youngmon/atlassian-qna huggingface dataset:
How to implement SSO between Typo3 + Jira + Confluence?
Asked by Klaus_Kruse:

Hi,

I'm looking for a possible solution to integrate a Typo3 frontend with Atlassian products. The idea is, that Users login into Typo3 and go from there to Jira or Confluence without logging in again.

So far, I think there are two solutions:

1) Authenticating against CrowdID: Users would login in Typo3 after authenticating against CrowdID. But I'm not sure, that this provides SSO experience. According to an [older question](/t5/JIRA-questions/How-can-I-configure-Confluence-to-user-CrowdID-to-authenticate/qaq-p/48727), no

2) Implementing login hook in Typo3 to retrieve cookie via REST API

Has anybody implemented this setup or a similar solution with another CMS? I'm curious about what's the typical way of implementing kind of a portal with SSO.

Thanks in advance!


Answers:
author: Jack Nolddor [Sweet Bananas]
body: Hi Klaus,  

Have you got any idP (Identity Provider) such as ADFS, Azure AD, Okta, Google Apps/GSuite, OneLogin... configured?  

If so, the easier approach is to install miniOrange SSO complement in both Type3 and Atlassian applications, see:  

- [Single Sign On (SSO) for TYPO3](https://www.miniorange.com/typo3-single-sign-on-(sso))

- [miniOrange \| Atlassian Marketplace](https://marketplace.atlassian.com/vendors/1213308/miniorange)

Hope this helps  
Regards


Tags: confluence

jira

rest-api

sso
Is OAuth (Impersonation) with crowd not enough anymore for SSO??
Asked by PRISMA Computer GmbH:

We have following setup:

* jira + confluence on 1 Server with 2 tomcat instances.
* the aplications are using the context /jira and /confluence
* confluence uses jira user directory with type crowd. synchronisation is successful.
* user access both applications via reverse proxy. reverse proxy is setup correctly, using it's own proxy connector in both apps. healthchecks are ok.
* both applications are linked to eachother by OAUth (impersonation) and green (linked). (Internal linked by localhost, shown URL is the proxy URL)

Quite normal setup. As far as I can remember, I'd say SSO worked before upgrading jira to 7.3.3. After upgrade users have to login twice. Did I something wrong or is this intended behaviour with 7.3.3??


Answers:
author: PRISMA Computer GmbH
body: PS: confluence and jira logs don't show any error regarding oauth. otherwise I had a point to start from to follow the documentation.


Tags: oauth

sso
Atlassian CROWD REST API for "Associating/linking a Group to application"
Asked by babu:

Hi ,

We are not able to find any REST API for associating/linking a already existing group to a application.

For example, we have a group and a application.Now we want to associate/link this group to the application (equivalent to 'adding' the group in "groups' tab in the application.

Please clairfy if there is any API.

Note: "add" group REST API is infact just creating the GROUP ; not actually associating/linking the group with the application


Answers:
author: Bruno Vincent
body: As of today there is no direct option in Crowd REST API for this. However there is a workaround. You should actually create a generic parent group and add it to the list of authorized groups for your application in Crowd's console. Then, use the REST API to add other groups as child groups of the generic parent group you've just created.

comments: author: Allan Margono
body: However if you have multiple directories that are associated with an app, then the newly created group only linked with the first directory in the order. How to link the new group with the rest of directories?


Tags: rest-api
How Can I Create A User In Confluence When Using A Crowd Directory With A Password Policy?
Asked by Dalectric:

I am running JIRA 7.2.3, Confluence 5.10.7 and using Crowd 2.11.1 as the user directory.

In Crowd I have configured a password policy using Regex.

Because Crowd doesn't send emails to new users when I create them I need to use Confluence to send an email to the new user with a link to set their password.

However if I try to create the user in Confluence I get the following error in the Confluence log file.

```
2017-04-19 14:40:42,155 ERROR [http-nio-8090-exec-9] [confluence.user.actions.CreateUserAction] execute Failed to create user:?mynewusername{{ ? referer: https://confluence.denso-sales.co.uk/admin/users/createuser.action | url: /admin/users/docreateuser.action | traceId: 11314af20408f9ca | userName: myusername | action: docreateuser}}com.atlassian.core.exception.InfrastructureException: com.atlassian.user.security.authentication.InvalidPasswordException: com.atlassian.crowd.exception.InvalidCredentialException: The new password does not meet the directory complexity requirements: At least 12 characters long, and must contain 1 upper case letter, 1 lower case letter, 1 number
```

To get around this I have to remove the entry in the Regex field in Crowd which allows me to create the user, and then put back the regex in the Crowd field.

Is there a way around this?

What's annoying is that JIRA works completely fine with the regex field filled in Crowd. One of the many inconsistencies I find when adminsitrating these 3 tools.


Answers:
author: Monique Khairuliana
body: This issue is caused by the following newly discovered bug:

* <https://jira.atlassian.com/browse/CONFSERVER-52377>


author: AnnWorley
body: I tested with Confluence 5.10.7 and Crowd 2.11.1, trying to reproduce the issue. I was able to create the user in Confluence (in the Crowd read/write directory). After I created the user the email was sent and would only allow the password to be created in compliance with the password policy from Crowd.

A deeper look into your logs and configuration files may be a good idea. I would be happy to open a support case on your behalf, or you may open it at <https://getsupport.atlassian.com>.

comments: author: Dalectric
body: Thanks, I'll test with SSO enabled and see if that fixes it for me.

If not I'll raise a support request.


author: Lars Olav Velle
body: Confluence does not offer a password policy out of the box.

Here is what Atlassian says.

<https://confluence.atlassian.com/confkb/how-do-i-enforce-password-complexity-in-confluence-346947947.html>

comments: author: Dalectric
body: Maybe I need to enable the SSO for Confluence then, I'll give that a try


author: Dalectric
body: Enabled SSO in seraph-config did not fix this, but thanks for pointing me to this information.


Tags: confluence

password

user-management
Crowd Apache Connector for CentOS 7
Asked by brian_cullen:

Is there a version of the Crowd Apache connector that will install on CentOS 7.3.1611.


Answers:
author: Pete Fuller
body: Bump

comments: author: AnnWorley
body: Please see my answer on:

[Apache 2.4 mod_authnz_crowd not working](https://community.atlassian.com/t5/Crowd-questions/Apache-2-4-mod-authnz-crowd-not-working/qaq-p/655874#U659831)

I would feel like a robot if I just pasted in the same answer, long story short, the connector has not been updated since 2014 so it doesn't work well with newer Apache.


author: Patrick Unthank
body: Has this situation changed or is there another method that now replaces this module for Centos 7 and apache/httpd \> 2.2?
Automatically deactivating a user in crowd (at a future date)?
Asked by Darla Sheehan:

Looking to deactivate Jira users through Crowd or Jira automatically. Is there a way to automatically deactivated a user in 6 months? And as a bonus, be emailed an alert to renew access?

Or is the only option creating custom code in script runner?


Answers:
author: Charlie Misonne
body: For anyone reading this today.

There's no such feature in Jira or Crowd. Scripting seems to be the only option if you use internal users.

If Jira/ Crowd is connected to an LDAP directory I suppose that could be set on the LDAP side, but not in Crowd / Jira.


Tags: user-management
Unable to login with g-suite user
Asked by Gokul Nagasubramanian:

1. G-Suite is integrated with Crowd using craftware plugin

2. I am able to see g-suite users in crowd and fisheye

3. Have allowed g-suite users to authenticate in fisheye

4. Authentication Tests in Crowd is successful (tried with a wront password it fails)

5. When I login using g-suite credentials (which passed the authentication test), it fails with Unknown Username or Bad Password error

Any help please?


Answers:
author: AnnWorley
body: Is it possible that there is a Fisheye internal directory above the G-Suite user directory in Fisheye? Per [External user directories](https://confluence.atlassian.com/fisheye/external-user-directories-812222853.html):

"When a user attempts to log in, the application will search the directories in the order specified, and will use the credentials (password) of the first occurrence of the user to validate the login attempt."

If the user exists with the same name and a different password in the higher directory, it could cause the unknown username or bad password error.


Tags: fisheye-crucible

g-suite
Password keeps expiring after 24 hours
Asked by Gabriel Stone:

We are using a Crowd directory for authentication and authorization for internal services like Bamboo and Artifactory. One user keeps having to contact our department to get back into Jira/Crowd every 24 hours. When he does, I find that is maxPassword attempts are 10 (even though he only tries two or three times) and his resetPassword is always set to true. He is not using any password managers and he is in the right groups for login to Jira and Crowd. The internal Crowd directory allows for all users to authenticate. There is nothing that looks weird about his account in Crowd. Logs on the server only show failed password attempts and don't really point to an underlying cause. I'd rather not have to recreate his account. Password expiry is set to 60 days. No one else is having a problem except for this user. It doesn't matter if he is in the home or office. I am stumped :(


Answers:
author: Karalee Kikiros
body: Disable and re-enable him?


Tags: expiration

password
how to reset Admin password for crowd which uses HSQLDB ?
Asked by Mayur Supare:

Hello guys,

can you plz help me out to reset the admin password from HSQLDB


Answers:
author: Bruno Vincent
body: Please follow Atlassian documentation: <https://confluence.atlassian.com/crowdkb/restoring-passwords-to-recover-admin-user-rights-283642653.html>
Best practice for old directories after migrating to Crowd
Asked by Stephen Hodgson:

I recently implemented Crowd for JIRA, Confluence, and Fisheye/Crucible. This involved moving three directories (2x LDAP and the internal directory) from each JIRA and Confluence into the same three directories in Crowd. At this point I plan on deleting the old delegated LDAP authentication directories from JIRA and Confluence as the users coming from Crowd just naturally override the old users.

However, the internal directory is a more complicated issue as it cannot be deleted. In JIRA, I can move the Internal directory higher than the Crowd directory and then delete the Internal directory users one by one (I plan on leaving an administrative account in case of emergencies). This is not ideal by any means, but it works to clean up old data.

I cannot do the same in Confluence. I moved the Internal directory higher than the Crowd directory, but I get errors deleting users "because he or she has authored content in one or more spaces". This seems like an artificial error in this case because I was able to remove two whole directories full of users who have authored content and that content was simply mapped to the new user record from Crowd.

What have others done to clean up old data after migrating to Crowd? I really don't want to leave old data sitting around as it only serves to complicate the solution.


Answers:
author: QuentinB
body: You really need to leave an admin user in JIRA and Confluence internal directory in case the link between Application and Crowd is not working.

You could move the Crowd directory in first position.  
Run a query in database to indenty all users that are in internal and in Crowd directory and do nothing with these users.  
And identity all users in internal and not in Crowd, should only stay the admin user account.  

Regards

comments: author: Stephen Hodgson
body: Yes, I planned on leaving at least one admin user in the JIRA and Confluence internal directories for recovery purposes.

However, doing nothing with the overlapping users doesn't resolve my original complaint that there is now a lot of duplicated data that only serves to complicate the current situation. This will only get worse over time as some accounts get disabled in Crowd but don't get changed in the no-longer-used internal directory.

It would be really nice if Atlassian had a whitepaper to cover the migration to Crowd that included some more complicated scenarios (e.g. moving multiple directories to crowd) and included what to do with the data that is no longer needed in JIRA and Confluence.

As far as resolving my issue with the extra internal users that are no longer needed, it seems like there are no options outside of fixing the data directly in the database.
Is Delegated Authority the right directory for my needs?
Asked by Kevin Lynch:

Multiple questions:

We have a JIRA instance and we use groups and users from a prior LDAP synchronizing to control access and modify workflows. We have added Crowd into our environment and created a Delegated Authority Directory linking to our LDAP. If we disable the LDAP sync in JIRA and replace it with Crowd, this will allow users to authenticate against LDAP through Crowd and gain access to JIRA. That's fine.

1) How do we see new groups (and there in, users of the group) created in LDAP for creating new workflow or access restrictions in JIRA?

2) If a user is added to a group currently being used in a JIRA Project Role, how will the system know that the user has been added and allow that Role for the user?

If put Crowd sync first and LDAP sync second in JIRA, could this be my solution? Regardless of overhead of syncing? and assuming I DON'T put jira-users and jira-administrators in LDAP and leave them in Crowd.

Thanks


Answers:
author: Bruno Vincent
body: 1) As far as I understand

* You want your users to authenticate against LDAP
* You want to see newly created LDAP groups in Crowd and Jira
* You want to manage jira-users and jira-administrators in Crowd and not in LDAP

I think you should use a "regular" LDAP directory connector in Crowd and select the *Manage Groups locally* setting. As explained in [Atlassian's documentation](https://confluence.atlassian.com/crowd/configuring-an-ldap-directory-connector-18579550.html): *"When this option is enabled, only local groups can be created and updated, while groups synchronized from the remote directory cannot be locally modified"*

Thus you will be able to manage jira-users and jira-administrators in Crowd and see your LDAP groups at the same time.

2) When you configure Crowd as a user directory in the user management section of your Jira server, you set a synchronization interval as detailed [here](https://confluence.atlassian.com/adminjiraserver071/synchronizing-data-from-external-directories-802592362.html#Synchronizingdatafromexternaldirectories-ConfiguringtheSynchronizationInterval). The default is 60 minutes which means that Jira requests your Crowd server every 60 minutes to update its local directory.

comments: author: Kevin Lynch
body: Thanks, this helps with some clerification. We have more LDAP active users than we have licenses within Crowd. Ultimately we decided that we would pull in users into Crowd based on department OUs. In JIRA we are only using departments within Workflow and Role restrictions. This allowed us to clean up the number of groups and users showing in Crowd.

We decided to use the Connector (as you suggested) and this will work fine for us.

Thanks


Tags: jira
Issue connecting from Bitbucket server to Crowd server
Asked by swetha meti:

After following all the steps for configuring crowd and Bitcukcet for authntication, i get the below error in bitbucket logs  
I dont see any error in Crowd server logs.

com.atlassian.crowd.exception.runtime.OperationFailedException: com.atlassian.crowd.exception.InvalidAuthenticationException: Application failed to authenticate?at com.atlassian.crowd.embedded.core.CrowdDirectoryServiceImpl.testConnection(CrowdDirectoryServiceImpl.java:78)?at com.atlassian.stash.internal.crowd.CustomizedCrowdDirectoryService.testConnection(CustomizedCrowdDirectoryService.java:43)?at com.atlassian.plugin.util.ContextClassLoaderSettingInvocationHandler.invoke(ContextClassLoaderSettingInvocationHandler.java:26)?at org.eclipse.gemini.blueprint.service.importer.support.internal.aop.ServiceInvoker.doInvoke(ServiceInvoker.java:56)?at org.eclipse.gemini.blueprint.service.importer.support.internal.aop.ServiceInvoker.invoke(ServiceInvoker.java:60)?at org.eclipse.gemini.blueprint.service.util.internal.aop.ServiceTCCLInterceptor.invokeUnprivileged(ServiceTCCLInterceptor.java:70)?at org.eclipse.gemini.blueprint.service.util.internal.aop.ServiceTCCLInterceptor.invoke(ServiceTCCLInterceptor.java:53)?at org.eclipse.gemini.blueprint.service.importer.support.LocalBundleContextAdvice.invoke(LocalBundleContextAdvice.java:57)?at com.atlassian.crowd.embedded.admin.ConfigurationController.handleSubmit(ConfigurationController.java:133)?at com.atlassian.crowd.embedded.admin.crowd.CrowdConfigurationController.onSubmit(CrowdConfigurationController.java:89)?at com.atlassian.applinks.core.rest.context.ContextFilter.doFilter(ContextFilter.java:24)?at ![Screen Shot 2017-04-04 at 2.54.49 PM.png](/t5/image/serverpage/image-id/39iAFFB82B4907AA526/image-size/large?v=v2&px=999 "Screen Shot 2017-04-04 at 2.54.49 PM.png")


Answers:
author: AnnWorley
body: It looks like the Bitbucket application configured in Crowd cannot authenticate, as the log says

```
Application failed to authenticate
```

Please check:

Crowd\>Applications\>Bitbucket_Application\>Details, that's where the application password is set. You cannot view it there but you could change it and try connecting with Bitbucket again.

Also, the remote IP must be allowed at Crowd\>Applications\>Bitbucket_Application\>Remote Addresses.


Tags: bitbucket-administration

bitbucket-server

crowd-administration
Crowd SSO only allowing user to access one other application
Asked by Nicholas DiCarlo:

I have a VM running crowd 2.7.1, a VM running Confluence 5.4.4, and a third VM running JIRA 6.2.

I have successfully configured both confluence and JIRA to use Crowd for authentication and enabled SSO. My problem is, the SSO will only allow me to automatically authenticate with one of the two other applications in a browser session.

Say I log in to crowd. I can then open up JIRA in another tab and I am automatically authenticated. However, if I then open up Confluence in a third tab it directs me to the login page. After I log in to Confluence, if I log out of any one of the 3 applications I am logged out of all the others as well.

If I log into crowd again, and this time open up confluence first, I will be automatically authenticated. But then if I open JIRA I am directed to the login page. This pattern holds for any order/combination of applications (If I log into JIRA, then open Confluence I will auto-authenticate, but I am taken to the login page when I try to access Crowd.)

What could be causing this?


Answers:
author: Nicholas DiCarlo
body: I figured it out, and am posting here for anyone that has this issue in the future. The problem was a combination of things, but I was able to fix this (and a couple other issues) by enabling authentication caching and adding our load balancers to the list of trusted proxies.


author: Karalee Kikiros
body: Proxy server causing issues?

comments: author: Nicholas DiCarlo
body: I've thought about that, since it's sitting behind a load balancer, but that still wouldn't explain why it only allows me to auth to one. If neither of them were working then I'd agree, but SSO can force sign off on all three so I don't understand how the reverse isn't true as well.


Tags: confluence

confluence-administration

crowd-administration

jira

jira-administration
Synchronize LDAP users pictures
Asked by Allan Margono:

We are evaluating crowd ver 2.11.0 and can't find a way to utilize our LDAP users pictures to all Atlassian Tools sets, including Jira, Confluence, Bitbucket, and Bamboo. Please provide suggestions on how we can achieve that? We have users complaint that they have to upload different pictures on each Atlassian tools.


Answers:
author: Bruno Vincent
body: As of today you can't. You might want to vote for the following feature request: <https://jira.atlassian.com/browse/CWD-2165>

comments: author: Allan Margono
body: What about synchronize users pictures between Atlassian tools? Hence users just need to upload pictures once and it should be shared among all Atlassian Tools?

Can it be done?

I.e, User uploads a pic on Jira, the same pic should be displayed in Confluence, Bitbucket, Bamboo, etc.


author: Bruno Vincent
body: There are actually plugins for this:

* <https://marketplace.atlassian.com/plugins/it.openmindonline.jiraextensions.jira-avatar-server/server/overview>
* <https://marketplace.atlassian.com/plugins/com.cutlass.confluence.plugin.rest.cas/server/overview>

Please note that I haven't tested them myself but they seem to have good reviews.


author: Allan Margono
body: Beside the plugins options, would it possible to host our own avatar server in Crowd? i.e., using public hosted avatar is not acceptable at an enteprise level, due to security, etc.

If yes, then is there any recommendation on how to set it up?


author: Allan Margono
body: If we have to use a plugin then I don't see any single plugin that can be used across all atlassian tools, e.g., jira, confluence, bamboo, bitbucket and crowd. At least none for jira \& confluence single avatar plugin.


Tags: ldap
hipchat server login username question
Asked by C. Faysal:

our HipChat server is connected to crowd.

i can not login anymore for some reason.

entering the email address (user with matching email record exists in crowd)

HipChat keeps telling me email or password wrong...which is definitely NOT the case.

any ideas where i can look for what?

thank you


Answers:
author: C. Faysal
body: solution was to deactivate and reactivate my user in HipChat Server to kill all active sessions


Tags: hipchat-server
how to adjust user accounts in crowd
Asked by Jeffrey Church:

I want to scale back the number of users in crowd because it went over my limit ( for the license ). HOWEVER, i can't login to the crowd console to make this adjustment.


Answers:
author: Saleh Parsa
body: If you login are you seeing update license page? If so - generate an evaluation license and then reduce your users . Please take a look at followings:

<https://confluence.atlassian.com/crowdkb/users-are-unable-to-log-in-after-updating-the-license-223223576.html>

<https://answers.atlassian.com/questions/15271077>


Tags: crowd-administration
upgrade from 2.6 to 2.11
Asked by Suyash Jain _Appfire_:

Hi,

I am preparing the road map to upgrade my Crowd 2.6 to latest 2.11 , So far based on release, I have not noticed any difference except java 8.

As per the upgrade document, I can export the DB xml and then import in new installation or use the same home directory.

Is it safe to directly upgrade to 2.11 or I must go one hop at a time i.e. 2.6 - 2.7 -2.8 -2.9 -2.10 -2.11

Do you have any detailed upgrade recommendations.

Thanks in advance.

Suyash Jain

Appfire


Answers:
author: Saleh Parsa
body: I believe it's safe to directly upgrade to latest :smile: <https://confluence.atlassian.com/crowd/upgrading-crowd-22544441.html>

comments: author: Suyash Jain _Appfire_
body: I appreciate your quick reply, you saved lot of my time :smile:


author: Saleh Parsa
body: Cheers but always test the upgrade in test environment prior to go to your production :wink:


Tags: crowd-administration