youngmon/atlassian-qna huggingface dataset:
Get a crowd SSO cookie via NTLM auth
Asked by Chad Neal:

I am looking to see if its possible to get crowd to give me a SSO token/cookie by using an NTLM based authenication. has anyone done this before?

Thanks for the help-

Chad


Answers:
author: Ellen Feaheny [AppFusions]
body: NTLM is a pretty old tech for AD auth now adays - here's a doc that compares it with some other options.

<https://www.appfusions.com/display/KBRSCJ/NTLM+v1+or+v2+or+Kerberos>

We are using Kerberos for Windows/Active Directory SSO solutions for our customers.

If interested, see our offering here:

<https://www.appfusions.com/display/KBRSCJ/Home>

Best,

Ellen


author: Bruno Vincent
body: Hi Chad,

There is actually a plugin for this (though it uses Kerberos instead of NTLM):

[Integrated Windows Authentication for Apps using Crowd (IWAAC)](https://marketplace.atlassian.com/plugins/com.cleito.iwaac/server/overview)

(Disclaimer: I work for the plugin's vendor)

Bruno


author: Ed Letifov _TechTime - New Zealand_
body: We do not yet do NTLM authentication to Crowd itself, but if you need to integrate seraph-enabled applications like Atlassian Confluence or Atlassian Jira with Active Directory to do SSO on any platform - we have it.

<http://techtime.co.nz/x/AwCxAg>

The NTLM Authenticator is delivered as a jar file and instructions how to deploy it to Atlassian Jira and/or Confluence to work in conjunction with IOPlex Jespa library to perform NLTM authentication in Windows environment.

The cost is one-off NZ$150 (plus fees for Jespa license payable to IOPlex).

TechTime NTLMv2/NTLMv1 authenticator supports Confluence 4.x as well as Jira 4.x. We are currently working on adding Fisheye/Crucible to the mix. The authenticator itself works in Crowd environment as well as without Crowd.

We are always open to requests if some killer feature is missing.
Crowd User Authentication with Remote custom directory
Asked by swathikumary:

Hi Team,

Currently i am doing User Authentication and Authorization using crowd with Internal Database.

Now i want to use User Authentication using crowd with Remote Directory.

Please provide me the any documents available fo this and how to i can dothis?

Thanks

SwathiKumar


Answers:
author: Ivar
body: You mean this? <http://confluence.atlassian.com/display/CROWD/Configuring+a+Remote+Crowd+Directory>

comments: author: swathikumary
body: Hi Lvar,

My Remote Directory is not the Crowd directory.

My database is Open Directory . But it does not support LDAP.

It is "ds_AuthWeb"

Please give me an idea how can i do Crowd with WebAuthentication.


author: Ivar
body: Have you checked out this: <http://confluence.atlassian.com/display/CROWD/Configuring+a+Custom+Directory+Connector> URL?


Tags: authentication
Integrating Crowd with Onjira hosted solution
Asked by nr:

I'm using a hosted jira solution (onjira) as my ticketing system. Also I have an application with which I've successfully integrated our Crowd setup for SSO. This is on my dedicated app boxes. I'm planning to have my Crowd function as CAS and thus wanted to integrated it with my onjira system.

Is this possible? If so, do we have any good links/references pointing to this?

Thanks


Answers:
author: nr
body: Was hoping to get some answers on this. Please let me know if this is not the right forum to post this question. I dont see much views also on this.


Tags: cloud

jira
Crowd server migration (licensing)
Asked by James Migue:

Hi

I have just performed a Crowd upgrade andalso migrated servers. I used the built in XML backup process. I expected this to import license details but it hasn't and I am currently uding an evaluation license.

How do I migrate the full commercial license?

<br />

Regards

<br />

James


Answers:
author: Eric S
body: Hi James,

If you email me at [sales@atlassian.com](mailto:sales@atlassian.com) with the SEN # and/or the technical contact email address I can take a look at the license and the account. If you have the same email address domain it shouldn't be a problem getting you the license key for the new server.

In your email, if you put it to my attention it will get direct to me.

I look forward to hearing from you.

Eric Snyder

[sales@atlassian.com](mailto:sales@atlassian.com)

comments: author: James Migue
body: All sorted. Many thanks Eric for your efforts.

Cheers


author: Eric S
body: Hi James,

You'll need to grab your Crowd license from you [my.atlassian.com](http://my.atlassian.com) account. You will use the same commercial/starter/academic license key for the new instance on the new server.

I hope this helps!

Eric Snyder

[sales@atlassian.com](mailto:sales@atlassian.com)

comments: author: James Migue
body: Hello Eric

<br />

Thanks for this. I do not have access Atlassian account and the Atlassian administrator is currently on leave,

Can I just pull the key off the old server then?

Cheers


Tags: licence
Migrate users from Crowd to Active Directory or other LDAP server?
Asked by Dennis Benzinger SAP:

How can I migrate users from an internal Crowd directory into Active Directory or another LDAP server?

Is it possible to create an LDIF export of an internal Crowd directory?


Answers:
author: Tam Nguyen
body: You can make LDIF file by using sql query, it's easier than using API. The following code used for Jira, you can do the same thing with Crowd database ( cwd_user table)

```
select 'dn: cn=' || username || ',ou=users,dc=erx' || chr(13) ||       'objectClass: person' || chr(13) ||       'objectClass: top' || chr(13) ||       'email: ' || (select propertyvalue from propertystring ps inner join propertyentry pe on ps.id = pe.id where pe.entity_id = ub.id and entity_name = 'OSUser' and property_key = 'email') || chr(13) ||       'uid: ' || username || chr(13) ||       'cn: ' || username || chr(13) ||       'structuralObjectClass: person' || chr(13) ||       'givenName: ' || (select propertyvalue from propertystring ps inner join propertyentry pe on ps.id = pe.id where pe.entity_id = ub.id and entity_name = 'OSUser' and property_key = 'fullName')  || chr(13) || chr(13)from userbase ub;
```


author: Vallatharasu Vallatharasu
body: Hi

We would like to move the crowd groups to AD.

is it possible?

Thanks

Arasu

comments: author: Dennis Benzinger SAP
body: As this is a new question, you shouldn't add it as an answer to my question, but rather as a new question.  


author: John Cheng
body: I'm guessing you could use the API to query each account and then output it in LDIF format. I guess then your question would now be, if there is an existing solution to this that is known to work, so you don't have to do it yourself.

comments: author: Dennis Benzinger SAP
body: Yes, doing it yourself is always an option. I hoped for an existing solution. Thanks anyways!


Tags: active-directory

ldap
Crowd with ApacheDS - too many users
Asked by Kimberly McKinnis:

Last night, I moved my Crowd authentication from a server with OpenLDAP/Posix to a different server with ApacheDS. Both LDAP servers have 76 LDAP users, but I didn't intend to allow them all to log into the Atlassian suite. This morning, I found that I was locked out of Crowd because our license only allows for 50 users, and any actions within Crowd redirect me to a license page.

Is there a way to tell Crowd that I don't want to actually allow all 76 users to log in? My staging environment auths against the OpenLDAP setup still, with a 50 person license, and I haven't run into this problem.


Answers:
author: Bruna Griebeler
body: In that case, you'll need to [create filters](https://confluence.atlassian.com/display/DEV/How+to+write+LDAP+search+filters) so just some users will be imported.

Hope it helps!
Must we choose either Embedded Crowd or SSO?
Asked by Michael Downey:

The wiki documentation (at least for JIRA and Confluence) suggests that we can't use Embedded Crowd if we want to use SSO. Instead, we must use seraph-config.xml and crowd.properties to specify our Crowd directory externally.

Is this really the case? Is there any way to use SSO with Embedded Crowd? If no, why not?


Answers:
author: Joe Clark
body: What kind of SSO are you talking about? Generally speaking, there shouldn't be any real reason why you can't have some SSO authenticator plugged-in to Confluence whilst your users are coming from an LDAP directory configured in Confluence (which is done via the 'embedded crowd' module).

There may be some features of the LDAP connection that may not be supported by the SSO authenticator.

For example, many customers using the Confluence SharePoint Connector have successfully configured an NTLM SSO Authenticator for Confluence, with the user accounts being pulled in from Active Directory via an embedded crowd LDAP connection. The "automatic group-joining on login" feature doesn't work with this authenticator, though.

comments: author: Michael Downey
body: I'm asking if there's any way to configure the Embedded Crowd client to use Seraph-based SSO to authenticate to a central Crowd server.

For example, if you read [http://confluence.atlassian.com/display/CROWD/Integrating+Crowd+with+Atlassian+JIRA](http://confluence.atlassian.com/display/CROWD/Integrating+Crowd+with+Atlassian+JIRA%20) you will see that the official way of connecting to JIRA to Crowd these days is to use the Embedded Crowd client. However, if you keep reading, you will see that the user is instructed to manually edit **seraph-config.xml** and **crowd.properties**files. These files (at least at the time I wrote the question above) are not recognized by JIRA's Embedded Crowd client.

The result is I must either choose between the integrated Embedded Crowd client with no Seraph SSO, and using the "old-fashioned" Crowd integration of manually copying files and editing configuration files.

My question is - will this ever be unified so Embedded Crowd clients support Crowd's Seraph SSO?


author: Joe Clark
body: Ah, I see what you mean! Sorry, my answer was off-track.


author: Konnie McCauley
body: This is a great question. We are considering using Crowd as our SSO solution for Confluence. we would also like to find a solution to automatically add everyone into confluence-users group without having to manually add them or have the users log in. We already have our AD groups created in Confluence. Has anyone successfully altered or designated the confluence-user group to be one already in AD?


Tags: sso
Do active directory sub groups come down into Crowd Directory during synchronization?
Asked by lance_lyons:

We have setup crowd to connect to our active directory. We have added the groups jira-users, jira-administrators, confluence-users, etc,etc. We have verified that if a user is placed into a active directory group on the active directory side and you synchronize, you will be able to login to the app using that directory using your active directory credentials. YOu can see these users in the group jira-users in Crowd. However if we added a active directory group like "SoftwareDevTeam" to the jira-users group and syncrhonize, you dont see any users or sub groups.

Am i doing something wrong or do I need to add users individually to the groups jira-users, etc,etc.

We dont have the Crowd directory setup to make changes in our active directory.

Thanks


Answers:
author: lance_lyons
body: This functionality is in Crowd and called nested groups. I was able to enable nested group in the directory and all the sub group info synced into the directory.

<http://confluence.atlassian.com/display/CROWD/Nested+Groups+in+Crowd>
Crowd-Apache connector 2.0 on Debian5
Asked by Ga?l NEUEZ:

Hi,

has anyone tried to build/install the crowd-apache connector 2.0 on a Debian5 machine? Crowd documentation says it is only for Debian6, I wonder if someone has tested it on Debian5 before I make a big move to Debian6.

Regards,

Gael


Answers:
author: Bruna Griebeler
body: Just tested on CentOS 5.6 - with success :)

Cheers!


Tags: apache

connector

linux
Crowd integration with Apache
Asked by claudia:

I'm trying to integrate Crowd with Apache (Ubuntu 10.04) but I'm getting this error:

configure: error: apr_pool_pre_cleanup_register was not found in libapr-1

I found this JIRA:

<https://jira.atlassian.com/browse/CWD-2372>

Is there a solution for this issue already?

Thanks in advance


Answers:
author: CelsoA
body: Hi Jeremy,

I believe that you need this package <https://launchpad.net/ubuntu/maverick/i386/libapr1> in your Ubuntu, this link refers to the i386 version.

Another package that can provide you the correct files for libapr is found here: <http://packages.ubuntu.com/search?keywords=libapr1-dev>

The second one includes the dev modules for use.

Please let me know if it worked.

Regards.


author: Jeremy Derr
body: @bruna - that's not terribly helpful. [This doc says Ubuntu 10.x is supported.](https://confluence.atlassian.com/display/CROWD/Integrating+Crowd+with+Apache#IntegratingCrowdwithApache-Step3.ChoosingtheCorrectApacheConnectorforyourOperatingSystem)


author: Bruna Griebeler
body: Hi Claudia,

I suggest you to try this on CentOS 5.6 or later!

Cheers!
Crowd and remember me
Asked by Moraillon Beno?t:

Hi Shihab,

Do you plan to develop a native remember me in crowd because our user  
dont' understand why they need to re-enter their username/password after closing their browser.

=\> crowd cookie alwys expires at the end of the session not at the end of the sso token.

Thanks,

Beno?t Moraillon.


Answers:
author: Michal Hobot
body: I have the same question: What about "Remember me" or "Stay signed in" checkbox on the login form?

Most of the modern web apps offer such an option, including your own webpage I'm using now :)

Do you plan such a feature in Crowd?


author: GuilhermeA
body: Hello Beno?t,

I'm not sure if I understand it correctly but you are having problems with Remember Me in your Crowd Instance, is this from your Company? It seems to be addressed to Shihab directly, is he from Atlassian or working in your Company?

Either way it could be that the Token is being invalidade by the Browser itself at the end of the session. I would suggest seeing the browser expiry timeout.

Or it could be something to do with:

* [https://extranet.atlassian.com/display/\~gcheck/Troubleshooting+Overview](https://extranet.atlassian.com/display/~gcheck/Troubleshooting+Overview)
* <https://confluence.atlassian.com/display/CROWD/SSO+Cookie>

Hope this helps you, or someone at your Company who is dealing with that problem.

Cheers,

Guilherme
Install Problem - Install Wizard - JDBC connection setup issue
Asked by Ryan Ward:

Hi There,

I get "The specified class was not found in the class path." during the database configuration step

I have jtds-1.2.4.jar (these are real jar files, not .zips renamed to jars) in C:\\crowd\\atlassian-crowd-2.3.2\\apache-tomcat\\lib

and my config in the wizard looks like this

Databas: Microsoft SQL Server

Driver Class Name: net.sourceforge.jtds.jdbc.Driver

JDBC URL: jdbc:jtds:sqlserver://localhost:1433/crowd

username:xxx

password: xxx

Hibernate Dialect: org.hibernate.dialect.SQLServerDialect

MY SQL install is MS SQL Server 2008R2

note: I have confluence and JIRA sucessfully installed as well

TIA


Answers:
author: Ryan Ward
body: still no luck trying different things :(

comments: author: Ryan Ward
body: Ok so I figured it out...

1) for some reason, because I had a confluence instance of tomcat running (not as a service), it gave the JTDS error

2) my DB was actually named crowddb not crowd, so my URL should have been JDBC URL: jdbc:jtds:sqlserver://localhost:1433/crowddb (this should of generated a DB does not exist or something error).

So it seems like there were some false positives and incorrect errors / lack of errors being thrown during the install.

Looks like a couple here bugs to me ;) Reported them to Atlassian
Problem with directory creation in Crowd 2.3.2
Asked by Wilfried Goemaere:

When creating a "Delegated Authentification Directory", I can't update the "Configuration" tab.

I've got an error message : "There was an error in updating the directory. Please check the fields to ensure all entries are valid."

I've just upgraded my version and I've got no problem with the preceding 2.2.7 version.

I try to create a "Delegated Authentification Directory" of type "Generic Posix/RFC2307 Directory (Read-Only)".


Answers:
author: David Mason
body: Hi Wilfried,

Just to let you know, this is a known bug in Crowd [https://jira.atlassian.com/browse/CWD-2712](https://jira.atlassian.com/browse/CWD-2712.). This will be fixed in version 2.5.

Regards,

David


author: Ivar
body: You should log this with Atlassian support if you haven't already :\|
Turn a remote Crowd directory into a standalone internal directory?
Asked by Dennis Benzinger SAP:

For upgrading a Crowd installation I'd like to install the new version in parallel to the old one.  
Then I'd create a remote Crowd directory in the new Crowd that connects to the old Crowd.  
With this setup I could switch over my applications one after another to the new Crowd without having to shut them down all at once.  
When the last application is using the new Crowd I'd like to cut the connection to the old one and turn the remote directory into a standalone internal one.

Is this possible?


Answers:
author: James Wong
body: **The answer below is totally unsupported and you could potentially lose your data.**

But if you really wanted to try it, you could just open up your database and look at the "cwd_directory" table. Find the row that you want to edit and change *impl_class* to: com.atlassian.crowd.directory.InternalDirectory

and *lower_impl_class* to: com.atlassian.crowd.directory.internaldirectory

change the *directory_type* to: INTERNAL

This*may* work.

**Again, please be aware of the risks before doing this**.


Tags: directory

remote
LDAP Authentication on Intermedia Exchange account not working
Asked by Gabriel Harriman:

I've setup JIRA using LDAP authentication delegation and it connects to my Intermedia exchange Active Directory and works great (without crowd).

Now, I would like to setup Crowd to do the same thing but I keep running into problems.

The first issue is, when I add the LDAP Delegation with Active Directory, it connects, but when I click on "Configuration" and try to change "User Name Attribute" from "sAMAccountName" to "mail" (to use email as username instead of the unfamiliar intermedia account format of username_accountname), it gives me an error of "There was an error in updating the directory. Please check the fields to ensure all entries are valid. " when I click "update", \*unless\* I have selected "Syncronise User Details" and "Syncronise Group Memberships" on the previous screen. If those options are selected, it lets me make the change, no problem.

The bigger issue is - even though all the test searches work, and my LDAP configuration in Crowd is identical to the configuration I use in my deletegated LDAP authentication in JIRA, I cannot authenticate using my LDAP accounts. It doesn't seem to matter if I use sAMAccountName or mail as the User Name Attribute, I cannot login.

Has anyone else used Crowd with Intermedia, or other hosted exchange providers?

\*\* EDIT \*\*

When I use LDAP sync instead of delegated authentication, users are synced over and I can see them in the directory, but I still cannot login to crowd using the LDAP user.


Answers:
author: Gabriel Harriman
body: I didn't see that "crowd" was listed under the "Applications" menu in Crowd and assumed it would just authenticate against the list under the "Directories" menu. I added the directory to the "crowd" application and everything works as expected.


Tags: ldap
How do I change email addresses stored in Crowd - in bulk?
Asked by Andrei [errno]:

* i have a group of users in Crowd
* I need to change email addresses for all users in that group (110's of users)

what are my options to do it in the most effective way? thanks  

EDIT: I am reading about <http://confluence.atlassian.com/display/CROWDDEV/Crowd+REST+APIs>


Answers:
author: Colin Goudie
body: If this is going to be an infrequent event I would consider just doing it in the database. (Assuming you are just changing the URL part of the email address). But if you a simple mapping table would also do it.


Tags: atl-gruland
Crowd - Sun Directory Server - No Permission for Self-Service LDAP Password Update
Asked by Jason Tolotta:

I have **Crowd 2.3.2** deployed on a**CentOS 6** server using the **Embedded Database**.

I currently added a **Sun Directory Server** using the **LDAP Connector**.

The LDAP Server Users are synched.

If I log into Crowd using the **Self-Service** of an LDAP user and proceed to **Change Password** a message is displayed stating**:**

**You do not have permission to change your password.**

On the Sun Directory Server I have indicated in the Password Policy that users can change their password.

On the Crowd side I have set the Sun Directory Server Connector as follows:

Type: Sun Directory Server Enterprise Edition

URL: ldap://my.server.com:389/

Base DN: dc=my,dc=server,dc=com

I am not sure what else is needed?


Answers:
author: Tiago Comasseto
body: Hi there,

I see that you are connecting to the LDAP using the ldap protocol, instead of ldaps (URL: ldap://my.server.com:389), as per what I know you need an SSL connection to perform password changes into the LDAP (it seems to be a restriction from the LDAP server, not Crowd itself).

You may try setting your LDAP directory in Crowd over SSL and see if it solves this issue. You can use this [documentation](https://confluence.atlassian.com/display/CROWD/Configuring+an+SSL+Certificate+for+Microsoft+Active+Directory) as a guide line for this configuration.

Cheers


Tags: directory

ldap
Can Crowd Function as an LDAP Proxy?
Asked by Charlie Jacks:

I am looking to solve a problem where we cannot put a public cert on a LDAP server within our company. I want to stand up a server that is publicly addressable and can use a public certificate to act as a proxy between SaaS providers and our internal LDAP server.

Can Crowd accept LDAP requests via a public name (such as [server.company.com](http://server.company.com)) and pass the request along to an internal LDAP server (such as ldap.company.internal)?


Answers:
author: J?rg Henne
body: You could give Penrose a try: <http://penrose.redhat.com/display/PENROSE/Home>
Fisheye 2.6.x and Crowd 2.0.2
Asked by Buelent Caliskan:

Hi!

We use Crowd 2.0.2 and Fisheye 2.4.5

After Update to Fisheye 2.6.x i got this error

com.atlassian.crowd.exception.InvalidCrowdServiceException: The following URL does not specify a valid Crowd User Management REST service: <http://crowd:8095/crowd/rest/usermanagement/1/config/cookie>

Is Fisheye 2.6.x not compatible with Crowd 2.0.2? If that's true, since which version?


Answers:
author: Pierre-Etienne Poirot
body: Hi Buelent,

Yes FishEye 2.6.x and 2.7.x are only compatible with Crowd 2.1+.

This is because FishEye migrated from Crowd's older [SOAP api](http://confluence.atlassian.com/display/CROWDDEV/SOAP+API) to its [REST api](http://confluence.atlassian.com/display/CROWDDEV/Crowd+REST+APIs), which provides additional [functionalities](http://confluence.atlassian.com/display/CROWDDEV/Crowd+2.1+Java+Client+Migration+Guide#Crowd21JavaClientMigrationGuide-DecidingWhethertoM) (such as [memberships queries](http://confluence.atlassian.com/display/CROWDDEV/Crowd+REST+Resources#CrowdRESTResources-GroupResource)).

However, as far as I know, this was not documented, so I created an issue [FE-3704](https://jira.atlassian.com/browse/FE-3704) so that we update the documentation promtly.


Tags: fisheye-crucible

moderators