youngmon/atlassian-qna huggingface dataset:
very slow authentication to Crowd 2.7.2
Asked by Bryan Karsh:

Hi,I have crowd 2.7.2 and mysql 5.1 on the same linux (rhel6) server. We have several applications linking to it just fine.In the past year or so, I noticed authentication to the crowd gui itself with my admin credentials take 1-5 minutes... and if I am inactive for 30 seconds or so, I have to repeat this hellish login.Had the same issue with crowd 2.6 - though it hasn't always been this bad. I haven't upgraded the mysql DB.Note: I thought it might me a reverse dns lookup issue . But nope , mysql is not performing reverse dns lookup. Heap settings look good on crowd application . Mysql user grants are not using hostnames..but localhost or specific up addresses.I'm stumped . Is this some mysql issue? We have several directories , only one is ldap though... an active directory connection to an ADAM server .. which has worked fine for years. Our user base, including disabled users, is under 4000. Any tips much appreciated . Makes admin tasks in crowd a nightmare.


Answers:
author: Caspar Krieger
body: Please raise a support case at [](https://support.atlassian.com)<https://support.atlassian.com>and our friendly support team will help you collect information and troubleshoot based on your configuration and logs. (This QA site isn't well suited to back and forth troubleshooting due to its public nature.)

comments: author: Bryan Karsh
body: Thanks - I did. I will post if anything interesting comes out of it.


author: Bryan Karsh
body: This is a provisional answer: When I granted all privileges on the crowd mysql user, the problem went away. Perhaps I was missing a necessary permission. Still need to see how it plays out though. :)

comments: author: Bryan Karsh
body: actually -- scratch that. Still encountering issue.


Tags: dns

login

mysql
How to enable SSO in jenkins using crowd
Asked by Manjul Srivastava:

I have integrated crowd and jenkins using crowd 2 plugin in jenkins, and centralized user management using crowd is working.

But i am stucked with SSO functionality.


Answers:
author: Manjul Srivastava
body: I have set session validation to 0. Now its working fine

comments: author: Markus
body: didn't help for me :(


author: Nic Brough -Adaptavist-
body: "It doesn't work" is not really very helpful as a question. You need to give details. What have you configured? What are the symptoms? What documentation did you follow and where did you do things differently from what the docs said? What do your logs say?

comments: author: Manjul Srivastava
body: Hi Nic,

I have crowd and jenkins on same machine at ports 8095 and 8090. On jenkins i installed crowd 2 plugin.

I have set machine's IPAdress as sso domain in crowd.

I copied main library crowd-integration-client-2.7.1.jar and all other supporting jar from crowd's client folder to jenkins's WEB-INF/lib folder.

I copied crowd.properties file from crowd's client/conf folder and paste it into WEB-INF/classes and edit it with details

application.name jenkins

application.password jenkins

application.login.url <http://IP:8090>

crowd.server.url <http://IP:8095/crowd/services/>

crowd.base.url <http://IP:8095/crowd/>

session.isauthenticated session.isauthenticated

session.tokenkey crowd.token_key

session.validationinterval 2

session.lastvalidation session.lastvalidation  
And done all configuration in jenkins's crowd part in security section.  
enable SSO  
set cokie.domain with IPAdress of machine  
set cokie.tokenkey as crowd.token_key  
After all these configuration i restart my jenkins  
Now, problem that i am facing is when ever i login in or logout from jenkins it get reflects on crowd but when ever i do the same in crowd it do not get reflected on jenkins. Users are same.


author: Manjul Srivastava
body: Basically, i noticed that session created for any jenkins user do not get expire with other atlassian tools when someone logout from jira/stash/any other atlassian tool.

But when i logout from jenkins it get reflected on other tools.


author: stuartej
body: is this officially documented anywhere?My jenkins deployment runs with the following/usr/bin/java -Dcom.sun.akuma.Daemon=daemonized -Djava.awt.headless=true -DJENKINS_HOME=/var/lib/jenkins -jar /usr/lib/jenkins/jenkins.war --logfile=/var/log/jenkins/jenkins.log --webroot=/var/cache/jenkins/war --daemon --httpPort=8082 --ajp13Port=-1 --debug=5 --handlerCountMax=100 --handlerCountMaxIdle=20 --prefix=/jenkinsThe war file is managed by RPM from Jenkins LTS, i assume on restart it unpacks it into the /var/cache/jenkins/war directory, however my concern is it is only cache directory and on shutdown/restart/update any changes i may apply could get blitzedI assume the proper location to put these auxilary components would be somewhere in /var/lib/jenkins
Crowd administration console expired maintenance message - how to update?
Asked by Bobbie Rumfola:

Crowd administration console is displaying a message that our maintenance period has expired but yet the maintenance was renewed. How do I get this updated?


Answers:
author: Bobbie Rumfola
body: Hooray Atlassian responded! Maintenance is up to date and was finally able to update the license on server.


author: Bobbie Rumfola
body: Update: Opened a support ticket with Atlassian on June 20 to follow-up on confirmation of maintenance payment. No response from Atlassian as of July 3. Are there any other avenues to pursue this type of problem with Atlassian?


author: Nic Brough -Adaptavist-
body: If you are using OnDemand, it should have been done automatically - check your account and then raise it at [support.atlassian.com](http://support.atlassian.com)

If you're on your own system, go to your Atlassian account, find the licence key, copy and paste it into the licencing section in your Crowd system's admin section


Tags: crowd-administration
Getting timeout error while adding crowd directory to Confluence
Asked by Jenin Mohan:

Hello Folks,

I am trying to add a crowd directory to confluence and I am getting the below error:

Connection test failed. Response from the server:  
org.apache.commons.httpclient.ConnectTimeoutException: The host did not accept the connection within timeout of 5000 ms

Now, I checked logs for both crowd and confluence and I found nothing in the logs, no errors.

Then there is one thing that there is no connectivity between crowd host and confluence host as both are on different servers. I am not able to ssh from crowd host to confluence host and vice versa. Could this be the reason for the timeout error?

Though, we have a similar situation with Jira and Fisheye where both are installed on different servers but still we can see fisheye commits on Jira.

Thanks and Regards,

Jenin Mohan


Answers:
author: Caspar Krieger
body: Different servers should be fine, but you do need to have general connectivity between them. SSH access from one to the other is not strictly necessary, but try curl'ing your Crowd server's http address (e.g. [](http://mycrowdserver:8095/crowd)<http://mycrowdserver:8095/crowd> from your Confluence server - that should work.

If it doesn't, follow the normal steps to troubleshoot that kind of connectivity problem (check firewalls, etc).

comments: author: Jenin Mohan
body: It was eventually a firewall issue. Got it fixed now.

Regards

Jenin Mohan


Tags: crowd-administration
SSO is not working on Apache with Crowd V2
Asked by Chaithra N:

We have a crowd configured for SSO for jira \& confluence \& it is working seamlesly. Now the same had to be enabled for SVN ( Centos V5.7)

Using crowd connector, we are able to do Authentication \& Autherization but SSO is not working.

Can any one please help on this ?

Config details:

SVNPath /etc/subversion/jiraxyz

AuthName "Atlassian Crowd"

AuthType Basic

AuthBasicProvider crowd

CrowdSSLVerifyPeer off

CrowdAppName svnapache

CrowdAppPassword xxxxx

CrowdURL <http://xyz:8095/crowd/>

Require valid-user


Answers:
author: Caspar Krieger
body: You should make sure your svn is in the same domain as your JIRA, Confluence \& Crowd.

If that's already the case, it's probably best to open a support ticket at [](https://support.atlassian.com)<https://support.atlassian.com>so that our friendly support team can help you troubleshoot in a secure environment.


Tags: svn
Enforce password policy in Crowd
Asked by Steve Gargan:

I've been searching for a way to enforce strong passwords in Crowd but have come up short. Is it possible to enforce a policy either through crowd itself or a plugin?


Answers:
author: Tiago Comasseto
body: In Crowd internal directory you can define a regex to increase the password complexity (see [here](https://confluence.atlassian.com/display/CROWD/Configuring+an+Internal+Directory)), in case you're using an LDAP, you should set this configuration directly there.

Cheers


Tags: password
crowd upgrade on linux fails
Asked by Bruce Clegg:

We unsuccessfully attempted to upgrade crowd to 2.7.2

I feel like we followed the instructions carefully, and tailing the apache-tomcat.catalina.out log file, it shows it coming up (eventually) - but we cannot access on port 8080

I'm very new to Atlassian, so I'm not sure the best way to ask this question.

here is the server.xml file:

\<?xml version="1.0" encoding="UTF-8"?\>  
\<Server port="8020" shutdown="SHUTDOWN"\>  

\<Service name="Catalina"\>  

\<Connector acceptCount="100" connectionTimeout="20000"   
disableUploadTimeout="true" enableLookups="false"   
maxHttpHeaderSize="8192" maxThreads="150"   
minSpareThreads="25" port="8095" redirectPort="8080"   
useBodyEncodingForURI="true" URIEncoding="UTF-8"/\>  

\<Engine defaultHost="localhost" name="Catalina"\>  
\<Host appBase="webapps" autoDeploy="true" name="localhost" unpackWARs="true"/\>  
\</Engine\>  

\<!-- To connect to an external web server (typically Apache) --\>  
\<!-- Define an AJP 1.3 Connector on port 8009 --\>  
\<Connector port="8080"   
redirectPort="8080"  
enableLookups="false"   
protocol="AJP/1.3"   
scheme="https" secure="true"  
clientAuth="false" sslProtocol="TLS" SSLEnabled="true"  
URIEncoding="UTF-8"  
keystoreFile="/opt/data/aviva/ssl/.keystore" keystorePass="hmpssl" /\>  

\</Service\>  

\<!-- Security listener. Documentation at /docs/config/listeners.html  
\<Listener className="org.apache.catalina.security.SecurityListener" /\>  
--\>  
\<!--APR library loader. Documentation at /docs/apr.html --\>  
\<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" /\>  
\<!--Initialize Jasper prior to webapps are loaded. Documentation at /docs/jasper-howto.html --\>  
\<Listener className="org.apache.catalina.core.JasperListener" /\>  
\<!-- Prevent memory leaks due to use of particular java/javax APIs--\>  
\<Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" /\>  
\<Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" /\>  
\<Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" /\>  

\</Server\>

What else can I show you that might help solve this?


Answers:
author: Bruce Clegg
body: I've opened a ticket with Atlassian support on this - once there is a resolution, I will post it here. Possibly with a better description of the problem.


author: Jobin Kuruvilla [Adaptavist]
body: Are you using a proxyName? What happens when you do wget on localhost:8080/crowd from the server itself?


author: Bruce Clegg
body: Thank you for your quick response -

Port is not blocked - when we 'roll back' to the previous version (2.4 I think) by renaming the folder, we can get in just fine to that port.


author: Jobin Kuruvilla [Adaptavist]
body: Is the port blocked on linux? Maybe stop iptables if it is running and check after that? Another thing is to check if selinux is enabled or not.


Tags: crowd-administration
How can I allow both username and email address during login with Crowd in Spring?
Asked by Mohiuddin Ahmed:

How can I configure crowd with spring so that I can allow both username \& email address during user login?


Answers:
author: Caspar Krieger
body: You'd have to subclass (or copy paste \& modify) one or more of the existing Crowd spring integration classes to do a search to find users by email if no user was found when searching by username.

Note that the integration (and the rest of Crowd) doesn't allow logging in with email by default because Crowd doesn't enforce unique email addresses across applications (which would be tricky to do because an application can have multiple directories, some of which may contain the same user with the same email under different usernames - currently that's legal but it would be ambiguous if we tried to enforce email uniqueness).


Tags: security

spring
Is Apache server required for Crowd Single sign on (SSO) installation ?
Asked by cybage_bitbucket:

Doing the Crowd SSO installation for different **Atlassian**products like JIRA,Bamboo,Confluence etc for Single sign on.

But having one query i.e. if Crowd independently manage SSO or it require the Apache server installation to support this feature.

Please provide answers with facts.


Answers:
author: cybage_bitbucket
body: Hi

Do we need Domain names config for doing SSO setup for Crowd and JIRA?

[](https://confluence.atlassian.com/display/CROWD/Integrating+Crowd+with+Atlassian+JIRA)<https://confluence.atlassian.com/display/CROWD/Integrating+Crowd+with+Atlassian+JIRA>;) )

regards

comments: author: Caspar Krieger
body: Yes, you need a shared domain. E.g. [jira.example.com](http://jira.example.com)and [crowd.example.com](http://crowd.example.com), but not [myjira.com](http://myjira.com)and [mycrowd.com](http://mycrowd.com).


author: cybage_bitbucket
body: Thanks Caspar

We want to design our SSO and User authentication using Crowd server \& integrate with JIRA and Stash servers.

In Crowd we have Users profiles and we want to have SSO for JIRA and Stash users.

Do we need this? 1) how do we set Domain names ? 2) how we design our Topology for Crowd, JIRA and Stash?

what should be the IP address and Ports ? for Crowd, JIRA and Stash servers?

Can you please Guide us on this solution, Thanks.

regards

comments: author: Caspar Krieger
body: If you follow the instructions I linked to, it will work. IP address and ports won't make a difference for SSO, as long as you have a consistent domain across all your properties. If you need further guidance (problem analysis, solution design \& implementation, etc) then I suggest you contact one of our [expert partners](https://www.atlassian.com/resources/experts).


author: Caspar Krieger
body: No, Crowd does not require Apache in order to provide single sign on across Atlassian applications.

(I'm a Crowd developer, but in case you don't trust me, here's our documentation on e.g. connecting JIRA: [](https://confluence.atlassian.com/display/CROWD/Integrating+Crowd+with+Atlassian+JIRA)<https://confluence.atlassian.com/display/CROWD/Integrating+Crowd+with+Atlassian+JIRA>;) )

You *only* need Apache if you'd like to integrate subversion access using Apache (or something else with Apache) *and* you want to use the Crowd Apache connector to authenticate users in Apache according to Crowd's userbase. Or to put it another way: you only need Apache if you want to integrate Apache, so if you don't want to use Apache, you won't need Apache. (That's a lot of "Apache"!)


Tags: sso
How to map new user attibute added on Crowd to LDAP user attribute?
Asked by G2G JPSupport:

Hi,

Our customer who uses Crowd 2.5.x finds he can add new attribute from Crowd console "User Attributes" in "Specifying a User's Attributes" ([https://confluence.atlassian.com/display/CROWD/Specifying+a+User%27s+Attributes](https://confluence.atlassian.com/display/CROWD/Specifying+a+User%2527s+Attributes)).

Then he wants to know how to map added new attribute to the user attributes of LDAP. For example, if he adds new attribute named "phone" on Crowd, he wants to map this to "mobile" atttribute of "inetOrgPerson" in LDAP.

Thank you in advance,

G2G Japan.


Answers:
author: Caspar Krieger
body: This isn't possible in Crowd right now. Please vote on [](https://jira.atlassian.com/browse/CWD-2417)<https://jira.atlassian.com/browse/CWD-2417>if you'd like to have this feature added.


Tags: ldap
How to show distribution group in Crowd for Directory only.
Asked by John Zhang:

I know it only show security group if I set Group Object Filter as "(\&(ObjectCategory=Group)(!(proxyAddresses=\*))) " in the configuration of Crowd's Directory. But now, I'd like to show distribution group, not security group.


Answers:
author: Tiago Comasseto
body: Hi John, the filter (ObjectCategory=Group) is suposed to include all kind of groups in MSAD, I've just tested this filter here with Crowd and it pulled distribution groups just fine.

Cheers

comments: author: John Zhang
body: Thanks for your reply. But I'd like to show distribution group only only only, not security group.


author: Tiago Comasseto
body: Hi John, sorry for the confusion, this should bring only distribution groups (more details can be found [here](https://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx?Sort=MostRecent)):

(\&(objectCategory=group)  
(!(groupType:1.2.840.113556.1.4.803:=2147483648)))

Cheers


author: John Zhang
body: Fine, thanks awfully.


author: Tiago Comasseto
body: I'm happy to help ;) you may mark this question as answered if you think it was answered satisfactorily. This will increase the visibility of the question and may help other people in the future.  

Cheers


Tags: crowd-administration
Invalid login error
Asked by Shravanthi Sudarshana:

I have integrated jira and confluence instances with crowd. Both applications are using crowd as their authentication mechnism(delegated ldap directory) . However none of confluence administators or jira administrators are able to login to crowd console(using ldap credentials). It gives an invalid login error and crowd log shows only 'user attempted to login with incorrect credentials' . I tried to do authentication test in directory section and it gave a successful verification message.

I found a n article which shows a similar issue [https://confluence.atlassian.com/display/CROWDKB/Can't+Log+Into+Crowd+SSO+Due+To+Invalid+Domain+Property](https://confluence.atlassian.com/display/CROWDKB/Can%27t+Log+Into+Crowd+SSO+Due+To+Invalid+Domain+Property)

I set SSO domain to 'hostname' because my crowd link is [](http://hostname:8095/crowd.)<http://hostname:8095/crowd>. After the changes made, it did not let confluence/jira administrators log in using ldap credentials. It did not let admin also log in so i had to delete domain property from database.

Can someone please help me figure out as to why none of the users are able to login to crowd console using their confluence/jira credentials(ldap) ? (even though both are integrated with crowd)


Answers:
author: Shravanthi Sudarshana
body: Hi All,

Thanks for your suggestions. The issue i had was because i had not added Jira/confluence directory under crowd application. Hence all users in jira/confluence were not able to login to crowd but they were able to login to jira/confluence. Once i added the directory, it worked fine!

I am still using evaluation version of crowd. Once we complete the testing, we will buy the licensed product. I will surely keep an eye on user limit.

Thanks!


author: Tiago Comasseto
body: Hi Sharavanthi, Crowd has its own application under the Applications tab. The confluence administators and jira administrators need to be able to authenticate in this application in order to log in Crowd.

Cheers

comments: author: Shravanthi Sudarshana
body: The confluence and jira administrators are present in userlist of suitable applications in crowd. they are able to autheticate successfully as well in authentication test of application tab. However they cannot login to crowd console using ldap credentials. It gives an invalid login error. i can only login to crowd console using admin credentials as it belongs to internal directory


author: Caspar Krieger
body: That sounds like a bug then; I suggest you open a support issue at [](https://support.atlassian.com)<https://support.atlassian.com>so our support staff can help you confirm the issue.


author: Tiago Comasseto
body: Shravanthi, you may need to check if you have excided your [Crowd license](https://confluence.atlassian.com/display/CROWD/Licensing) limit. If it happened, no one, except the Crowd internal admin, will be able to login.

Cheers


Tags: crowd-administration
Can Crowd perform authentication for multiple instances of Confluence and JIRA?
Asked by BruceK:

I have a situation where I would like to run multiple instances of JIRA and Confluence and I'm wondering if Crowd is capable of handling this situation. More specifically if I have Confluence running on two different servers can I provide SSO to both Confluence instances and restrict some users to only one instance of confluence?


Answers:
author: Mirek
body: Hi Bruce,

Yes you can. However as I remember the accumulated number of users would count towards to your Crowd license.

See this diagram. It might be usefull for you:

[](https://confluence.atlassian.com/download/attachments/311920408/image2012-10-15%2012%3A37%3A15.png?version=1&modificationDate=1352499228403&api=v2)[https://confluence.atlassian.com/download/attachments/311920408/image2012-10-15%2012%3A37%3A15.png?version=1\&modificationDate=1352499228403\&api=v2](https://confluence.atlassian.com/download/attachments/311920408/image2012-10-15%252012%253A37%253A15.png?version=1&modificationDate=1352499228403&api=v2)

-Mirek

comments: author: Caspar Krieger
body: (Your link is broken Mirek)


author: Caspar Krieger
body: (A few typos which I can't seem to correct via the editing functionality there, but you get the idea.)


author: Caspar Krieger
body: To expand a little on Mirek's answer, you can also have separate sets of users who can be authenticated to each instance of Confluence and JIRA if you like (or they can share the same userbase).

Crowd handles this with the concept of potentially multiple directories (e.g. your corporate LDAP directory, a crowd internal directory, etc) which you can map to applications (1 instance of JIRA would have be 1 application in Crowd), and then for each directory mapped to an application you can choose which users can authenticate to each application by choosing groups for each directory (or allowing all users in that directory to authenticate with the application).


author: BruceK
body: One other question. Since only a URL is required in Crowd can the url target a Confluence instance that is OnDemand?

comments: author: Caspar Krieger
body: No, there's no way to configure Confluence in OnDemand to talk to your behind-the-firewall Crowd instance. In my *opinion*, it's unlikely we'll add that feature in the short-medium term, because most customers who run an instance of Crowd are relatively large and usually that goes hand in hand with not wanting their data in other companies' clouds (I am a Crowd developer, but this is my personal opinion).


author: BruceK
body: If you cut and paste it into the browser window it works

comments: author: Caspar Krieger
body: Fair enough!
How to sync disabled Active Directory User in JIRA service management
Asked by Muhammad Ali Khan:

I have sync active directory in JIRA but the problem is if a user account is disabled it is not appearing in "Reporter" field...If we receive a request from a user whose account is inactive so how we can put his/her name in "Reporter" field


Answers:
author: Trudy Claspill
body: Hello [@Muhammad Ali Khan](/t5/user/viewprofilepage/user-id/5460324)

The user's account needs to be activated and they need to be granted access to JSM as a Customer.


Tags: cloud

jira-service-management

jira-service-management-cloud