users cannot sign in anymore with their credentials.
Asked by Roland Vermeulen:

Hi,

Today i've been testing with an addition of an AD directory in our existing Crowd to replace an LDAP directory.

Due to disabling the LDAP directory , a certain amount of users was unable to logon as they were removed from Jira

After enabling this again and synchronizing, all users were put back in place in Jira  
However unable to logon with their credentials , while they could earlier.

In logs at the Jira side i find entries like:

2018-02-27 17:20:35,651 http-nio-8080-exec-640 anonymous 1040x3562356x1 rrcaim \<ip client, ip server\>,127.0.0.1 /login.jsp The user 'xxxxxxxx' has FAILED authentication. Failure count equals 3  
2018-02-27 17:20:47,522 http-nio-8080-exec-639 anonymous 1040x3562366x1 - \<ip client, ip server\>,127.0.0.1 /rest/gadget/1.0/login login : 'xxxxxxxx' tried to login but they do not have USE permission or weren't found. Deleting remember me cookie.

On the crowd side:

127.0.0.1 \[27/Feb/2018:16:20:48 +0100\] "POST /crowd/rest/usermanagement/1/authentication?username=xxxxxxxx HTTP/1.1" 400 160 1574 "-" "Apache-HttpClient/4.5.3 (Java/1.8.0_60)"

No changes were made in directory configuration or applications in Crowd.

Within both Jira and Crowd the users exist and can be found defined as they should be and member of right groups and application.

Anyone encountered this before?

Incognito browser , cache and cooking clearing are performed.  
New syncs have taken place but not resolving this weird issue.

Crowd version 2.11.0  
Jira version 7.5.1

<br />

Thanks in advance!

Regards  
Roland


Answers:
author: Marcin Kempa
body: Hi [@Roland Vermeulen](/t5/user/viewprofilepage/user-id/1191784),

Sorry to hear that you have those kind of problems in your setup.

Did you try to do [test user authentication](https://confluence.atlassian.com/crowd/testing-a-user-s-login-to-an-application-103088399.html) in Crowd? As you were doing some changes in the directory setup, could you check if [the group that is allowed](https://confluence.atlassian.com/crowd/specifying-which-groups-can-access-an-application-25788430.html) to authenticate to application in Crowd is still defined or maybe you just have 'Allow all to authenticate'?

Additionally are there any other entries in Crowd log files that may indicate authentication problem?

Hope that helps,

Marcin Kempa

comments: author: Roland Vermeulen
body: Hi [@Marcin Kempa](/t5/user/viewprofilepage/user-id/671367),

Test authentication from crowd works , from Jira through the User directory it doesn't.

The users/groups are allowed to authenticate to the application.  

We did not find any other authentication issues except the 400 on the POST for authenticate so far.  

I'm verifying currently if Crowd is the issue , by adding the LDAP to the Jira instance (bypassing Crowd) to see if the users can authenticate in that way.


author: Noni Khutane
body: [@Marcin Kempa](/t5/user/viewprofilepage/user-id/671367) Did this work?


Tags: jira
Migrate from internal to Azure AD
Asked by Benjamin Brummer:

We need to migrate from internal to Azure AD Directory.

Usernames in internal Directory are like "username". Azure AD like "username@domain.com". How can we keep all history and tickets in jira, confluence, bitbucket etc?

1. Rename users in internal Directory username =\> username@domain.com

2. Create all groups/users in Azure AD

3. Activate Azure AD in Crowd and deactivate internal Directory

Is this the right way?


Answers:
author: Bruno Vincent
body: Hi [@Benjamin Brummer](/t5/user/viewprofilepage/user-id/1191704)

Yes, that sounds like the right way! In step 3, don't forget to add the required Azure AD groups to the list of authorized groups for your applications in Crowd's console.

Alternatively if keeping your usernames in the form 'shortusername' instead of 'shortusername@yourdomain.com' is important for your organization, you might want to take a look at the Office 365 Directory Connector for Crowd (ODCC) plugin which has an option for using that short username: <https://marketplace.atlassian.com/plugins/com.cleito.odcc/server/overview>

(Disclaimer: I work for the vendor of the ODCC plugin)

comments: author: Benjamin Brummer
body: Can we get a evaluation license for your plugin? =\> Found the info on your website ;-)


author: Bruno Vincent
body: Great :-) Feel free to contact us at support@cleito.com if you have any questions!
Crowd server exeption screen.
Asked by Bob B:

following error message is showing after I entered the license on new Crowd server. What could be the reason? What should i do investigate this error? It is on remote computer with no internet access so I can not get the log right now.

Thanks in advance.![crowd error.png](/t5/image/serverpage/image-id/15896iAD2C47794C890D20/image-size/large?v=v2&px=999 "crowd error.png")


Answers:
author: Marcin Kempa
body: Hi [@Bob B](/t5/user/viewprofilepage/user-id/1181969),

I am sorry you've experienced this kind of error.

At the moment it is hard to say what is the underlying problem here without a broader context. Would you mind checking your log files if there are other errors logged before this NullPointerException?

We can also open a support ticket for you, so it would be easier to share the logs with us. Before we do that could you check if you starting Crowd using Java9 by any chance? If so please note that currently it is [not supported and JDK8](https://confluence.atlassian.com/display/CROWD/Supported+Platforms) should be used instead.

Best Regards,

Marcin Kempa

comments: author: Bob B
body: Java is Oracle JDK 8 and Java Core is working fine on same computer. Also I will attach the log when I would be able to get them. Thanks.


author: Bob B
body: Now I have the log file. How can I upload file here?
SSL connection to Crowd doesn't work on SuSe with TOMCAT HTTPS Config
Asked by N B:

SSL connection to Crowd doesn't work on SuSe with TOMCAT HTTPS Config

After following the instructions and trying this:

\<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"  
maxThreads="150" SSLEnabled="true" scheme="https" secure="true"  
clientAuth="false" sslProtocol="TLS"  
keystoreFile="${user.home}/.keystore" keystorePass="changeit"  
keyAlias="tomcat" keyPass="changeit"/\>

This simply doesn't work according to the instructions on the Atlassian website. I do not even get any error message. I tried this on SuSe Linux. It just hangs and times out without even an error message. I tried the following:

\* curl --noproxy "\*" https://localhost:8443 -v

\* wget --no-proxy https://localhost:8443

\* openssl s_client -connect <https://127.0.0.1:8443>

\* Adding the 8443 port to the SuSe firewall and reloading the firewall

\* Changing the above to 443 instead of 8443

\* Reading the Atlassian Crowd logs (nothing useful therein)

\* Reading the Tomcat Apache Cataline logs (nothing useful therein except useless timeout message)

\* Praying...

It does however work with an nginx reverse proxy bolted on at the front. I guess that rules out firewall issues then :-)

With the Atlassian/Tomcat method of enabling HTTPS, it doesn't even give any error. It just sits there for ages then times out.

?


Answers:
author: Marcin Kempa
body: Hi [@N B](/t5/user/viewprofilepage/user-id/1188433),

Can you check if Tomcat is listening on the port you configured HTTPS?

When you are saying that:
> It does however work with an nginx reverse proxy bolted on at the front.

does it mean that https works then with Crowd? or is your nginx doing SSL termination?

Could you post output of curl?

Best Regards,  

Marcin Kempa
Crowd firewall configuration RHEL 7.4
Asked by Bob B:

Hi,

I would like to know more about firewall configuration for crowd in RHEL 7.4.

I have added the 8095 with firewall-cmd and semanage commands, but still can't access to crowd through web browser.

What could be wrong? How to check if crowd is running?

Thanks.


Answers:
author: Bruno Vincent
body: Hi [@Bob B](/t5/user/viewprofilepage/user-id/1181969)

You should run a simple netstat to check whether port 8095 is actually listening

```
$ netstat -an | grep 8095
```

You should also check what you've got in *\<crowd.install.directory\>/apache-tomcat/logs/catalina.out*. When Crowd has successfully started, you should get the following INFO log message:

```
2018-02-26 09:46:40,077 localhost-startStop-1 INFO [com.atlassian.crowd.startup] Starting Crowd Server, Version: 3.1.2 (Build:#891 - 2018-01-19)

*********************************************************************************************
*
* You can now use the Crowd server by visiting http://localhost:8095/crowd
*
*********************************************************************************************
```

Did you reload the firewall service after you added the new rule?

```
$ sudo firewall-cmd --reload
```

comments: author: Bob B
body: Thanks.

```
netstat -an | grep 8095
tcp6 0 0 :::8095 :::* LISTEN

```

the log says x.x.x.8095/opeidserver

does it mean i've installed wrong server?

EDIT:

and x.x.x.8095/opeidserver still refused to connect ... Ihave Jira core server installed on same computer and Jira core is working fine...


author: Bruno Vincent
body: The OpenID server is bundled in the default Crowd installation package. The first server to be started is Crowd Server then OpenID server. So, it's just fine that you see that the OpenID server is started, it does not mean that the Crowd server is not. Check the *catalina.out* file, a few lines before the log about the OpenID server you should see the same info about the Crowd server.

On your Crowd server, do you get 8095/tcp in the results of the following command?

```
$ sudo firewall-cmd --list-ports
```

On a ++remote++ Linux machine, what do you get with a simple TCP connection to your Crowd server?

```
$ nc -vz <CROWD_SERVER_IP> 8095?
```


author: Bruno Vincent
body: BTW I've noticed that the output of your netstat command is "tcp6" which means IPv6. Are you really trying to connect to an IPv6 address? If your Crowd server FQDN was bound to an IPv4 address I think you would see "tcp" or "tcp46" as a result of the netstat command.

If you want to force Crowd to use IPv4, add the *-Djava.net.preferIPv4Stack=true* option in *apache-tomcat/bin/setenv.sh*

```
JAVA_OPTS="-Xms128m -Xmx512m -Dfile.encoding=UTF-8 -Djava.net.preferIPv4Stack=true$JAVA_OPTS"
```


author: Bob B
body: Thank you [@Bruno Vincent](/t5/user/viewprofilepage/user-id/853568). Turns out the port was disabled in network level... I had to change the default port to 80 (since i don't have network admin access) to make it run...
com.mchange.v2.async.ThreadPoolAsynchronousRunner$DeadlockDetector@98898a0 -- APPARENT DEADLOCK!!!
Asked by N B:

2018-02-19 10:05:49,834 C3P0PooledConnectionPoolManager\[identityToken-\>31alg59t187kpw61r3sacz\|6a3140aa\]-AdminTaskTimer WARN \[mchange.v2.async.ThreadPoolAsynchronousRunner\] com.mchange.v2.async.ThreadPoolAsynchronousRunner$DeadlockDetector@98898a0 -- APPARENT DEADLOCK!!! Creating emergency threads for unassigned pending tasks!

Is this a bug? I only tried to remove a user from a group and the Crowd server appears to have crashed...


Answers:
author: N B
body: Appears to be a low memory issue. Have increased -Xmx to give JVM more memory and have not seen the crash again so far...
Crowd Multiple URLs for LDAP servers connection
Asked by A:

I have 2 LDAP servers Primary (currently configured via ldap: chemar URL field in connector, but want to add 2nd server (LDAP Slave). Should I specify

++URL: ldap://ds1:389/ ldap://ds2:389/++

instead of:

++URL: ldap://ds1:389/++


Answers:
author: Marcin Kempa
body: Hi [@A](/t5/user/viewprofilepage/user-id/1188799),

I believe you are trying to implement a directory failover mechanism. The supported method for doing so in Crowd is described in this [documentation](https://confluence.atlassian.com/crowd/configuring-directories-for-failover-authentication-890749126.html).

I hope that this helps,

Marcin Kempa


Tags: crowd-administration
Crowd Multiple LDAP servers
Asked by A:

I have 2 LDAP servers Primary (currently configured via ldap: chemar URL field in connector, but want to add 2nd server (LDAP Slave). Should I specify

++URL: ldap://ds1:389/ ldap://ds2:389/++

instead of:

++URL: ldap://ds1:389/++


Answers:
author: Marcin Kempa
body: You may also give a try directory failover that Crowd offers, as described [here](https://confluence.atlassian.com/crowd/configuring-directories-for-failover-authentication-890749126.html).

Or you can go for the load balancer method as suggested by [@Craig Castle-Mead](/t5/user/viewprofilepage/user-id/224850).

Hope that helps,

Marcin Kempa


author: A
body: Crows is based on java naming service API, the URL field may contain multiple servers:

<https://docs.oracle.com/javase/jndi/tutorial/ldap/misc/url.html>

But it's not documented by crowd team.

comments: author: Craig Castle-Mead
body: Thanks [@A](/t5/user/viewprofilepage/user-id/1188799) - was just able to get time to fully test this out and it's simplified things significantly (no need for external haproxy/lb/etc.

Used the URL format

"ldap://10.0.0.1:3268/ ldap://10.0.0.2:3268/"

Whatever the connection timeout value is, it'll check against each instance, and if there's no response, moves down the list

CCM


author: Craig Castle-Mead
body: I'm quite certain that the UI won't even let you save with the double LDAP server string in the field.

I'd suggest looking at load balancing your ldap servers outside of Crowd itself (f5, AWS elb, haproxy), have Crowd point to that device and then it has the smarts to know which server to route the traffic to.

If the two servers have replication delay, you may notice some weird behavior if/when you need to fail over. Hopefully this doesn't happen too frequently, but I'd definitely suggest testing it out on a non-prod install, or even just a new Crowd directory that isn't linked to any of your apps. Force a failover, see what happens the next sync, fail back, test again. I'd defnintely suggest against using a round robin approach (lowers the risk of constantly adding/removing groups of the two ldaps are out of sync), only use the secondary when you have to.

CCM


Tags: crowd-administration

ldap

mac
Cannot access crowd console from another host browser on LAN
Asked by N B:

I'm not able to access the crowd console via http://\<IP Address\>:8095/crowd

I can only access it via localhost

I've tried adding entries in Applications \> Crowd \> Remote Addresses

but nothing works.


Answers:
author: Bruno Vincent
body: Hi [@N B](/t5/user/viewprofilepage/user-id/1188433)

If you can't even see Crowd's console login form, then that's probably a network issue. Make sure that port 8095 is open for inbound HTTP connections on your Crowd server.

If you do see Crowd's console login form, but cannot login, then that's probably a configuration issue in Crowd itself. In that case (I assume that you're running Crowd v3.x), in the console go to *Settings \> General options* and change the Base URL. I strongly suggest that you use a resolvable FQDN (e.g. myserver.mydomain) instead of an IP address. Still in *Settings \> Single Sign-On cookie settings*, make sure that SSO domain is either blank or equals your actual domain (e.g. .mydomain). Once you've changed those settings, you might need to restart your browser or clear your cookies to login again.

Hope this helps.

comments: author: N B
body: Thanks for the quick response. It turned out to be a Windows Firewall issue where I had to add port 8095. After that it worked. Out of practice with Windows as I've been using only Linux for years.
Is there a way to create non-LDAP groups in Crowd but for grouping LDAP users?
Asked by N B:

Due to customer requirements, we need groups created in Crowd that are outside of Active Directory. Nevertheless, we want to use these Crowd-only groups to be able to group Active Directory users. Is there a way?

The reasoning is to be able to assign group permissions only in Crowd, without having to ask the IT dept. to create new LDAP groups, yet still have a single source of users via the central Active Directory.

Today I was unable to figure out a way, because it would only allow me to add LDAP users to LDAP groups, or add Crowd users to Crowd groups, but I could find no way to add LDAP users to Crowd groups.

This is a very important use case for our large German customer and the main reason why the customer wanted to use Crowd...


Answers:
author: Bruno Vincent
body: Hi [@N B](/t5/user/viewprofilepage/user-id/1188433)

Yes there is!

Add an LDAP Directory connector in Crowd (of type Active Directory) and select the **'Manage Groups Locally'** setting on the Connector tab.

Please follow Atlassian's documentation for more details: <https://confluence.atlassian.com/crowd/configuring-an-ldap-directory-connector-18579550.html>

comments: author: N B
body: Thanks Bruno, looks promising. Only issue so far is that "synchronise to local cache" option fails with Java out of memory error, due to the fact the client is somewhat large and has 5000 to 10000 LDAP entries.

Is it possible to run this option 'Manage Groups Locally' without having to sychronise the LDAP DB to the local Crowd cache?


author: Bruno Vincent
body: Hi [@N B](/t5/user/viewprofilepage/user-id/1188433)

As stated in the documentation, the 'Manage Groups Locally' option is only available if the cache is enabled.

However, OutOfMemory issues in Crowd can usually be solved by increasing the value of the '-Xmx' Java option in *apache-tomcat/bin/setenv.sh* (or *setenv.bat* on Windows).

You might want to take a look at the following KB page: <https://confluence.atlassian.com/crowdkb/outofmemory-errors-in-crowd-224396874.html>


author: Craig Castle-Mead
body: Unsure if this is possible given your requirements, but you could look to filter down the groups using an ldap filter to either no groups coming from AD, or a subset of groups from AD, but still get all users. This would speed up the sync and then allow you to enable cache on the directory, and then manage the groups you want in Crowd but add the AD users to your Crowd groups.

if there is no way to restrict the AD groups coming in, adjust the xms/xmx as already suggested (probably worth reviewing this anyway)

CCM


author: Marcin Kempa
body: Hi [@N B](/t5/user/viewprofilepage/user-id/1188433),

You may also find this [Crowd webinar](https://www.atlassian.com/webinars/software/centralize-identity-management-using-crowd-data-center) interesting, which describes different deployment scenarios with Crowd as well as other topics like license optimization, SSO, High availability which you may find useful.

Best Regards,

Marcin Kempa


Tags: active-directory

ldap
Customer permission
Asked by Rajan Dangol:

Is it possible to allow customers to view tickets raised by others from the same organisation? Even if we have not setup any organisation group within Jira.


Answers:
author: Rebekka Heilmann _viadee_
body: Hi [@Rajan Dangol](/t5/user/viewprofilepage/user-id/5527757)

no - automatic sharing only works with JSM Organisations. If you consider all users from one Email domain "from the same organisation" you could sort them into Orgs automatically though.

Check out this article: [Automatically manage JSM customers and organizations at scale (atlassian.com)](https://community.atlassian.com/t5/Jira-Service-Management-articles/Managing-customers-and-organizations-on-Jira-Service-Management/ba-p/2677857)


Tags: cloud

jira-service-management

jira-service-management-cloud
Need to update a filed without altering the resolved/updated date - Jira Cloud
Asked by Selvakumar_ Shrinidhi:

I need to update a field for tickets that were resolved or closed a while ago, but I don't want them to appear as if they've been updated or resolved recently.

In Jira Cloud


Answers:
author: Connor
body: Hi [@Selvakumar_ Shrinidhi](/t5/user/viewprofilepage/user-id/5573122) if you're not updating the issue resolution than the resolved date shouldn't change. Updating any field on the issue will change the updated date though, that's unavoidable to my knowledge.


Tags: cloud

jira-service-management-cloud