youngmon/atlassian-qna huggingface dataset:
[Crowd] Impact of Slowloris (Slow HTTP DoS) vulnerability on Atlassian Crowd
Asked by Sameera Shaakunthala [inactive]:

We are going to use Crowd as the user management and SSO provider for several Atlassian applications (JIRA, Confluence, Stash, etc.). All these applications will connect to Crowd using HTTP protocol, and users will use the same to access their user profile using the same.

During a vulnerability assesment followed by manual verification we found that Crowd is vulnerable to Slowloris attack. I think that a successful attack may imapct the availability of all connected applications.

1. Are there any Crowd configuration best practices in place to mitigate the vulnerability?
2. A suggestion is to limit the number HTTP connections on client IP/host basis. Is this possible to with Tomcat?

*(this vulnerability is found in many other web applications as well, but Crowd is critical as it is the centralized authentication server - which is why I'm asking this question)*


Answers:
author: JustinK
body: This is more a problem with Tomcat and potentially the reverse proxy you have infront of Tomcat.

I would recommend that you follow the advice listed here:

[](http://security.stackexchange.com/a/52736)<http://security.stackexchange.com/a/52736>

For example placing Apache Httpd/Nginx infront of Tomcat and configure it correctly to block this type of attack vector.

comments: author: Sameera Shaakunthala [inactive]
body: Thank you!

That's helpful.


Tags: crowd-administration

http

security
Changing CROWD "Remote Addresses" through database?
Asked by Mike Monette:

Hi,

We just switched our network to a new range of IP's. I forgot all about adding this new range of IPs to crowd under "Remote Addresses" and now I am locked out.

I have made LDAP changes manually in the database by updating the stuff I believe in "cwd_directory_attribute"

Is there any table that keeps track of the remote addresses allowed to login? I would really like to just modify the existing IP address to be that of the new network.

I would really like to do this through the database because otherwise I need to give them the old network addresses, login, add the new network address to the "Remote Addresses" and then change all the IPs to the new network again.

Tanks for any help..


Answers:
author: Mike Monette
body: Got it. Funny, I have been looking for this on and off for a very long time. But right after asking the question, I finally find it.

It is in the crowd database under cwd_application_address

Hope it helps someone

comments: author: Caspar Krieger
body: Glad you got it sorted. For anybody else who runs into this, this is a manifestation of [CWD-2315](https://jira.atlassian.com/browse/CWD-2315); that issue has more information on fixing the problem, and you may like to vote on the issue to have the underlying cause fixed.

As always, if you have an urgent issue (e.g. you have been locked out of your production Crowd instance), please do not hesitate to [create a support issue](http://support.atlassian.com/) so our support team can help you resolve the issue.


author: Mike Monette
body: Yeah, another thing I started doing now to prevent this is adding the hostname of the servers under Remote Addresses.. I don't think localhost would work, but something that resolves to the IP you're hitting crowd on
how to install LDAP server plugin for Crowd
Asked by bbdigital:

I can't for the life of me figure out how to install this plugin, the instructions point me to a place that does not exist in my crowd control panel, I am running 2.7.1

[](https://marketplace.atlassian.com/plugins/net.wimpi.crowd.ldap.crowd-ldap-server)<https://marketplace.atlassian.com/plugins/net.wimpi.crowd.ldap.crowd-ldap-server>

Thanks.


Answers:
author: Guy Jarvis
body: The instructions are here:

[](https://github.com/dwimberger/crowd-ldap-server/wiki)<https://github.com/dwimberger/crowd-ldap-server/wiki>

going to be trying it myself...


author: Felipe Kraemer
body: Hello Lukas,

You cannot install this plugin because you're running Crowd 2.7.1 and the latest version of this plugin is only compatible with Crowd 2.2.2 to 2.6.5.

Please also note that this plugin is not supported by Atlassian because it's from a third-party. I would suggest you to get in touch with [the plugin vendor](https://marketplace.atlassian.com/vendors/1210579) and ask them what are their plans for this plugin, if they intend to release a newer version compatible with Crowd 2.7.1.

Kind regards,  
Felipe Kraemer  
Atlassian Support

comments: author: bbdigital
body: Thanks, I can see that it isn't compatible but I would like to try. It's just that I cannot find the place to install plugins in Crowd 2.7.1, has the option been removed?


Tags: crowd-administration
crowd 2.7.1 hangs when trying to login
Asked by chrisi:

when trying to login to crowd console, i get the login screen. after entering the credentals and submitting them nothing happens anymore. the browser hangs at j_security_check forever telling me it is waiting for data. after 90 min i killed the request. the last statement in the logs is:

```
ajp-bio-8109-exec-6 WARN [beans.factory.config.CustomEditorConfigurer] Passing PropertyEditor instances into CustomEditorConfigurer is deprecated: use PropertyEditorRegistrars or PropertyEditor class names instead. Offending key [org.codehaus.xfire.service.ServiceFactory; offending editor instance: org.codehaus.xfire.spring.editors.ServiceFactoryEditor@3213289a
```

also, my registered applications (jira, stash, bamboo etc.) are unable to connect so i cannot login to these apps as well.

any ideas?


Answers:
author: Ubique Manager
body: Same issue here. I could resolve it using Workaround 2 from <https://jira.atlassian.com/browse/CWD-3769>


author: Andy Nguyen
body: You may find some useful information from the following links:

* [A failure in a single DB connection causes deadlock in Crowd](https://jira.atlassian.com/browse/CWD-3768)
* [Adding a token to database causes transaction to lock indefinitely](https://jira.atlassian.com/browse/CWD-3769)


Tags: crowd-administration

login
Crowd Breaks on Boot when Other Apps are Installed
Asked by Robert Kennedy:

I currently have a Red Hat 64-bit server that I want to use for Atlassian products. I have installed Jira, Confluence, Bamboo, Crucible, Stash, and Crowd all on the same server. I have also created services to run each of these apps which run as non-privileged users.

If I install just Crowd and create a service for it, the application works flawlessly even after a reboot. If I install all of the applications (including Crowd), each with their own services, Crowd breaks after a reboot. To be more specific, when the server boots, Crowd results in a 404 apache-tomcat error. If I disable all of the services except Crowd and reboot, [](http://myserver:8095/crowd)<http://myserver:8095/crowd>successfully shows the login screen. It never progresses past this point though. I try to login with the local administator account, and it simply sits there...spinning. After this, Crowd is never the same and only a complete remove/re-install fixes the issue. That is, until you enable all of the services and Crowd breaks again.

Is there a limitation on how many Atlassian applications/services you can have on a system? Should Crowd be installed on a separate server? Or am I doing something wrong? Any help would be GREATLY appreciated.


Answers:
author: Tiago Comasseto
body: What happens if you start the applications using their built-in script file (bin/start-jira.sh, bin/start-confluence.sh, start_crowd.sh, etc)?

Also, each application use two ports, one is the port that you'll use to access the application in your browser (8095 by default for Crowd) and the other port is the control port that is used to shutdown the application. Both ports are defined into the *server.xml* file of each application.

Those ports need to be exclusive, you can repet the port number or the applications won't start. You may want to check that.

Cheers


Tags: crowd-administration
mod_authnz_crowd
Asked by Marcel Montel:

Does this set REMOTE_USER ?  

I have a application that runs a cgi (py) that needs to pick up the username that has signed in against crowd. Please advise


Answers:
author: FelipeA
body: Hi Marcel,

Yes it does.

This is an example of how it looks on the access_log:

172.16.28.1 - apache \[25/Mar/2014:18:48:04 -0300\] "GET /repositorio/ HTTP/1.1" 401 472 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:28.0) Gecko/20100101 Firefox/28.0"

172.16.28.1 - admin \[25/Mar/2014:18:48:08 -0300\] "GET /repositorio/ HTTP/1.1" 401 472 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:28.0) Gecko/20100101 Firefox/28.0"

As you can see, one access was made with apache user, and the other with admin user. With PHP you could retrieve the user with the variable $_SERVER \['REMOTE_USER'\]

Best regards,

Felipe Alencastro


Tags: apache

crowd-administration
Crowd : Disabling account locally but not in AD
Asked by Jerome Macaranas:

I need to disable some accounts in Crowd that are Active directory users but not disable them in AD.

On the documentation --\>

Crowd will synchronise the user status with Active Directory. If a user account is disabled in Active Directory, the user will be deactivated in Crowd, and reciprocally, if a user is deactivated in Crowd, the user account will be disabled in Active Directory. To prevent this synchronisation, use **Manage User Status Locally** in the 'Connector' tab.

I don't see **Manage User Status Locally** in the 'Connector' Tab.

Can someone provide me where I can configure "Manage User Status Locally"?


Answers:
author: Tiago Comasseto
body: Hi Jerome, this option is only available in Crowd version 2.7 onwards. You can see more details in this [link](https://confluence.atlassian.com/display/CROWD/Crowd+2.7+Release+Notes).

Cheers

comments: author: Jerome Macaranas
body: We have a lot of application running on top of crowd. Are we required to upgrade those application as well?

- bamboo

- crowd openid

- crucible

- google-aps

- jira

- stash

- opennms

- confluence


author: Tiago Comasseto
body: Openid is part of the Crowd packet, so it'll be upgrade when you upgrade Crowd. As for the other Atlassian applications, there is no need to upgrade them. The only thing is that I'm not familiar with opennms, I don't know this application, you may contact it's vendor and check this information.

Cheers
[Crowd] Migrating from Internal to LDAP Authentication
Asked by Sebastien Erard:

Years ago, we set up an Atlassian deployment (Jira, Confluence, Bamboo, Fisheye/Crucible, Crowd) completely integrated, but without any connection to our LDAP server.

Today, I'm asked to switch from an internal Crowd directory to a LDAP delegated authenticaton. Every Crowd user exists in our LDAP with the exact same username. Ideally, only the group membership shall be kept in Crowd, with the username definition and their password managed directly by the LDAP. As this solution does not seems to exist, delegated authenticaton is the way to go.

Is there an easy way to do so? I would think of the Crowd directory importer, but it requires that the password encryption are the same in both directory, though the goal of my operation is to drop the passwords...

Thanks for any help or suggestions.

PS: Currenty running Crowd 2.4, but an update is planned in the near futur.


Answers:
author: Caspar Krieger
body: This page details an (unsupported) work around for the problem of the encryption algorithms being different between an internal and delegated authentication directory: [](https://confluence.atlassian.com/pages/viewpage.action?pageId=391086175)<https://confluence.atlassian.com/pages/viewpage.action?pageId=391086175>

There's a few relevant feature requests you might like to vote on:

* [](https://jira.atlassian.com/browse/CWD-747)<https://jira.atlassian.com/browse/CWD-747>
* [](https://jira.atlassian.com/browse/CWD-910)<https://jira.atlassian.com/browse/CWD-910>
* [](https://jira.atlassian.com/browse/CWD-945)<https://jira.atlassian.com/browse/CWD-945>


Tags: crowd-administration

jira-service-desk
Crowd & Directory
Asked by Aur?lien Tertre:

We would like to declare a new directory in our crowd 2.3.3 console.

The new ldap is a Red hat Directory Server version xxx

What would be the best connector to use in our case?


Answers:
author: Caspar Krieger
body: Since [Wikipedia says](http://en.wikipedia.org/wiki/389_Directory_Server) that the Red Hat Directory Server is a rebranded version of the 389 Directory Server, which was formerly Fedora Directory Server, I would try "FedoraDS (Read-Only Posix Schema)", but that's just a guess.

You could also try "OpenLDAP" or "Generic LDAP Directory". Ultimately, try it on a staging server, and see what works well enough for your purposes.


author: Aur?lien Tertre
body: Thanks for your help, I will try those 3 Directories.

Best regards
Manually add crowd user to server
Asked by david martin:

I have just taken over the current confluence, jir, crowd suite. I was given a user and jira account by temp admin but just realized that neither of us has a crowd account. How can we manually create a user for the crowd system on the server itself?


Answers:
author: Jobin Kuruvilla [Adaptavist]
body: It is always good to have a local Crowd admin. [](https://confluence.atlassian.com/display/CROWDKB/Restoring+Passwords+To+Recover+Admin+User+Rights)<https://confluence.atlassian.com/display/CROWDKB/Restoring+Passwords+To+Recover+Admin+User+Rights>will help you identify existing admin account and reset it if needed.

comments: author: Caspar Krieger
body: Correct, this is the procedure you will want to follow to recover the admin password. If there is no admin user (which is possible but unlikely) then please [create a support request](https://support.atlassian.com) and our friendly support staff will step you through recovering your Crowd installation.


author: david martin
body: Thannk you all. I did get to see the users. the change the password statements errors when "`where` `id=<id ``from` `Stage 1>;" is etered it says error at from.`  


author: david martin
body: Well I login to postgres database and I'm not sure that got me any closer to having an admin crowd account. The system is woorking but I know the admin who left gave no turn over for that function. So does anyone know what I need to do now? Open a support ticket to have me walked thru getting a crowd admin account made or reset?

comments: author: Caspar Krieger
body: Following the instructions which Jobin linked to in his earlier answer will most likely solve your problem, but our friendly support team will be happy to help you out as well if you [open a support case](https://support.atlassian.com).


author: Rodrigo Girardi Adami
body: Hello David,

If Crowd doens't have the [Public sign up enabled](https://confluence.atlassian.com/display/CROWD/Public+Signup+Setup), I fear that only a Crowd Administrator can create the user for you.

OR, your user should be inside some of crowd directories inside the application.

I hope this helps!

Rodrigo

comments: author: Caspar Krieger
body: Public signup isn't going to help recover admin permission in Crowd; even if it was enabled for JIRA / Confluence such that users will be created in the internal directory which Crowd itself uses to authenticate users, it's highly unlikely that those newly created users would be authorised to access the Crowd admin UI (because such a setup is unnecessarily insecure; you wouldn't want a newly signed up member of the public to start administering your Crowd server).


Tags: crowd-administration
We are connecting Crowd with Active Directory.
Asked by abhishek mittal:

How can we ensure that user information is automatically created in crowd from Active directory automatically. Like when a new user is added in AD it automatically gets added in Crowd. Is it an out of box feature of Crowd. Or a customized solution would be required.

Thanks

Abhishek Mittal


Answers:
author: EddieW
body: That is the primary function of Crowd. Please read the documentation for basic "can it do this?" quiestions. If you run into issues, or unexpected behavior the community is here to help.

<https://confluence.atlassian.com/display/ALLDOC/Crowd+Documentation+Directory>


Tags: crowd-administration
[Crowd] What are the e-mail notification events?
Asked by Sameera Shaakunthala [inactive]:

According to the follwing article, Crowd sends e-mail notifications at \*specific events\*.

[](https://confluence.atlassian.com/display/CROWD/Configuring+your+Mail+Server)<https://confluence.atlassian.com/display/CROWD/Configuring+your+Mail+Server>

* What are these events?
* Does Crowd send out password expiry reminders? (for example, if password expiry happens in 14 days, remind the user to change the password)


Answers:
author: Caspar Krieger
body: Specific events is a slightly too general term to be useful. Crowd will send email when:

* To the user when a user requests a password reset
* To the user when a user has forgotten their username and requests that it be sent to their email address
* To the admin when users approach 90% of the license limit for the current license installed

Crowd does not currently email users when their passwords are about to expire. The best issue to vote on to get this added is [CWD-1765](https://jira.atlassian.com/browse/CWD-1765).


Tags: crowd-administration

email

notification
Virtual Agent
Asked by Indigo Duenas:

Hello,

My technical operations team is curious on utilizing Virtual Agent for automation for our help desk. I tasked myself with navigating this advancement, but after reviewing the Atlassian beginner guide. I am still having trouble access the virtual agent platform. I am an admin and I do have a decent idea of how to get started with building it, but cannot find out how to actually get to it. The options for virtual agent do not populate when I start a new project. Any guidance on what I am doing incorrectly?

Best


Answers:
author: Jack Brickey
body: Hi [@Indigo Duenas](/t5/user/viewprofilepage/user-id/5555302) , welcome to the community.

It appears that the link you provided was in accurate so it has been removed so as not to confuse others and adhere to Community guidelines. You might want to check the documentation started here -[use-the-virtual-agent-in-your-portal](https://support.atlassian.com/jira-service-management-cloud/docs/use-the-virtual-agent-in-your-portal/)


Tags: atlassian-support

cloud

jira-service-management

jira-service-management-cloud
JSM Status Name on Customer Portal
Asked by Francesco Carullo MMS:

Hi,

I have renamed some statuses in order to show customers "in progress" status for all the statuses that have different meanings just for the agents.

![statuses.png](/t5/image/serverpage/image-id/338543iB8B0A5CEF7FED446/image-size/large?v=v2&px=999 "statuses.png")

The visible status to customers in their request is correct ("in progress"), but the filter in the requests panel shows all of them:

![filter.png](/t5/image/serverpage/image-id/338542i48A0247748747BFD/image-size/large?v=v2&px=999 "filter.png")

Is it possible to hide these statuses also here?

Thanks

Francesco


Answers:
author: Hans Polder
body: [@Francesco Carullo MMS](/t5/user/viewprofilepage/user-id/5436246) ,

Not to my knowledge. The feature was designed to simplify the statuses shown to end customers. I believe your agents should still be able to see all statuses... Or you would need to simplify the workflow itself (which is not the right call, I would say).

If you need a simple filter to catch all 'In Progress' statuses, you could do a regular Issue Search using JQL "statusCategory = "In Progress". I don't believe this is possible within the queue itself.

comments: author: Francesco Carullo MMS
body: Hi Hans,

thanks for your reply. Probably my explanation wans't clear, I'll try again.

My agents are just fine, no issues in their visualization.

I'm referring to the filter that is visible in the customer portal, where cutomers can see all their requests. I mean, the status in each single requests is correct (always "in progress"), but in the requests panel there's a filter that shows all the statuses, also the ones that are supposed to be hidden to the customer. I'd like these additional statuses that are visible in the request panel to be hidded, just like in the request itself.

Thanks

Francesco


author: Hans Polder
body: [@Francesco Carullo MMS](/t5/user/viewprofilepage/user-id/5436246) ,

Apologies, you're totally right! I skimmed through the screenshots as I don't understand Spanish, but I should have noticed this was still the customer portal side.

I agree, this is not really logical. In my test environment I see the same (and actually ALL the statuses in all the workflows that are used in all service projects, as it seems. I would use the 'Give Feedback' button in your service project to provide this feedback to Atlassian, as I wouldn't know an option to change this behavior (other than actually changing your workflow itself)


Tags: cloud

jira-service-management

jira-service-management-cloud
How do i change dashboard owner?
Asked by Christopher:

I have JSM Data Centre. I have a dashboard with an owner who has left the company. How do I change it? I can only see the option to edit Viewers and Editors. I am a Jira Admin.


Answers:
author: Hans Polder
body: [@Christopher](/t5/user/viewprofilepage/user-id/4431985) ,

In DataCenter you can overrule a Dashboard Admin as follows:

1. Go to the cog wheel icon on the top right (Settings)
2. Choose 'System'
3. Go to 'Dashboards' on the left menu
4. Search the dashboard in question (search works a bit wonky, if needed put items between "" to find specific dashboard names. If you don't search for the full name, include % in front and at the back of the query to find all related dashboards.
5. Via the cog wheel icon on the right of any dashboard, you can choose 'Change owner'

Same also applies to changing **Filter** owners - just choose 'Filters' in the right menu when opening 'System Administration'.

comments: author: Christopher
body: Thank you, this is the correct answer.


author: Alain Kovacs
body: Hi [@Christopher](/t5/user/viewprofilepage/user-id/4431985) ,

I don't have access to a DataCentre instance, but I don't see why it would be too different. In Cloud, this is how it looks like.

If you can't see this option, do you have an Org admin? Can he see this option?

![1.png](https://community.atlassian.com/t5/image/serverpage/image-id/338544i35104B2D3241ECA7/image-size/large?v=v2&px=999 "1.png")

Later Edit: I can see that that option is only available for my own dashboards, so I could change the assignee myself, in this case, you might need an Org Admin to impersonate the user, and then assign the dashboard to somebody else.

comments: author: Christopher
body: Hi, I do not have that option. I am full and complete Admin.


author: Alain Kovacs
body: Later Edit: I can see that that option is only available for my own dashboards, so I could change the assignee myself, in this case, you might need an Org Admin to impersonate the user, and then assign the dashboard to somebody else.


author: Hans Polder
body: This is not needed - see my other response.

Keep in mind that when Jira instances are linked to an AD, an account could actually be deactivated, making it questionable if you can impersonate a user successfully.


Tags: jira-service-desk-data-center

jira-service-management

jira-service-management-data-center