youngmon/atlassian-qna huggingface dataset:
Crowd cannot see some users
Asked by Plexus ALM Support:

Crowd cannot see some users...where would I begin to troubleshoot this?

Thanks,

Alex


Answers:
author: Daniel Borcherding
body: Hello Alex,

What do you mean when you say it is unable to see some users? How are you populating users into Crowd? Are you coming from another external user directory like LDAP? Are you creating users manually?

If you are talking about LDAP, can you identify any common thread to users that are not showing up? Are they a part of a similar group? Do they all have some common property?

We are happy to help, we just need more info.
Crowd and Google usernames
Asked by Philip Colmer:

The documentation for Crowd's Google Apps connector states:

"Usernames must exist in Google Apps as well as Crowd and a person's username must be the same in both Google Apps and Crowd. The Crowd Google Apps connector does not support the automatic adding of users. If a user exists in Crowd but not in Google Apps, then the user will not be able to log in to Google Apps."

If I export from Google a list of my accounts, the CSV file has a column labelled "account_name" where the values are [firstname.lastname@example.com](mailto:firstname.lastname@example.com).

For Crowd, do I make the cn equal to firstname.lastname only or do I make it equal to firstname.lastname@example.com?

It may be pertinent to state that this is Google Apps for Business, and @example.com is my managed domain.

Thanks.


Answers:
author: LuizA
body: Hello Philip,

If your username in Google Apps is "[firstname.lastname@example.com](mailto:firstname.lastname@example.com)." (I mean, if this is the username that you use to login into the Google Apps) so the cn for Crowd needs to be "[firstname.lastname@example.com](mailto:firstname.lastname@example.com)". I hope this helps.

Cheers,

LJ.


author: Philip Colmer
body: Hi Luiz

Thank you for this.

Since I am also using LDAP for server logins, the current server configuration won't support full usernames but will work with the bit before the @. This would suggest that I need to have two "cn" entries per user - one with just firstname.lastname and one with [firstname.lastname@example.com](mailto:firstname.lastname@example.com).

That is quite an administrative overhead and a potential risk of typing mistakes.

Is there any way to get Crowd's Google/SSO implementation to strip or add the bit after "@" so that I only need one cn entry?

Thanks.

Philip

comments: author: Philip Colmer
body: I've now realised that Unix logins will check against the uid attribute so I don't need two cn entries. This means that cn can be [firstname.lastname@company.com](mailto:firstname.lastname@company.com) and uid can just be firstname.lastname.

I've also "discovered" LDAP Account Manager which makes maintaining the underlying LDAP entries a breeze.
Apache Crowd Connector - Integration of ThirdParty Authenticator
Asked by Karanam Subbarao:

We are currently trying to upgrade Crowd from 2.0.7 -\> 2.5.1 along with upgrade of other tools.  
Currently our firm has its own authentication mechanism. We would like to use Crowd as basically authorization but authenticate with our authentication.   
What should be configuration in Apache Crowd Connector to disable authentication and enable authorization. ? How should I pass the details of the user


Answers:
author: Karanam Subbarao
body: I fixed this by changing the Apache Crowd connector code by Getting the user id via HTTP Header and creating tthe crowd session


author: PauloP
body: Hi Karanam

I'm not quite sure, but if you might using/integrating CROWD with another external authenticator, you'll have to add a valid JAVA class for that. For further details, please use the following link as your guideline:

<https://confluence.atlassian.com/display/CROWD/Overview+of+SSO#OverviewofSSO-HowItWorks>

Anyway, raise a new support ticket for further assistance.

Cheers,

Paulo Renato


author: PauloP
body: Hi Karanam

I'm not quite sure, but if you might using/integrating CROWD with another external authenticator, you'll have to add a valid JAVA class for that. For further details, please use the following link as your guideline:

<https://confluence.atlassian.com/display/CROWD/Overview+of+SSO#OverviewofSSO-HowItWorks>

Anyway, raise a new support ticket for further assistance.

Cheers,

Paulo Renato


author: PauloP
body: Hi Karanam

I'm not quite sure, but if you might using/integrating CROWD with another external authenticator, you'll have to add a valid JAVA class for that. For further details, please use the following link as your guideline:

<https://confluence.atlassian.com/display/CROWD/Overview+of+SSO#OverviewofSSO-HowItWorks>

Anyway, raise a new support ticket for further assistance.

Cheers,

Paulo Renato


Tags: apache
How do I setup crowd so I do sync users from LDAP but have local groups?
Asked by Sorin Sbarnea (Citrix):

How do I setup crowd so I do sync users from LDAP but have local groups?


Answers:
author: Septa Cahyadiputra
body: Hi Sorin,

As of now, Crowd does not provide the ability to use local group membership for **CONNECTOR** directory type. Due to your query, we proceed to create a feature request regarding this issue here:

* [Allow Connector Directory to Mapped LDAP user with Local Membership](https://jira.atlassian.com/browse/CWD-3020)

We highly recommend you to add yourself as a watcher so that you would be updated, vote on it to increase its popularity and please feel free to address your concern directly into it. As I believe this would be a good addition for Confluence I have personally add my vote into it to raise the popularity of the issue.

For more information about how Atlassian implement New Features, please see the [Implementation of New Features Policy](http://confluence.atlassian.com/display/DEV/Implementation+of+New+Features+Policy).

Furthermore, if this is a more urgent matter, we can refer the case to one of our [Experts](http://www.atlassian.com/resources/experts), that provide professional services and could possibly create a tailored solution to implement the functionality.

Please let us know if there is anything else we can do. Thank you for your understanding.

Cheers,  
Septa Cahyadiputra


Tags: active-directory
How to I import groups memberships into crowd?
Asked by Sorin Sbarnea (Citrix):

I managed to import my LDAP users from ldap-connector to ldap-delegated and now I need to reassign users to the groups that are managed inside crowd.

I do have a CSV file with \`name,group\` but how I am supposed to import this?

So far the only way to import groups that I found was when you import an entire directory into a crowd-local directory, but I am not able to use a local directory because LDAP authentication is a must.


Answers:
author: Sorin Sbarnea (Citrix)
body: This is possible in Crowd, the only trick is to use the Import Users feature and give an empty csv file (only with headers) and the group membership one.

It works, I used it several times with more than 20.000 memberships.

comments: author: Kensuke Karukomi _?? ??_
body: I've confirmed that your method is still effective at Crowd 3.4.5.   
Thanks!


author: mika nokka
body: Tnx, using this trick I was able to import users and groups and then add users to correct group. (not multiple , just one)


author: mika nokka
body: When one has as many username groupname enries in groups csv (individual lines), then that username will be added to all these groups. This requires first normal import phase: users.csv - multigroups.csv and then the second import phase: emptyusers.csv- multigroups.csv


author: Yilin
body: Hey Sorin,

It is currently not possible within a native way in Crowd, but I think you can do a trick if you're using Mysql or PostgreSQL database which allow to dump the data from CSV file, you can dump the group data in the table cwd_group then dump the membership data in the table cwd_membership. :)

Cheers

MOMO


Tags: active-directory

group
Suggestions for moving to Crowd SSO with Google Apps?
Asked by Philip Colmer:

We currently have over 150 users set up on Google Apps. I want to implement an LDAP server with Crowd so that I have a centralised platform that can be used for Google authentication (SSO) plus Crowd/LDAP authentication with other platforms.

As I understand it, once I've enabled SSO on Google Apps, all login requests will be directed to Crowd. This would seem to make it quite difficult to test SSO/Crowd without affecting all users.

Also, once I've populated the LDAP directory, I need to get the users to set their desired passwords so that when SSO \*is\* turned on, they know what password to use.

Has anyone gone through a similar process and got suggestions to share on how best to tackle these issues?

Thanks.


Answers:
author: Philip Colmer
body: If a business is using Google Apps, they get their own URL which users must enter if they want the redirect to go off to Crowd. If users use the generic URL, e.g. [www.gmail.com](http://www.gmail.com,), they still get authorised by Google Accounts.

Also, it is possible to put a netmask into the SSO configuration on Google, ensuring that the redirect only happens if the user is on the correct network.


author: Philip Colmer
body: Reading this question:

<https://answers.atlassian.com/questions/29680/crowd-sso-with-google-apps-assistance>

it looks, from one of the answers, as if users can actually override the SSO process and continue to log in with the Google authentication?

"Please note that as long as users' passwords are synced between your LDAP system and Google, users can bypass the SSO login system by signing in directly to Google."

If that is the case, it would seem that I can:

a) populate LDAP and get staff to start setting their passwords.

b) set up SSO on Google and tell staff not to use it. I think I could even enforce that by using the Crowd settings to restrict who is allowed to log in via SSO.


Tags: google-apps
disable logins for maintenance
Asked by Plexus ALM Support:

How could I disable logins to performance maintenance? Would my only choice be to remove the allowed groups in Crowd and then re-add them after the maintenance is finished.


Answers:
author: Septa Cahyadiputra
body: Hi there,

If the purpose is to ensure that there are no one adding any content into your Confluence instance, you might want to consider making Confluence as a "Read-Only" which describe on our knowledge base FAQ here:

* [How to make Confluence Read-Only](https://confluence.atlassian.com/display/CONFKB/How+to+make+Confluence+Read-Only)

Hope it helps.

Cheers,  
Septa Cahyadiputra

comments: author: Plexus ALM Support
body: Will those timebomb licenses only work with Confluence?


author: Fuad Moghe
body: You should also be able to remove the view (can use) permissions from the confluence users group under Administration - Security - Global permissions.

Regards

comments: author: Plexus ALM Support
body: I don't have Confluence.


Tags: maintenance
Adding a welcome page with list of atlassian products after login in CROWD
Asked by Emidio Stani:

Hi all,

In my organization we have CROWD as SSO between the atlassian products.

The client is asking if it is possible to add an intermediate page, after the successful login, with links to the current applications, so the idea would be redirect the login in CROWD to the intermediate page where the user can choose which application want to enter.

I don't believe is feasible without development, thanks for confirming that.

Alternatively we could let the user login in JIRA and put the links to the other applications in the introduction gadget.


Answers:
author: Daniel Borcherding
body: Hello Emidio,

You are correct in your assumption that this behavior is not possible without some further development. Crowd uses a rest service to communicate with all of the Atlassian Applications. That service only handles and authrozation challenge and response. There is no way that I am aware of to push extra data, like the other applications Crowd is configured to provide authorization for, across this serivce. I would be happy to file a feature request for this functionality, but I am not sure that it would gain a lot of traction.

Your stopgap solution of providing an information blurb about and link to the other services your company uses is probably the best one. We have a document on how to customize the login screen in Confluence that I will include below. This may be the most appropriate place to put this information as users will only be exposed to it once and not continually shown links to your other products.

<https://confluence.atlassian.com/display/DOC/Customising+the+Login+Page>

Please let us know what else we can to to help!
Crowd/Apache connector on Windows
Asked by Matthew J. Horn:

Can someone at Atlassian confirm or deny that development of the 2.0 connector has been abandoned?

This page shows a history of ignoring customers' request for information:

<https://confluence.atlassian.com/display/CROWD/Installing+the+Crowd+Apache+Connector+on+Windows>

We need a solution, and it's looking more and more likely that we'll have to contract out to get one written.


Answers:
author: Rodrigo Girardi Adami
body: Hi Matthew,

I think that for now the developers are not focusing in this crowd/apache connector since the 1.3 still works. I couldn't get in touch with one so I'll leave this question open as a dev can participate and give more detailed asnwers on this.

Regards,

Rodrigo

comments: author: Matthew J. Horn
body: Great, I will be giving it a try when we're done setting up a test environment. If this works, it will be a big win. Thanks!

matt


Tags: apache

authentication

connector
2 Directories in Crowd connected to 2 branches of LDAP - can user-group mgmt be done in JIRA
Asked by Archanaa Panda:

Hi,

We are planning the deployment architecture for Atlassian suite for our enterprise.

We will have both employees and non-employee users using the Atlassian Suite.

One possible configuration that we are favoring is that we will use OpenLDAP to maintain users and groups. We will create 2 different OUs or branches in LDAP and possibly have replication at LDAP to other geographies.

Our concierge uses JIRA for creating users and groups, right now. We are wondering if we can continue to use JIRA in the below scenario to be the user interface for managing users and groups.

1 LDAP

connected user \|

JIRA -----------\> Crowd ---------\> Dir1-------\> Branch for employees

\| \| \|

\| \| \| \| (mapping)

\| \|group \| /

\| -------\| Branch for groups

\| -------\|

\| \| group\| \| (mapping)

\| \| \| /

\|-----------\> Dir2-------\> Branch for non-employees

user

Now, if we give JIRA application privileges to Crowd for creating users and therefore to LDAP, does that mean that if we create/manage users and groups and memberships they will be created properly in LDAP?

If not, what is the best user interface you can propose for easily creating users and groups and memberships in atlassian suite to the OpenLDAP Directory.

We are using JIRA, Confluence, Fisheye and doing SSO with Crowd. We are open to deploying any plugins (like Teem) that will help in managing users and groups and memberships for the whole suite.


Answers:
author: Archanaa Panda
body: Hi, I got an answer from Atlassian support on [support.atlassian.com](http://support.atlassian.com). Apparently, if we use JIRA to create the users and groups in the above scenario, where we have 2 different branches of LDAP, JIRA would create the users and groups in the first directory mapped to it only. If we want users and groups in separate branches of LDAP, we could use 2 JIRA servers instead of 1, one mapped to each directory of crowd and further to different branches of LDAP.


author: Septa Cahyadiputra
body: Hi there,

If the Crowd directories configured to have [the permission](https://confluence.atlassian.com/display/CROWD/Specifying+Directory+Permissions) to write into your OpenLDAP and the LDAP user that used by Crowd to bind your LDAP server has the privilege to write into your LDAP server, your setup should work fine.

Hope it helps.

Cheers,  
Septa Cahyadiputra


Tags: ldap

user-management
SSO across different domains
Asked by Daisuke Niwa:

Hi there

Quick question about Crowd SSO.

Is it possible to establish SSO across different domains, such as between [aaa.bbb.com](http://aaa.bbb.com) and ccc.ddd.com?

I know it's possible when the root domain name is same, but what about cases like above?

I appreciate your input.

Regards,

Daisuke Niwa


Answers:
author: joe
body: Unfortunately, cross-domain SSO is not currently possible when there is no domain in common. There is an open feature request ([CWD-1240](https://jira.atlassian.com/browse/CWD-1240)) to add this to Crowd.

comments: author: Daisuke Niwa
body: Joseph,

Thank you for your quick response. Understood the situation.
Anyway to edit the format after a ticket is created?
Asked by N3B Software:

I created a custom field with a multi pick user from AD. It worked great but i would rather it display in details , rather than under people. Is there a way to change the layout so when an agent is assigned a ticket they can see the users in details rather on the right side where they are not used to looking for valuable information?![image (1).png](https://community.atlassian.com/t5/image/serverpage/image-id/336453i1FECB48AC94C86E5/image-size/large?v=v2&px=999 "image (1).png")


Answers:
author: Graham Twine
body: Hello [@N3B Software](/t5/user/viewprofilepage/user-id/5123793)

The quick answer is no if you want to keep the user picker field type. I recommend you do.

The screen is categorized into [fragments](https://developer.atlassian.com/server/jira/platform/web-fragments-4227124/)

Fragments contain things such as Top Nav, project side bar, Jira view left context and Jira view right context.

In the right context panels are broken into People, Dates, Development and some plugin that has registered something to a UI fragment.

Any data picker you add to the instance will appear under the Dates panel.


Tags: jira-service-desk-data-center

jira-service-management

jira-service-management-data-center
Customer/User is Defaulting to Single Project Board with Access to Others
Asked by Brooke Smither:

Situation:

* We are an organization that utilizes external business relationships that require access to Jira to provide customer support and execute business.

Backgound:

* I have multiple Customers that require being Customers on a \[project to which they already have portal access for "Project A".
* After having built a new \|Project B" and adding the Customers as Users and admin-approved "People" to a project dashboard, when the resources click the link to the "Project B Dashbord" to which they are added, they are being default routes to the "Project A Portal" view which is VERY limited.

Assessment:

* It was my hope that adding them as customers to the new board and granting Service Desk Team Member permissions on Project B, which I have, AND adding them as People to the "Project B Dashboard" they could see the tickets in Project B with no issue.

Request:

* Is this a limitation or purposeful functionality of Jira SM, or am I missing something?
* We are looking to avoid Agent status due to cost and privacy/compliance requirements - which is why we created a separate project for them.


Answers:
author: Kevin Patterson
body: Hi [@Brooke Smither](/t5/user/viewprofilepage/user-id/5514758) ,

If I understand what you are trying to do correctly, It sounds like the users you added to the project B have a product role of Customer only (non-licensed users). You will want to update this to be User(Agent) if you want them to have agent access to one of your JSM projects.

![permissions.png](https://community.atlassian.com/t5/image/serverpage/image-id/336459i81BD968A28B4DBF1/image-size/large?v=v2&px=999 "permissions.png")--

I'd recommend adjusting your existing group or creating a new group that contains your users that need customer access to project A and agent access to project B and adding the appropriate product roles.

Edit: I should mention that Access to Dashboards requires an agent license.


Tags: cloud

externalusers

jira-service-management

jira-service-management-cloud
Jira Service Desk Mailbox Issue
Asked by Gabi DAbato:

We have our Jira service desk set up to create a ticket every time an email is sent. It works for all emails on individuals but does not create a ticket for mailbox emails that come from a group. Are there settings that I need to toggle or do I need to change my automations for this to work?


Answers:
author: Victor Law
body: Hi [@Gabi DAbato](/t5/user/viewprofilepage/user-id/5521353)

Welcome to the Atlassian Community.

Have you tried to add the email address to the JSM's allowlist?

<https://support.atlassian.com/jira-service-management-cloud/docs/manage-your-allowlist/>

Thank you.

comments: author: Gabi DAbato
body: Hi Victor,

<br />

Thank for the response! I did just try it now and it is still not working for some reason. Could it be global settings that need to change?


author: Victor Law
body: Hi [@Gabi DAbato](/t5/user/viewprofilepage/user-id/5521353)

I strongly suggest you check for a warning in the email processing log to identify the specific reason why the email is not being converted into a Jira issue.

<https://confluence.atlassian.com/jirakb/how-to-download-email-processing-logs-for-jsm-email-handlers-1188420551.html>

Thank you.


author: Gabi DAbato
body: Victor- That helped me figure out that I needed to get out IT department to add those mailboxes to approved users on Jira. Thanks for your help!


Tags: cloud

jira-service-management

jira-service-management-cloud
Updating Automation Rule to update More Fields of an Issue
Asked by David Clark:

To update more fields on an issue or ticket in a JIRA project using information from the description inside of an email.

I'm just trying to autofill more fields, like the Part Number custom field, from the details inside an email that created the issue, which has the Part Number in the email.

I tried this logic, but it didn't work.  

{

"fields":

{ "Part#": { "name": "{{issue.description.substringBetween("Part#: ", "\\n")}}" },

"Part#": "{{issue.description.substringBetween("Part: ", "\\n")}}" } }


Answers:
author: Manav Shah
body: [@David Clark](/t5/user/viewprofilepage/user-id/5547249) can you try the below?

{  
"fields": {  
"customfield_XXXXX": "{{issue.description.substringBetween("Part#: ", "\\n")}}"  
}  
}

comments: author: David Clark
body: That kind of worked it just updated the label add the top to put the name Part#.

I need it to auto-populate the Part Number so that when I am in a Que, I search for a part number to see how many of that Part # to order.

The info I want is in the Summary field, its just not searchable and I don't see a way in the rules automation to use the Summary field to pull data from?


author: Manav Shah
body: [@David Clark](/t5/user/viewprofilepage/user-id/5547249)   

{{issue.summary}} to reference summary if that is what you mean


author: David Clark
body: Its not working.

Does it matter if the issue is created from an email?

The information is in the subject line, along with the description of the issue.

It's not pulling part # 12345 description plug

Subject: Part#12345

Part# 12345

Description Plug.

I want it to grab Part#12345 out of the issue and put it on the label called Part # on the central Issue Page so that I can search for Part#12345


author: Manav Shah
body: could you like screenshot your flow or something, so I can understand better?


author: David Clark
body: ![image.png](https://community.atlassian.com/t5/image/serverpage/image-id/337101i3658378297845355/image-size/large?v=v2&px=999 "image.png")


author: Manav Shah
body: {  
"fields": {  
"customfield_XXXXX": "{{issue.summary.match("Part#\\d+")}}"  
}  
}  

<br />

use custom field ID, don't use the name of field. try it once


Tags: cloud

cloud-automation

jira-service-management

jira-service-management-cloud