Unable to login to internal directory user
Asked by dchisholm:

I'm running Confluence with Crowd in an SSO configuration, and I cannot login to a user that I created in the Confluence internal directory.

The internal directory is listed first in the directory order, and I've confirmed that the user was created in the internal directory. When I try to login, the UI says the username/password is invalid, but the logs say:

```
WARN [atlassian.seraph.auth.DefaultAuthenticator] login login : 'internaluser' tried to login but they do not have USE permission or weren't found. Deleting remember me cookie.
```

I have verified that this user is a member of both the confluence-user (doesn't this enable USE?) and confluence-admin groups.

I'm running Confluence 4.2 and Crowd 2.4.

How do I fix this?


Answers:
author: Colin Goudie
body: You can't. When SSO is enabled you MUST log in via a Crowd user.

This changed back I think when they added embedded crowd to Confluence

comments: author: dchisholm
body: But then it's not possible to edit any properties of the Crowd directory since it's in-use by your active login account.

I want to keep a local admin directory in the internal directory which I can then use to edit the Crowd directory settings.

Is the solution to switch out the SSO authenticator with the default one whenever I need to use the internal directory?


author: Colin Goudie
body: Yeah pretty much, you disable the SSO authenticator in seraph-config.xml and reboot, do the fixes, and revert, reboot. Very annoying.

I was trying to find the small clause in the documentation that says this but can't find it now. If I find it I'll post it here


author: j
body: it's been taking long time to fix this problem for me. I disabled SSO and finally I can login with a internal account !!


author: Sebastian Kouba
body: Saying this is ridiculous is an inderstatement. So if I need to make changes to my crowd directory I have to:

- disable sso

- restart jira

- make the changes

- enable sso

- restart jira?

Come on. Those are supposed to be integrated tools by the same vendor!


author: Lari Peltokangas
body: You can just change the url to the crowd directorys edit page to still edit it.

right click the "synchronise" link

--\> copy url

(example [https://confluenceurl.com/plugins/servlet/embedded-crowd/directories/sync?directoryId=xxxxxxx\&atl_token=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx](https://confluenceurl.com/plugins/servlet/embedded-crowd/directories/sync?directoryId=xxxxxxx&atl_token=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx))

--\> change "sync" to "edit"

--\> profit


author: christopher.sentman
body: Worked for me (v.6.5.0)! Thanks Lari!


author: Colin Goudie
body: Here it is, on this page

<https://confluence.atlassian.com/display/CROWD/Integrating+Crowd+with+Atlassian+Confluence>

|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| It is possible to define multiple user directories in Confluence. However, if you enable SSO integration, you will only be able to authenticate as users from the Crowd server defined in the `crowd.properties` file. |

comments: author: Colin Goudie
body: Yeah, I wouldn't call it a feature


author: dchisholm
body: Thanks Collin. Not the answer I hoped for, but at least I can quit searching.


author: Topher dailing
body: would this also affect my ability to add users to a newly created group in confluence? cuz i cant add users to groups now.


author: Bryan Stephenson
body: What worked for one of my users getting this log message was clearing the browser cache and killing all browser process instances, then starting a fresh browser process. The error no longer occurred.


Tags: crowd

login

sso