youngmon/atlassian-qna huggingface dataset:
What is the recommended maximum number of users for crowd with external LDAP Sync ?
Asked by Kumaran:

**What is the recommended maximum number of users for Crowd with **external LDAP Sync**?**

We have few hundred thousands of users/groups in our active directory (\~500K). We have been trying to cache the entities by a full synchronization, which always times out.

So my question here is to check if there is any LDAP limitation. Is delegated authentication the recommended approach for our sizing ? Does delegated authentication approach's limitation based on sizing of the database ?


Answers:
author: Bruno Vincent
body: Hi Kumaran,

Atlassian recommends to leave caching disabled for very large user bases. Please, check out [this page](https://confluence.atlassian.com/display/CROWD/Configuring+Caching+for+an+LDAP+Directory#ConfiguringCachingforanLDAPDirectory-FindingtheTimeTakentoSynchronise).

*"**Be aware of the optimal number of users.** We have optimised the database caching for directories containing approximately 10 000 (ten thousand) users. If your directory is significantly larger, the new caching may not be as beneficial. For really large user bases, we recommend that you leave the caching disabled."*

Have you considered splitting your AD configuration in multiple directories in Crowd (let's say, one per OU if that makes sense in your AD) and then check "Aggregate group memberships across directories" in the application configuration view?

Regards,

Bruno


Tags: crowd-administration
Jira and Confluence authentication and SSO
Asked by Greg T:

We are in the process of spinning up a service desk, and looking to utilize Confluence as the knowledgebase (KB) add in. Our current setup is JIRA is integrated with our Active Directory and also serves as our user repository for Confluence.

When a user is entering an issue from the customer portal, it searches and presents results pulled from Confluence which works great, the problem that we are trying to solve is when a user clicks on one of these results it then prompts for credentials even though both are using the JIRA user repositofy. What is the best way to prevent the user from having to authenticate into Confluence to view the KB info?

I know "Crowd" can offer a solution, I would prefer not to license and maintain another product just to meet this single need. I feel I may be missing something with the Application links and the associated authentication configuration as a potential solution.


Answers:
author: Steven F Behnke
body: If you want Single-Sign On, **the** Atlassian solution is a single directory within Crowd and using the Crowd-Seraph SSO Plugin in each client application.


author: GabrielleJ
body: Yes, the "Application Links" is the way to go. I always wanted the "Trusted Application" links (which will not require any authentication prompt ever and that means these 2 applications fully trust each other) or you can use OAuth (which will require them to log-in one time). Using the former requires that JIRA and Confluence have the same set of users, if not you can only use OAuth.

<https://confluence.atlassian.com/doc/integrating-jira-and-confluence-2825.html>
Where can I reconfigure the Timed call for search with handler timeout value?
Asked by Sorin Sbarnea (Citrix):

Where can I reconfigure the Timed call for search with handler timeout value?

Our logs are filled with a huge number values that are between 1000ms-1150ms and we assume that's because this message is logged only when the duration goes above 1000ms.

\`\`\`

2015-10-08 18:51:58,865 http-bio-8095-exec-958 INFO \[crowd.directory.ldap.SpringLdapTemplateWrapper\] Timed call for search with handler on dc=citrite,dc=net took 1073ms  
2015-10-08 18:51:59,923 http-bio-8095-exec-958 INFO \[crowd.directory.ldap.SpringLdapTemplateWrapper\] Timed call for search with handler on dc=citrite,dc=net took 1057ms  
2015-10-08 18:52:00,557 http-bio-8095-exec-849 INFO \[crowd.directory.ldap.SpringLdapTemplateWrapper\] Timed call for search with handler on dc=citrite,dc=net took 1069ms  
2015-10-08 18:52:00,654 http-bio-8095-exec-912 INFO \[crowd.directory.ldap.SpringLdapTemplateWrapper\] Timed call for search with handler on dc=citrite,dc=net took 1078ms  
2015-10-08 18:52:01,699 http-bio-8095-exec-844 INFO \[crowd.directory.ldap.SpringLdapTemplateWrapper\] Timed call for search with handler on dc=citrite,dc=net took 1432ms  
2015-10-08 18:52:02,031 http-bio-8095-exec-912 INFO \[crowd.directory.ldap.SpringLdapTemplateWrapper\] Timed call for search with handler on dc=citrite,dc=net took 1369ms  
2015-10-08 18:52:02,497 http-bio-8095-exec-755 INFO \[crowd.directory.ldap.SpringLdapTemplateWrapper\] Timed call for search with handler on dc=citrite,dc=net took 1372ms  
2015-10-08 18:52:02,783 http-bio-8095-exec-844 INFO \[crowd.directory.ldap.SpringLdapTemplateWrapper\] Timed call for search with handler on dc=citrite,dc=net took 1083ms  
2015-10-08 18:52:03,124 http-bio-8095-exec-912 INFO \[crowd.directory.ldap.SpringLdapTemplateWrapper\] Timed call for search with handler on dc=citrite,dc=net took 1092ms

\`\`\`

Also please note that this is the fastest DC from a forest of 38! The root cause is related to the way crowd queries are performed.


Answers:
author: Tayyab Bashir
body: Hi,

<br />

I am using JIRA Server 7.2.6, and I have an open LDAP directory.  
I am using a similar issue.  
My issue is that the directory auto syncs after 1 hour and it takes about 50 minutes to sync in total .  
So basically it is syncing all the time. And the entires for syncronisation of the groups is always coming in the logs.

Did you find anything related to this? How to increase the lookup time or how to stop the entries from popping in the logs?


author: William Ing
body: This, ignored, bug may be related to this issue <https://jira.atlassian.com/browse/CWD-4179>
crowdid authetication
Asked by shailesh ligade:

Hello,

I have crowdid authentication working, and it is great. However, I am seeing a issue. When I pass my userid to validate, crowdid sends me back my given name as authenticated user, is it possible to configure crowdid to send back userid, as authenticated user instead?

Thanks

S


Answers:
author: shailesh ligade
body: Also, is there a way to whitelist all the sites user may visit, and preset with allow-always, that way user will never see crowdid page? This is all on intranet, so no need for user to open crowdid page.


author: shailesh ligade
body: if I can create default profile for users, it will do what I want it to do. Is there a way to edit default profiles of all the users?


Tags: crowd-administration
Multiple jira connected to a single Crowd
Asked by Software Asset Management:

Hi Team,

We running multiple Jira in a single server and these servers will be integrated with the same crowd for the user management as two different Jira applications.

When one user is logged into 1 instance of Jira and if he tries to login to the other instance of Jira, he is being logged out from the 1 instance.

Is there any limitation in adding an application in Jira, how can we resolve this issue where the same person can be logged into the two the Jira instances simultaneously.

Thanks  
Fahad V A


Answers:
author: Bharadwaj Jannu
body: Check the link:

<https://confluence.atlassian.com/display/JIRAKB/User+is+constantly+logged+out+of+JIRA>


Tags: crowd-administration

jira

jira-administration
My users are in Crowd and I want to migrate them to Okta. Any support for moving users to and IDP?
Asked by Tom Kozanecki:

My users are in Crowd and I want to migrate them to Okta. Any support for moving users to an IDP (Okta)?

API available? CSV export from Crowd?


Answers:
author: Nic Brough -Adaptavist-
body: There's no support for external users on Cloud - the best Okta can do is store the user credentials and log in for them.

But, you'll still need the list of users to help build the Okta side and I don't think there's an easy way to get a list.


Tags: cloud
What triggers a Full Crowd Synchronization vs Incremental?
Asked by David Lunsford [Agency Consulting Group]:


Answers:
author: Pedro Cora
body: Incremental is triggered if you choose in the Directory Settings. Otherwise, the Full will be the one to run. Also, when the incremental is enabled, the Full should only run when you disable and enable the directory.

comments: author: Richard Cross
body: If you find the directory always performs a full sync, even though you've selected Incremental... are there any particular troubleshooting steps to follow?


author: Dario B
body: [@Richard Cross](/t5/user/viewprofilepage/user-id/664850) Can this be same behavior described in below feature request?

* [\[CWD-3717\] Allow incremental sync when a remote Crowd delegated authentication directory is used](https://jira.atlassian.com/browse/CWD-3717)


Tags: sync
Crowd Setup Wizard does not start
Asked by Vasanth makam:

2015-10-02 09:43:24,393 localhost-startStop-1 INFO \[service.soap.client.SoapClientPropertiesImpl\] Loading property: '[application.name](http://application.name)' : 'crowd-openid-server'

2015-10-02 09:43:24,393 localhost-startStop-1 INFO \[service.soap.client.SoapClientPropertiesImpl\] Loading property: 'application.login.url' : '<http://localhos>

t:8095/openidserver'

2015-10-02 09:43:24,393 localhost-startStop-1 INFO \[service.soap.client.SoapClientPropertiesImpl\] Loading property: 'session.tokenkey' : 'session.tokenkey'

2015-10-02 09:43:24,393 localhost-startStop-1 INFO \[service.soap.client.SoapClientPropertiesImpl\] Loading property: 'session.lastvalidation' : 'session.lastva

lidation'

2015-10-02 09:43:24,393 localhost-startStop-1 INFO \[service.soap.client.SoapClientPropertiesImpl\] Loading property: 'session.validationinterval' : '0'

2015-10-02 09:43:24,393 localhost-startStop-1 INFO \[service.soap.client.SoapClientPropertiesImpl\] Failed to find value for property: cookie.domain

2015-10-02 09:43:24,395 localhost-startStop-1 INFO \[service.soap.client.SoapClientPropertiesImpl\] Loading property: 'crowd.server.url' : '<http://localhost:809>

5/crowd/services/'

2015-10-02 09:43:24,506 localhost-startStop-1 INFO \[server.manager.site.ApprovalWhitelist\] Using file as a site approval whitelist: /opt/atlassian/crowd/crowd

-openidserver-webapp/WEB-INF/classes/crowdid.approval-whitelist

2015-10-02 09:43:24,764 localhost-startStop-1 WARN \[org.openid4java.server.RealmVerifier\] RP discovery / realm validation disabled;


Answers:
author: Giuliano C.
body: So far, the warning it looks related to the OpenID usage for Crowd that was affecting it in versions below than the 2.8.2 one: <https://jira.atlassian.com/browse/CWD-4129>

However, since you are installing the instance and the wizard is giving you some trouble, can you check if all the connections with the DB are properly configured and also, the current content and permissions of READ/WRITE for the file system.

Hope it helps ya.

Cheers,

Giu


author: Luiz Maia
body: Hello there,

In addition to Guilherme's answer, please also make sure you're running this Crowd installation on supported platforms only: <https://confluence.atlassian.com/display/CROWD/Supported+Platforms>

Regards,  
LM


author: Guilherme V.
body: Hey there,

It would be better if you could share the ERROR lines that you have in Crowd logs.

Nevertheless, maybe this documentation can help you:

* [Running the Setup Wizard](https://confluence.atlassian.com/display/CROWD/Running+the+Setup+Wizard)

Cheers,
crowd apache connector performance issues
Asked by shailesh ligade:

Hello,

I am using crowd apache connector for SVN SSO with crowd.

The SSO configuration is working fine and I can see it from browser as well as IDE/Tortoise SVN client etc.

configuration is:

AuthName "Atlassian Crowd"  
AuthType Basic  
AuthBasicProvider crowd  
CrowdAppName \<SVN APP NAME\>  
CrowdAppPassword \<SVN APP PWD\>  
CrowdURL [https://\<CROWD HOST\>:9443/crowd/](https://united1-crowd.sat.cbp.dhs.gov:9443/crowd/)  
CrowdSSLVerifyPeer Off  
CrowdCreateSSO off # Improves performance when using Subversion clients that don't store cookies

We do have many repos and each repo had its own acl with list of users defined.

We can reuse the same files for authorization as well, however, we are having performance issues. e.g. it used to take 2 sec, now it is taking 40 sec.

Is there any setting to control that e.g. cache data or not to go to crowd for every request etc?

Thanks

Shailesh


Answers:
author: shailesh ligade
body: Thanks,

Although I have

LoadModule authnz_crowd_module modules/[mod_authnz_crowd.so](http://mod_authnz_crowd.so/)

LoadModule authz_svn_module modules/[mod_authz_svn.so](http://mod_authz_svn.so/)

I am getting

CrowdCacheMaxAge not allowed here

Any suggestions.

Thanks

comments: author: shailesh ligade
body: I guess I had to add those cache options outside of location tag of apache. However, even after doing that, performance didn't improve much. What I have is crowd configuration in place, and not for each individual repo. Each individual repo location, I have specified acl file. Not sure if that makes any difference..


author: Steffen Opel _Utoolity_
body: You have two options to control the cache behavior, which are documented in [Integrating Crowd with Apache](https://confluence.atlassian.com/display/CROWD/Integrating+Crowd+with+Apache):

|-----------------------------|-------------------------------------------------------------------------------------------------------------------|-----|
| `CrowdCacheMaxAge 120`      | The maximum number of seconds that a response from Crowd will be cached by the Apache Crowd connector.            | 60  |
| `CrowdCacheMaxEntries 1000` | The maximum number of entries cached at any time by the Apache Crowd connector. If set to 0, caching is disabled. | 500 |

The last column denotes the default value, and a note further down on that page confirms that caching should already be enabled by default:
> * If the `CrowdCacheMaxEntries` setting is missing or set to a non-zero value, then requests to Crowd are cached in order to increase performance. This means that changes to passwords, group membership and session expiry in Crowd may not be reflected immediately in user access.

Given your scenario comprises many repos, you probably need to ensure that `CrowdCacheMaxEntries` is sufficiently large to avoid items being purged from the cache early and actually yield them to be cached for CrowdCacheMaxAge.


Tags: crowd-administration
How do I get Crowd to remove a user from an AD sync when the user is marked as disabled in AD?
Asked by blnrepo:

When users leave the company, or procedure is to disable their AD account, and 90 days later it gets deleted. During those 90 days, Crowd is still synchronizing them as an active user into Jira, Confluence, Crucible, etc. How can I get Crowd to recognize that it should not be importing inactive users?


Answers:
author: Bruno Vincent
body: Hi David,

You have to change the "User object filter" in the Configuration tab of your Active Directory in the Crowd console:

```
(&(&(&(objectCategory=Person)(sAMAccountName=*))(!(userAccountControl=514)))(!(userAccountControl=66050)))
```

(Don't forget to click *synchronise* afterwards)

Regards,

Bruno


Tags: crowd-administration
Have a user whose group associations disappear as he is logged in and using Jira. Believe issue is with Crowd group membership.
Asked by Lynda:

Hi - We have a user that loses his group association several times a week, even without a sync performed between Jira/Crowd/AD. What I have found is that in Crowd, the user shows an association to the group he should be in. However, when you go to the group and view the group membership, he is not listed. I have viewed the database tables to see if I could identify what is odd or missing for this user. I have yet to identify anything. In order to address this, at first, we could perform a sync between AD/Crowd then Crowd/Jira. Now, even that will not work. He will show in Jira, but still not having the group association. I had to add him to an additional group in AD (with greater access) and sync all the way through the system. Then perform the test login feature from the JIRA Administration\>User Directories page with the user for his regular group to show in JIRA. Then after a day or so, it disappears again. This is too much work for something so simple and for one user only. Any ideas on what in Crowd is not recognizing him as a member of the group?

Thank you in advance!


Answers:
author: Guilherme V.
body: Hi There,

You are probably having the following bug:

* <https://jira.atlassian.com/browse/CWD-4179>

It would be nice if you could check it so you could confirm it, but I could see it has the same behaviour.

Cheers,


Tags: crowd-administration
Cannot get bamboo SSO work with crowd
Asked by Yinsong:

I have bamboo and crowd on the same server. I got the intgeration part working. Bamboo can authenticate against AD set up in crowd. I followed their link to set up SSO . However, SSO didn't work. when I was logged in crowd and open the url for bamboo. I was still asked to put in credentials again. please advise.


Answers:
author: Bruno Vincent
body: Hi Yinsong,

Did you check that the user that you used to log into the Crowd administration console belongs to a Bamboo authorized group (e.g. bamboo-admin or bamboo-user)?

You might also want to check that the Crowd cookie is sent to the server while requesting a Bamboo URL (you can use a Firefox plugin such as Live HTTP headers for instance).

Regards,

Bruno


author: Bruno Vincent
body: @Yinsong,

You can use Developer Tools in IE (Tools \> F12 Developer Tools \> Network then capture and details)


author: Yinsong
body: Thanks for your reply. I have bamboo-admin set up in crowd which means centralized authentication part works. I can only use IE in my company. How to check if the corwd cookies is sent to the server in IE?
can an XML backup be taken in Crowd without impacting Servers that use Crowd for Authentication?
Asked by robert.sanders:

We are planning to upgrade our crowd 2.6.4 production server and we need to backup the server to an XML file.

The question has come up whether authentication services are degraded or blocked during while creating an XML back up of the database from the admin GUI.

Specifically, is there a chance of authentication problems in JIRA and Confluence while the backup is being created?

thanks in advance,

-rob


Answers:
author: Rodrigo Girardi Adami
body: Hi Robert,

You should be able to take a XML backup from the application. The services should not be disrupted unless an out of memory error happens in the process.

Since this is a production, I recommend to schedule a maintenance window and then proceed with the XML backup for safety reasons.

Cheers,

Rodrigo


author: robert.sanders
body: thanks!
Integrated Windows Authentication for Apps using Crowd (IWAAC)
Asked by Bruno Vincent:

Hi,  

Not really a question, more like an announcement. We are actually proud to announce the release of our new add-on, Integrated Windows Authentication for Apps using Crowd (IWAAC) at <https://marketplace.atlassian.com/plugins/com.cleito.iwaac>  

IWAAC uses Kerberos to allow your Windows domain users to log into Jira, Confluence, Bamboo, Bitbucket Server, FishEye, Crucible or any other web app using Crowd as its user management system, without entering a password.  

Best regards,  

Bruno


Answers:
author: Thiago Zandona
body: Hi Bruno,

This add-on will certainly facilitate our user's life. As I could see is pretty smooth the way it does the authentication. Allow me to paste here also the link to the documentation so everyone that comes here see in detail about this:

<https://www.cleito.com/products/iwaac/documentation/>

Great one! :smile:

Cheers


author: Bruno Vincent
body: Hi Thiago,  

Thank you for your comment!  

About the documentation, we have tried to make it as detailed as possible. However, if you encounter any issue, feel free to contact us at [support@cleito.com](mailto:support@cleito.com)  

Regards,  

Bruno


Tags: addon-com.cleito.iwaac

authentication

bamboo

bitbucket

confluence

crowd-administration

fisheye-crucible

jira

kerberos

sso

windows
Crowd to WordPress
Asked by Sam Lander:

I'm exploring Crowd as a account CRUD and Authentication mechanism to sit behind/beside WordPress.

The available material (and it is a little old now) says that the road ahead is not simple. Commonly people point me away into OpenAM. Is there a straightforward article covering "WP \<-\> Crowd", or "WP -\> Crowd"?


Answers:
author: Craig Castle-Mead
body: We use <https://github.com/broadinstitute/wordpress-crowd-plugin> and it works well - looking to add SSO support as it doesn't do that.

comments: author: D?ng Nguy?n T?
body: Hi Craig, I'm developing SSO function for that plugin to integrate my system. But it seem the token key is wrong. Did you finished SSO function for that plugin?


Tags: crowd-administration
Authentication against internal crowd in Atlassian cloud
Asked by Steve Gargan:

We're currently deploying a Crowd server internally and have a number of different applications authenticating against it. We'd like to move to cloud hosting for our Atlassian products and would like to be able to authenticate our apps against the internal version of crowd in cloud. Is this possible?


Answers:
author: gustavo_refosco
body: Hi Steve,

This isn't possible as users of applications hosted internally can't be managed by Cloud, and the same goes for the opposite way. That being said, all your users in Cloud applications must be managed within Cloud.

If you are going to use JIRA Cloud, it can manage your users also for Confluence Cloud and Bamboo Cloud.

Going further and assuming you will likely need to have all the users you currently have in Crowd imported into your Cloud applications, you can follow the steps in <https://confluence.atlassian.com/pages/viewpage.action?pageId=442271568> to export your Crowd users to a CSV file, so the Cloud Team in Atlassian Support can import then to your Cloud instance.

Regards,

Gustavo Refosco


Tags: crowd-administration
CROWD - JIRA/CONFLUENCE - FISHEYE SSO Problem
Asked by JongBum Lee:

Hi.

Crowd SSO is causing problem

Server A : Crowd (http://1.1.1.1:8095/crowd)

Server B : Jira/Confluence (<http://1.1.1.2:8080/jira,> http://1.1.1.2:8090/confluence)

Server C : Fisheye (<http://1.1.1.3:8060)>

(Both domain and apache web server are not used.)

------------------------------------------------------

Jira, Confluence (server B) using same user sso working well.

but fisheye (server C) is not working. **must login**..

Above Environment(no domain, no apache webserver), I could not use SSO with crowd?

Please tell me the way .

Thank you


Answers:
author: gustavo_refosco
body: Hi JongBum,

I believe your issue is because you have different domains among your applications. As JIRA and Confluence domain is the same, SSO works between them, while it doesn't work between them and FishEye.

This is because the cookie used for SSO is based on the domain name. Please refer to <https://confluence.atlassian.com/display/CROWD/Overview+of+SSO> as it contains further and detailed explanation about this. You'll need to have all your applications under the same domain so SSO works among them.

Regards,

Gustavo Refosco


Tags: crowd-administration