youngmon/atlassian-qna huggingface dataset:
Bulk changes in Crowd
Asked by Sameera Shaakunthala [inactive]:

Is there any method to bulk add users to groups in Crowd? In JIRA it can be done with a Jelly script.


Answers:
author: Caspar Krieger
body: As an alternative to using Crowd's CSV importer, you could use [Crowd's REST APIs](https://developer.atlassian.com/display/CROWDDEV/Crowd+REST+APIs) to write a script in your language of choice.


author: Rodrigo Girardi Adami
body: Hi Sameera,

I could find this other answer which will probably help you: [](/questions/50446/crowd-is-it-possible-to-bulk-add-a-user-to-several-groups)<https://answers.atlassian.com/questions/50446/crowd-is-it-possible-to-bulk-add-a-user-to-several-groups>

In other words, [importing users from CSV](http://confluence.atlassian.com/display/CROWD/Importing+Users+from+CSV+Files) should do the trick.

Cheers,

Rodrigo

comments: author: Sameera Shaakunthala [inactive]
body: Thanks! Other answer is also correct.

We did it using CSV importer. An inportant thing, as Rune Hallem has mentioned in their question, user CSV must contain only the headers and no data.


Tags: automation

bulk-edit

crowd-administration

migration

user-management
Update Crowd 2.4.0 to 2.7.1
Asked by H. H.:

Hi,   

after the update from 2.4.0 to 2.7.1 I get the following error messages on startup:

```
2014-03-13 16:00:21,542 localhost-startStop-1 WARN [engine.jdbc.internal.JdbcServicesImpl] HHH000342: Could not obtain connection to query metadata : Cannot create PoolableConnectionFactory (Die von der Anmeldung angeforderte crowdid-Datenbank kann nicht ge?ffnet werden. Fehler bei der Anmeldung.)2014-03-13 16:00:22,073 localhost-startStop-1 ERROR [hibernate.tool.hbm2ddl.SchemaUpdate] HHH000319: Could not get database metadataorg.apache.tomcat.dbcp.dbcp.SQLNestedException: Cannot create PoolableConnectionFactory (Die von der Anmeldung angeforderte crowdid-Datenbank kann nicht ge?ffnet werden. Fehler bei der Anmeldung.)
```

The update I have now done five times according to instructions. Always with small changes, which unfortunately did not lead to success. Does anyone have ideas?

When I import the backup again, the connection to the database is working.

Thanks for the help,   
Heiko


Answers:
author: Septa Cahyadiputra
body: Hi Heiko,

Could you please make sure that your database driver is placed appropriately in the new version of Crowd. If it is using datasource configuration, then it should be placed in *\<Crowd_Install_Dir\>/apache-tomcat/lib/.*If you are using JDBC, then it should be under \<Crowd_Install_Dir\>/Crowd-webapp/WEB-INF/lib/.

Hope it help.

Cheers,  
Septa Cahyadiputra


author: Septa Cahyadiputra
body: Hi Heiko,

Could you please make sure that your database driver is placed appropriately in the new version of Crowd. If it is using datasource configuration, then it should be placed in *\<Crowd_Install_Dir\>/apache-tomcat/lib/.*If you are using JDBC, then it should be under \<Crowd_Install_Dir\>/Crowd-webapp/WEB-INF/lib/.

Hope it help.

Cheers,  
Septa Cahyadiputra


Tags: crowd-administration
how can i retrive CROWD sso token by username
Asked by anosi anosi:

hello everybody,

Is there any function REST to retrive CROWD sso token by username.

i use REST API to creat the SSO token: POST `/session`

```
&lt;?xml version="1.0" encoding="UTF-8"?&gt;&lt;authentication-context&gt;  &lt;username&gt;my_username&lt;/username&gt;  &lt;password&gt;my_password&lt;/password&gt;  &lt;validation-factors&gt;    &lt;validation-factor&gt;      &lt;name&gt;remote_address&lt;/name&gt;      &lt;value&gt;127.0.0.1&lt;/value&gt;    &lt;/validation-factor&gt;  &lt;/validation-factors&gt;&lt;/authentication-context&gt;
```

i want to authenticate a user in one application by validadting his login/password and creat the sso token -\> after that in the other application i want to chek if the user is logged in by retriving the sso token


Answers:
author: Caspar Krieger
body: *i want to authenticate a user in one application by validadting his login/password and creat the sso token -\> after that in the other application i want to chek if the user is logged in by retriving the sso token*

We don't support your intended method of operation directly. The way we expect third party applications to use Crowd is to use the *session* resource; you can POST to it to authenticate a user in the first application, which will get you a session token. Your application should set that session token as a cookie for the user.

Then, in the second application, your user will send over the token key in the cookie to it, and the second application should use the *session/{token}* resource to get the session associated with the token, which will contain the username of the user who created the session. Alternatively, the 2nd application could POST to the *session* resource again to again authenticate the user and create another session; it will get back the same token if the provided validation factors are the same.

(I'm a Crowd developer.)

comments: author: TruongNN5
body: Hi Caspar Krieger,

My confluence use User Directory of Crowd, so Can i get Token when login into Confluence ?

Thanks!


author: anosi anosi
body: i found the answer so for any one who try ti athenticate to apps using Crowd. the easiest way is to retrive SSO toke from this cookie "crowd.token_key" of your domain / . after that check the session is open or not.

comments: author: Caspar Krieger
body: Correct, however note that *crowd.token_key* can be configured to be named differently.


Tags: sso

token
How to retrieve Crowd password last updated value?
Asked by Derek Sheeman:

Is there a way to retrieve the 'passwordLastChanged' value from the crowd internal user database, or find informaion on how it is calculated. We would like to poll this value or recalculate it from the underlying MySQL database in order to notify users of passwords expiring soon.

We had something, but with the crowd 2.7.1 something in the behaivor broke that.


Answers:
author: Caspar Krieger
body: You can extract the password changed attribute from the cwd_user_attribute table:

```
select * from cwd_user_attribute inner join cwd_useron cwd_user_attribute.user_id = cwd_user.idwhere attribute_name = 'passwordLastChanged';
```

Note that this information is only recorded for Crowd internal directories; LDAP (whether cached, uncached, and delegated authentication) connectors do not store this information for users because user authentication in these cases is done by sending the user's password to the LDAP server for verification. Hence, in those cases you'll have to check your LDAP server for the details (this may not apply to you, but noting it here to save future searchers some time).


author: Rodrigo Girardi Adami
body: Hi Derek,

This value in written in Unix type and you should be able to retrieve the exact date by following the advices in this answer: [](/questions/97528/how-can-an-admin-determine-when-someone-s-password-last-changed-in-crowd)<https://answers.atlassian.com/questions/97528/how-can-an-admin-determine-when-someone-s-password-last-changed-in-crowd>
> From the answer above: **"Solution** : Remove the last three digits from Crowd's timestamps, then visit [](http://www.epochconverter.com/)[epochconverter.com](http://epochconverter.com)in order to determine the date."

I hope this helps!

Regards,

Rodrigo

comments: author: Derek Sheeman
body: I recognize the epoch time. I am looking for how to retrieve the passwordLastChanged value from the application (API) or where it is stored in the Database so I can poll it. Nothing in published schema looks to reflect this.

... also, your answer really doesn't have anything to do with my actual question.


author: Rodrigo Girardi Adami
body: Hi Derek,

In addition to Caspar's answer, I couldn't find a way to retrieve this information [using API](https://developer.atlassian.com/display/CROWDDEV/Crowd+REST+Resources)

You may want to check the resources thought.

Apologies, but since you have asked "...or find informaion on how it is calculated" I was trying to explain how this information is stored.

I hope this helps.

Cheers,

Rodrigo


author: Derek Sheeman
body: I can see that interpretation, thanks!


Tags: crowd-administration
Import users in to crowd using 'csv import'
Asked by Vijay Krishna B:

I want import about 5000 users and the same number of usergroups to one directory using the csv importer but the server is halt in the middle after runnning 2400+ users.

I have tried with the single user import and it was working.

Is there any limit in the number of users to import?


Answers:
author: Tiago Comasseto
body: Hi Vijay, the [CSV import documentation](https://confluence.atlassian.com/display/CROWD/Importing+Users+from+CSV+Files) doesn't mention any limitation of number of users. What I believe may be happening is that Crowd is runnig out of resources when executing this task. May be a good idea increase the memory size allocated to Crowd.

Cheers

comments: author: Caspar Krieger
body: Also, you can look at the Crowd logs for any errors.


author: Corentin M?hat
body: You also want to check if your crowd'JVM has enough memory configured / try to increase it.


Tags: crowd-administration
Jira - users have to login twice
Asked by SkyIsFalling:

We're running Jira 6.2 with Crowd providing authentication services across all our Atlassian software. Crowd syncs with Active Directory, and our users can all log in to Atlassian software using their Windows logon.

When a user tries to login to Jira, the first attempt fails - a message saying "You do not have permissions to log in ....." appears above the username field in the login page. When the user then tries again with the same username and password they successfully log in.

I believe (but cannot be certain) that this behavior began after the upgrade to Jira 6.2. Confluence doesn't seem to exhibit this behavior, and neither does Stash

Has any one else had the same problem?

Thanks.


Answers:
author: eyrisone
body: I'm seeing the same behavior - for a small number of users - in confluence. All our accounts are synced with Active Directory.


author: SkyIsFalling
body: SSO hasn't been enabled.

Our users log on to Atlassian applications using their Windows credentials - this has been working fine until just recently.

I'm beginning to get more reports from users about permissions - one user can no longer resolve issues, an admin-level user can not assign issues.


author: Tiago Comasseto
body: Hi Michael,

When integrating JIRA with Crowd, the SSO is not enable by default, additional modification to seraph file is needed to enable it and some customers decide to user other softwares to provide SSO.

Do you have any kind of SSO configuration in place? I'm asking this because I see you mentioned Windows logon, perhaps are you refering to [Integrated Windows Authentication](http://en.wikipedia.org/wiki/Integrated_Windows_Authentication)?

If you have SSO enabled, can you turn it off temporarily and see if it brings any improvement?

Cheers
crowd and multiple jira/confluence instances
Asked by Alex Domoradov:

Hello,

Could you clarify the following moment. We have 3 jira/confluence instances on the same server. Do we need to buy 3 crowd license or we can use one crowd server to manage all 3 jira/confluence instances?

Thanks in advance.


Answers:
author: Tarun Sapra
body: You can use one crowd license and map the different JIRA and confluence instances as applications in the Crowd Admin console, but the accumulated number of users would count towards the crowd license.


Tags: crowd-administration
Crowd advice?
Asked by Warren McInnes:

Hi guys,

I couldn't find this in the Crowd documentation, hence I am here....

Scenario:

We currently use the jira user repsository to manage our users, however many of our users have multiple email addresses.

Eg. Joe So has 2 email accounts - [Joeso1@email1.com](mailto:Joeso1@email1.com) \& [joeso123@email2.com](mailto:joeso123@email2.com)- Both being the same person and is struggling to manage Jira notifications. (Both accounts on jira)

So my question is:

Can the Crowd user reposirtory manage this type of user?

What I would like for example -

1 user - Joe So

2 email account on 1 profile ([Joeso1@email1.com](mailto:Joeso1@email1.com) \& [joeso123@email2.com](mailto:joeso123@email2.com))

Jira notifiys both email accounts

I hope I'm being clear, I want one user profile that can have multiple email addresses? so that if the user wants to make things complicated by having two email accounts, I will just be one Jira account for Admin to manage.

Thanks in advance


Answers:
author: JohnA
body: Hi Warren,

I'm sorry to say that Crowd can only manage one email address for each user, so this wouldn't be possible to configure from the application itself. However, I would have thought you'd be able to configure your mail server to relay the mails sent from the applications to multiple email addresses, even though the applications only originally send the mails to the one address stored in the user's profile details, so that is the route I would go down to set this up.

All the best,  
John

comments: author: Warren McInnes
body: I'm not too stressed about Jira's notifications to users, However I am more bothered about user accounts, Some on our users may move between deparments and then get allocated a new email address, this can not be helped. And then they send an email to one of our support email addresses assigned to Jira - hence creating a new user for that email account. This approach makes the same person end up with multiple users accounts due to having multiple email addresses. I understand this is a User error and not an application error, but as an Administrator this becomes messy to manage and it's a constant battle to get the user to use just one account and one email address. So I thought if there was some way to allow 1 person to have 1 Jira account but have as many email addresses as they wish to manage on their own capacity, it would make managing some users in jira better and it's would be their problem to manage to track their Jira notifications. What is the purpose of Crowd then, If you can manage users in Jira, What functionality does crowd offer that Jira can't do?


Tags: crowd-administration
Crowd LDAP Connectivity issue : Configuring crowd to Delegated Authentication Directory
Asked by AK:

Hi ,

I wanted to connect my Crowd application to LDAP using Delegated Authentication Directory(Directory type). I did all the configuration set up as per the atlassian documentation. In my new crowd integration with LDAP "Microsoft Active Directory" as a connector. And Test Connection and Test Search displaying mesasge as successful. But there are no users listed from LDAP in my new crowd application.

There is already an existing Crowd server which connected to same LDAP and working fine.

Can we connect more than one crowd to LDAP.??

Could anyone help me to fix this issue..

Thanks,

Jagadeesh


Answers:
author: AK
body: Thanks so much for your reply Caspar!!

Could you please tell me where can I find the option "To create and/or update users on login" in Crowd application configuration tab which you mentioned in the above reply.

Regards,

Jagadeesh

comments: author: Caspar Krieger
body: You need to look in the directory configuration in Crowd, not the application configuration in Crowd, because it's a setting on the directory which will apply to all applications mapped to that directory. Our documentation isn't the clearest on this, but [this might help](https://confluence.atlassian.com/display/CROWD/Configuring+a+Delegated+Authentication+Directory).


author: Caspar Krieger
body: Using a Delegated Auth directory means that the users are managed separately from the LDAP server, but will use the LDAP server to verify users' passwords.

You need to either turn on the options in the configuration of the Delegated Auth directory to create and/or update users on login, or you need to use a normal LDAP Directory Connector instead of a Delegated Auth Directory.


Tags: crowd-integration

ldap
Using crowd with JIRA and Confluence on single host server crowd invalidates sessions when you switch between them.
Asked by Dana Frost:

This is for a dev/test configuration where all three services JIRA, Confluence, and Crowd are running on a single host (using different ports). I have crowd working with both applications (JIRA and Confluence) and I can log into each separately. The problem is that as soon as I log into the second application, the first application requires a new login. The only diffrence between the services is the port number

* Crowd: [](http://atlassian.example.com:8095/%20)<http://host.example.com:8095/>
* JIRA: [](http://atlassian.example.com:8080/%20)<http://host.example.com:8080/>
* Confluence: [](http://atlassian.example.com:8090/%20)<http://host.example.com:8090/>

So, each time I log into JIRA, it will invalidate the current Confluence login and ask me to login again. Crowd is setup to use a Delegated/Generic LDAP connection.


Answers:
author: Dana Frost
body: Using diffrent address per application is the way to go. Got this answer from support...

The reason for this behavior is that the cookie is created via the domain. In this case, each service was at [](http://vmlnx-dfrost.calix.local/)http://host.example.com as far as the browser was concerned. Therefore, each new login granted a new cookie which invalidated the previous one. The most common way around this is to either to us a context path ([](http://vmlnx-dfrost.calix.local/confluence)<http://host.example.com/confluence>) or a mixed domain ([](http://confluence.vmlnx-dfrost.calix.local/)<http://confluence.host>.example.com).

The other way, which you have discovered, is to establish SSO with Crowd. In this situation the cookie (and token) are assigned view Crowd so for each application the token is the same so you are not logged out.


author: Timothy
body: Have you tried this? Let your apps have a context path. E.g. /jira or /confluence
Crowd stores LDAP directory password as plaintext in backup file
Asked by Jan Wittorf:

Hi,

I enabled the "Schedule Backup" function and as I had a look inside the backup file I found that the ldap.password is stored in plaintext.

Is this correct? Are there any options to encrypt this password?


Answers:
author: JohnA
body: Hi Jan,

I'm sorry to say that is correct and at the moment there isn't an option to encrypt all passwords in the system. We do have an open feature request to ask that all Crowd passwords are encrypted so I would recommend that you watch/vote/comment on that issue to encourage our developers to prioritise its implementation: [](https://jira.atlassian.com/browse/CWD-1876)<https://jira.atlassian.com/browse/CWD-1876>

All the best,  
John


author: Jan Wittorf
body: Ok, thanks


Tags: ldap

password
Can we enable crowd authenticaton for IIS SERVER
Asked by Sreeni MCA:

Hi,

can we enable crowd authentication for wordpress blogging server , which is running on IIS server.


Answers:
author: Caspar Krieger
body: Crowd has no specific support for Wordpress out of the box, however if Wordpress provides pluggable authentication and authorisation mechanisms then it should be possible to write a plugin for Wordpress to connect it to Crowd using [Crowd's REST APIs](https://developer.atlassian.com/display/CROWDDEV/Crowd+REST+APIs).

comments: author: Sreeni MCA
body: Thanks for your reply Caspar.

Is the any other dependencies as we are running our crowd on linux server and wordpress server is running on windows IIS server.


author: Caspar Krieger
body: The only dependency you haven't mentioned there would be the custom plugin for wordpress :)

Crowd doesn't require much except a server with Java to run on and a database to connect to. [Here's the list of supported platforms](https://confluence.atlassian.com/display/CROWD/Supported+Platforms), if that's what you were after.


Tags: crowd-administration
Crowd XML backup failed with NPE
Asked by Sameera Shaakunthala [inactive]:

We are currently evaluating Atlassian Crowd. When I tried to take a XML backup, a 'java.lang.NullPointerException' occured. (full stack trace: (crowd-error.txt) )

We have only one user in the crowd internal directory and no groups other than default crowd-administrators group. Also, we have one Windows Active DIrectory configured (connector - not delegated authentication).

Could you please help me to find the root cause for this?


Answers:
author: Caspar Krieger
body: I tried to reproduce this with Crowd 2.7.1 (in use by you according to your stack trace) but wasn't able to. I used the embedded database and configured Crowd to have the internal directory plus an active directory connector.

Would you please tell me what database you have Crowd connected to, and if possible run the SQL *select \* from cwd_directory;* on your Crowd database? That stack trace seems to indicate that the description for a directory is *null*, so I'd be interested to see if that is actually the case.

**After clarification:** Ah yep, Oracle would do the trick, and as you worked out you can fix it by setting a non-empty description. Looks like another occurrence of [this old Oracle quirk](http://stackoverflow.com/questions/203493/why-does-oracle-9i-treat-an-empty-string-as-null); [CWD-3216](https://jira.atlassian.com/browse/CWD-3216) would be appropriate to vote on if you'd like to see this fixed.


author: Sameera Shaakunthala [inactive]
body: We use Oracle 11.2 . Descriptions for both directories were null.

Then I put descriptions for both, and then XML backup worked fine.

I think this is a bug in Crowd application. If description is supposed to be a required field, field validaiton must be done.

Please convert your comment to an answer so I can accept it. :)

Thank!


author: Sameera Shaakunthala [inactive]
body: Other information:

* No connected applications.
* Active Directory connected with cache enabled.
* This is just a basic instance.
* Crowd version: 2.7


Tags: backup

crowd-administration

null-pointer-exception

xml
About Apple Open Directory
Asked by Song Liu:

We are evaluating the Stash on our Mac OSX Server, during the User Directories setup, it keeps telling me that:"Connection test failed. Response from the server:

\[LDAP: error code 34 - invalid DN\]; nested exception is javax.naming.InvalidNameException: \[LDAP: error code 34 - invalid DN\]"

the DN we use is "dc=spark,dc=moplus,dc=com", I think it is right as we can use "ldapsearch -Hldap://localhost -b "dc=spark,dc=moplus,dc=com" -x in CLI to get search results.

<br />


Answers:
author: drwilltx
body: Hope this helps, but just ran into this myself as well connecting to OpenDirectory. I had to set basedn to "dc=\<server\>,dc=\<domain\>,dc=\<tldn\>" and User DN (on the Configuration Tab) to "cn=users"

So if your server is "ldap" and your domain is "example.local", the basedn that I had to use would look like

dc=ldap,dc=example,dc=local

Again, hope that helps!


author: cofarrell
body: Hi Song,

I hope you don't mind, I've added the crowd/ldap tags so that hopefully someone who knows more about them can help. If you get stuck don't hesitate to create a [support ticket](https://support.atlassian.com/).

Charles


Tags: crowd-administration

ldap