Authenticate Azure AD users against Crowd and Atlassian products
Asked by Alae Loudiyi:

Hi,

I have connected Crowd with Azure AD (AAD) without any problem. But when It came to authenticating Azure AD Users againt Atlassian products (Mainly Jira, Confluence \& Bitbucket) we are having some trouble. First I cannot give users access to Jira or Confluence and I cannot create local groups or use groups to assign permissions to users.

We have gone through some documentation and I have some questions:

1. Is it possible to authenticate AAD users against Atlassian Products without any other third party plugin? if YES HOW? if NO what is the benefit from connecting AAD to crowd without being able to delegate authentication to AAD?
2. I have seen that Microsoft have a free add-on for Jira ([link here](https://azuremarketplace.microsoft.com/en-ca/marketplace/apps/aad.msjira?tab=Overview)). If the answer to the first question is NO, do you think it is a viable alternative to use this plugin with Jira and then connect other Atlassian Products to Jira without using Crowd.

PS: I'm using crowd 3.2.1 and I will upgrade to the latest version because we are facing a bug ([link](https://jira.atlassian.com/browse/CWD-5192?_ga=2.109860098.609312360.1532272046-1338725805.1531831270))

thank you


Answers:
author: M Amine
body: Hi,

The issue has been resolved now and here is how:

1. Upgrade to crowd 3.2.2 as it fixes this [bug](https://jira.atlassian.com/browse/CWD-5192)
2. [Documentation](https://confluence.atlassian.com/crowd/configuring-azure-active-directory-935372375.html) is a 'bit' wrong, especially here 5. Configure permissions for the native application to allow Crowd to validate user credentials:  
   > - Click your native application.  
   > - Click Settings  
   > - In the API ACCESS section, click Required permissions.  
   > - **Click Grant Permissions and confirm.**
   **B**efore cliking 'Grant Permissions' and confirming, we Added Windows Azure AD API permissions (Read directory Data, Sign in and read user profile ...)
3. We validated these permissions as described in step 6 in this [link](https://www.cleito.com/products/odcc/documentation/)

et voila. That's it.

Hope that Atlassian Team [@Gaurav](/t5/user/viewprofilepage/user-id/1177576) will update this [documentation](https://confluence.atlassian.com/crowd/configuring-azure-active-directory-935372375.html).

cheers

comments: author: Patryk
body: Hello Mohammed,

Are you certain that it was the native application that requires those rights? The permissions for the native applications are permissions for executing actions on Azure Active Directory, which is a capability that Crowd does not use. I've set up a test directory a moment ago without any additional permissions on the native application and didn't run into permission issues.

However since some Azure AD requires that "Grant permissions" is executed both on the web application, as well as the native one.

Best regards,

Patryk Petrowski


author: M Amine
body: Hi [@Patryk](/t5/user/viewprofilepage/user-id/833066),

Absolutely certain. Because before doing that I have clicked on Grant Permissions and confirmed for several times and the issue was the same as described.

Then I added the API permissions and it worked.

Let me know if you need more info or screenshots.

best regards


author: Carl Pelletier
body: Hi, I configure Confluence to validate authentification with SAML/azure Ad. Done

I configure crowd a a Confluence directory. Done

I configure in Crowd a Azure directory to fetch users/groups from Azure Ad. Done

Now my question:

When a user authenticate to Confluence, The browser call Azure and the authentification is done. The token is send back to Confluence. Confluence validate if the user exist in the directory(Crowd). I

Is there a Communication with Crowd at this moment ? I guess that yes. What is sent to Crowd ? The user identifier? No password ?

How Crowd validate that user with the Azure Directory ?

Can you explain please? A communication flow diagram will be nice!

Thanks

Carl


author: Carl Pelletier
body: Hi, the configuration section have change in Azure Ad. Can someone point me to the same configuration now?

`API ACCESS` section, click **Required permissions** . doesnt exists or I cant find it.

thanks

comments: author: Gaurav
body: Hi [@Carl Pelletier](/t5/user/viewprofilepage/user-id/3533558) ,

Here's the documentation from Microsoft regarding what are the UI changes and how they relate to old one.

<https://docs.microsoft.com/en-us/azure/active-directory/develop/app-registrations-training-guide#required-permissionsapi-permissions>

You can keep following the Crowd's Azure integration documentation, and see the corresponding changes in this link regarding how to grant permissions.

We will be updating the Crowd's documentation as well.

Let me know if you need anything else.

Cheers!

Gaurav


author: Carl Pelletier
body: Hi [@Gaurav](/t5/user/viewprofilepage/user-id/1177576) Thanks for the quick answer!. It's now more clearer for me.

Can you tell me what grant I should give if I want Crowd to be able to authenticate my Confluence users with sso?

Thanks!


author: Gaurav
body: Hi Alae,

I would like to know why you cannot give users access to Jira or Confluence, you can configure Jira or Confluence applications in Crowd, and allow these applications to authenticate against your Azure Active Directory or a set of selected groups from the directory.

Though you can't create groups in Azure AD using Crowd, you can create them in Azure AD itself, and then use the groups to control access for applications in Crowd.

Coming to your question:

Yes, it is possible without any third party plugin. Please follow the documentation to [configure Azure AD in Crowd](https://confluence.atlassian.com/crowd/configuring-azure-active-directory-935372375.html?_ga=2.23016571.1398445006.1532285796-59502074.1529911040), or skip this if you have already successfully connected to Azure AD and follow this documentation to [connect JIRA to Crowd](https://confluence.atlassian.com/crowd/integrating-crowd-with-atlassian-jira-192625.html)

Hope this helps, if not, please list out the problems in detail what you are facing.

comments: author: Alae Loudiyi
body: Dear Gaurav,

Thank you vm for your quick feedback. I will first upgrade Crowd because 3.2.1 is having some issues getting users' groups from Azure AD.

Will let you know after the upgrade.

Keep you posted.


author: KO89
body: Alae,

Any luck with this task?


author: KO89
body: Disregard, just noticed that Azure MFA can't be used with Crowd soooo... i'll have to take a different route