youngmon/atlassian-qna huggingface dataset:
Mirrored groups in Crowd Internal Directory
Asked by Jeffrey Wilson:

I have inherited administration of my company's Atlassian products, including Crowd Server.

I am doing some housekeeping and it appears that a previous admin had attempted at one time to set up a Delegated directory, ditched it and went on to implement a Microsoft Active directory instead.

The Delegated directory is de-activated so I presently have an MS AD directory and an Internal Directory active.

It appears that as a result of the previous attempt at setting up a Delegated directory, all of the default groups exist in both the MS AD and Internal directories - confluence-developers, confluence-users, jira-developers and so on. Theses groups are "Active" in both the MS AD and Internal directories, but it appears that all of my users are being pulled from MS AD and that there are no users that are members in the "mirror" groups that exist in the Internal Directory.

$10,000 question - Can I delete the mirrored groups from the Internal Directory or are they there for some reason other than the probably unsuccessful attempt at setting up a Delegated directory? Again, I have looked at the groups in the Internal Directory and they have no Direct or Nested members and a a random sampling of my users shows that they are all coming from the MS AD directory.

I want to use the Internal directory for creating special groups so that I can limit their access to Applications via Crowd. (which seems to be the way to do it.)

Just don't want to start removing groups and get a million phone calls because users can't access their apps.

Thanks!


Answers:
author: Damien Tan
body: Hey [@Jeffrey Wilson](/t5/user/viewprofilepage/user-id/902630)

Groups that are mapped to the applications in Crowd always follow the directory where it came from. So even if you have 2 groups with the exact same name, as you can see they are both under different directories (in your case, one belong to your Internal Directory another one belong to AD)

You'll need to confirm is the Internal Directory mapped to the application in the first place, if it is not mapped to the application, removing the group won't affect the access to your application at all.

If the Internal Directory is in fact mapped to the application, just double confirm again if there is any direct or nested member in it. if it is empty, then removing the group won't affect your users on accessing as well.

From my understanding, the "mirrored group" seems to be empty so it is safe to be removed. You'll find your users all located in the group that is coming from the AD instead

hope this help
What is the correct way to setup Crowd with existing instances of Confluence and Jira
Asked by Gary Spencer:

First we had Confluence and setup users in it. Then we added Jira and setup users in it. Now we have Crowd. How do we get the users from Confluence and Jira into Crowd so all the existing assigned issues, tasks, pages in Confluence etc. are the same? Backwards, I know, but that's where we are.


Answers:
author: Marcin Kempa
body: Hi [@Gary Spencer](/t5/user/viewprofilepage/user-id/204517),

There are couple of questions in need to ask before I can suggest a solution. Do you have the same set of users between Jira and Confluence? Do you have the same username scheme between applications? (for example both Jira and Confluence have users with names like 'jdoe' rather than Jira have 'jdoe' and Confluence 'john.doe')

Do you want all of the users to be now in Crowd or only some subset? Were those users created manually or users accounts were created by users themselves using public signup?

If both applications contain same set of users, you can try using import feature as described here <https://confluence.atlassian.com/crowd/importing-users-from-atlassian-jira-30736459.html> and import users from one of your applications. Then as user matching is based on username itself, once you switch to Crowd directory in Jira and Confluence your users should still have access to it and history should be maintained.

I suggest testing how it works for you on some staging environment before rolling this up to production.

Instead of removing internal directories in both applications I suggest disabling them. for now. In general it is better to administer users in one place and not duplicate them across applications. The only exception is to leave a unique sysadmin in internal directory in Jira and Confluence so you still can have access to those applications even if Crowd application cannot be reached.

Hope that helps,

Marcin Kempa

comments: author: Gary Spencer
body: Hi Marcin,

The usernames were the same in some cases but not in others. Because we are small I ended up creating new accounts in Crowd, renaming old accounts in the other apps and recreating the permissions.

-Gary


author: Marcin Kempa
body: Thank you for reply,

I am glad that you were able to solve this problem.

Best Regards,

Marcin Kempa
Does Crowd 2.8.0 support MySQL 5.5 or 5.6?
Asked by Artem Grotskyi:

Hi all,

we are going to upgrade our MySQL server from 5.0.x to 5.6 but I'm not sure that

Crowd 2.8.0 supports MySQL 5.6.  

On the [Supported Platforms page for 2.8.0 version](https://confluence.atlassian.com/display/CROWD028/Supported+Platforms#SupportedPlatforms-mysql) is not clear wether or not

it is supported:

MySQL ( [4](https://confluence.atlassian.com/display/CROWD028/Supported+Platforms#SupportedPlatforms-mysql) ): ![(tick)](https://confluence.atlassian.com/s/en_GB/7202/e97769bbf919c0bd667762fc102f557beacb7f94/_/images/icons/emoticons/check.png) 5.0.37 and later

So could some one please advise if it is safe to upgrade MySQL to 5.6 version? Or it is better to upgrade it to 5.5?

Cheers, Artem.


Answers:
author: Jobin Kuruvilla [Adaptavist]
body: Yes, both 5.5 and 5.6 should work fine as all versions after 5.0.37 is supported.

comments: author: Artem Grotskyi
body: OK, perfect!  
Thank you, Jobin!
Connecting Azure AD and Jira Cloud
Asked by ???????? ??????:

Hello!

We have Free edition of Azure AD with our Office 365 bussiness premium subsription.

We want to start with Jira Cloud and connect it to Azure AD.

Is there any actual manuals or step-by-step documentation for this action?

Best regards, Gregory.


Answers:
author: Matthew Clark
body: now can this be used for Jira Service Desk customers as well?


author: Bruno Vincent
body: Hi [@???????? ??????](/t5/user/viewprofilepage/user-id/1182778)

Yes there is! Please follow the instructions on this page: <https://docs.microsoft.com/en-us/azure/active-directory/active-directory-saas-atlassian-cloud-tutorial>

comments: author: ???????? ??????
body: Hello!

I'm stuck at finding out unique ID for SAML configuration on Azure AD.

Can you suggest me where should I look it for?


author: Bruno Vincent
body: Hi [@???????? ??????](/t5/user/viewprofilepage/user-id/1182778)

That's pretty confusing. According to the comments in Microsoft's tutorial, the documentation seems to be outdated...

Looks like the following URLs should now be used:

* Identifier: <https://id.atlassian.com/login>
* Reply URL: <https://id.atlassian.com/login/saml/acs>

One of the reporters successfully used <https://id.atlassian.com/login> for both fields so you might have to do some testing here.

(As far as I understand you don't need the Atlassian Cloud tenant ID anymore. I suppose that tenant ID was the ID embedded in the SAML single sign-on link in your Administration panel, e.g. <https://yourcompany.atlassian.net/admin/o/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/saml>)

Good luck on this!


author: Ruslan Mamedov
body: any way it doesn't redirect directly, but I should log in with my gmail address without password. How make it redirect to Jira immediately ?


author: Ruslan Mamedov
body: And how about provisioning? Now it is available only in Manual mode


Tags: active-directory

azure

jira

microsoft

ms-office-365
CROWD http authentication with custom login page
Asked by rajeev pandey:

Hi Guys,

We have php/Apache website and authentication is via CROWD http authentication module. So when i go to mydomain.com page, it displays an alert/popup for the authentication, which looks really boring and plain, Can anyone suggest some way to change this alert into a custom login form. Also this has SSO enabled. Any links or guide/post will be greatly appreciated. Thanks


Answers:
author: Marcin Kempa
body: Hi [@rajeev pandey](/t5/user/viewprofilepage/user-id/1181929)

Crowd provides a REST API for doing the authentication and SSO. It is possible to integrate a custom application that would send to Crowd authentication details (user login and password) via REST API, so you are able to provide your own custom log page. In fact this is what other Atlassian applications do (each of the product has its own login page).

I assume that currently your php/Apache website is relying on apache Crowd module <https://confluence.atlassian.com/crowd/integrating-crowd-with-apache-9961902.html>, which btw is not supported.

You will need to create a custom page with a login form, that would send user credentials to Crowd using session SSO REST API. Then you will have to setup a cookie in order for the user to be able to use SSO with other applications, and also you will have to manage the session.

Here are some links to documentation that would hopefully get you up and running with the SSO:

* General SSO overview: <https://confluence.atlassian.com/crowd/overview-of-sso-179445277.html>
* SSO REST API: <https://docs.atlassian.com/atlassian-crowd/3.1.2/REST/#usermanagement/1/session-authenticateUser>

You may also find this community thread useful <https://community.atlassian.com/t5/Questions/how-can-i-retrive-CROWD-sso-token-by-username/qaq-p/79159>.

Hope that helps!

Marcin Kempa
How can I automate Crowd installation and configuration for deployment on a Docker cluster.
Asked by Gordon Shankman:

I'm using the blacklabelops/crowd Docker image as a baseline and auto-generating the crowd.cfg.xml file in the ENTRYPOINT script for my image so it contains our server ID, license, and database settings.

I'm having trouble figuring out how to initialize the database though -- when Crowd starts up, it doesn't create the schema, instead generating errors in the DB logs because the requested tables don't exist.

Is there a way to specify all relevant parameters at startup so Crowd will initialize if settings don't exist and use existing settings if the database is found? Or do I have to run a bootstrap container and manually configure Crowd before I can launch my runtime containers for an HA solution?


Answers:
author: Marcin Kempa
body: Hi [@Gordon Shankman](/t5/user/viewprofilepage/user-id/281412),

Indeed there is no headless setup for Crowd at the moment. However, the approach you've taken with generating crowd.cfg.xml, looks like a way to go.

In order to overcome the problem with empty database, I would suggest doing a backup and then reapplying it on a fresh DB before Crowd is started. It can be a DB dump from a previous startup as Crowd will automatically upgrade DB schema and data to a version you currently run.

You've mentioned HA solution you are building with docker containers. I guess it is more disaster recovery mode then active-active clustering?

Did you tried our [Crowd Data Center](https://www.atlassian.com/software/crowd/enterprise/data-center) for HA capabilities in Active - Active cluster mode?

Hope that helps,

Marcin Kempa

comments: author: daniel.x.diaz@capgroup.com
body: any update on this question?


Tags: aws

cloud

docker
viewing a users nested groups in crowd admin console
Asked by Martin Day:

We currently have Crowd 3.0.1 under evaluation. We are using nested groups to structure the roles/permissions to atlassian applications used by our organisation. One question I have as an admin using the admin console is that I don't seem to be able to easily view all the groups a user is a member of - If I look in the Groups tab of the "users management screen" I only seem to be able to see the direct groups a user is a member of, but not the groups that those groups are contained in. Whereas, under my profile or in the crowd user console it does list **all** the groups I belong to. Am I missing something obvious? It would definitely be useful for the admin to be able to view/manage all the groups a specific user belongs to, particularly because there is no way of clicking through from the groups displayed to the group(s) that contain it. Of course if I know the group I want to check a user belongs to I can use the group management page to see the nested members tab contains the user, but I definitely see a common use-case of wanting to see all the groups a user belongs to.


Answers:
author: Bruno Vincent
body: Hi [@Martin Day](/t5/user/viewprofilepage/user-id/27626)

You're not missing anything. Same behaviour here, I must say I had never noticed this inconsistency.

Looks like there is already an open feature request for it: <https://jira.atlassian.com/browse/CWD-3794>

comments: author: Martin Day
body: thanks [@Bruno Vincent](/t5/user/viewprofilepage/user-id/853568) - i somehow missed that feature request. I've upvoted it and your answer.


author: Bruno Vincent
body: [@Martin Day](/t5/user/viewprofilepage/user-id/27626)

You're welcome. I've upvoted the feature request too. I've seen you also left a comment on the page, which is a good thing as it sometimes speeds up the implementation decision.
What is the maximum number of groups that we can create in CROWD?
Asked by Harris Kristanto Husien:

We want to know, what is the maximum number of groups that we can create in CROWD? and will the huge number of groups effect the CROWD performance?


Answers:
author: Marcin Kempa
body: Hi [@Harris Kristanto Husien](/t5/user/viewprofilepage/user-id/1180492)

There is no limit for groups in Crowd. We do have customers successfully running with 10k groups or even more. There might be an impact on performance, but it all depends on how big are those groups (how many users are assigned to them), are those local groups (created in Crowd) or groups that needs to be synchronized from remote.

So all in all it depends on the setup and on resources assigned to the instance.

Hope this answers your questions. Do let me know if you have any doubts.

Marcin Kempa

comments: author: Harris Kristanto Husien
body: Thanks for the answers, it clears my doubts


author: Marcin Kempa
body: Hi [@Harris Kristanto Husien](/t5/user/viewprofilepage/user-id/1180492)

I am glad that this answer cleared your doubts. Would you mind accepting the answer, so other community users may find it easily?

Thanks,

Marcin Kempa


author: Craig Castle-Mead
body: Wanted to chime in from a customer point of view and confirm Marcin's comment. We have what I'd consider a large Crowd install - 2xAD, 2xLDAP and 2xinternal Crowd directories. Crowd reports around 60000 users with 15000 of them making it through to the apps, and around 5000 groups with heavy nesting to assist with permissions management. While we have done some basic tuning (psql on AWS RDS) and 8GB xms/xmx, nginx in front - performance hasn't been an issue for us.

CCM
User management multiple Atlassian products
Asked by Rogier The:

Is it possible to create a group per Atlassian product but still maintain the integration? We have Jira, Confluence, Bitbucket and Hipchat. Not all four products are necessary for all users, how do I separate this effectively?


Answers:
author: Nic Brough -Adaptavist-
body: Your instincts are correct, create an access group per application and put different people in them. This won't affect your integrations directly, but you may find users who have different accesses may see quirks (e.g. if a user has Confluence and looks at a page that reports on Jira, but they have no Jira access, the reports may look empty)

comments: author: Rogier The
body: Thanks Nic, will try to set it up.


author: Tarun Sapra
body: Just to add to what Nic has already stated. I would suggest you to use "crowd" for managing all the groups and being the single source of truth for authentication/authorizations to all the different applications because scaling user management schemes isn't an easy task especially in last enterprise setup.

comments: author: Rogier The
body: Thanks for the suggestion. I'll see if I can get more info on Crowd


Tags: jira
How do I add or see a project portal to our "Featured portals" on our portal homepage?
Asked by Tyler Giles:

Hello! Please see screenshot. We currently have 2 project portals showing up on our portals page. We have other projects with portals that we are wanting to put here under "Featured portals". What dictates whether or not our portals show up here?  

I am missing a portal for a project that I have full admin rights to, so that is not the issue. Also, there is **no option** under:  

**Project\>Project Settings\>Customer permissions**   
or  
**Project\>Project Settings\>Portal settings**

I can access the portal directly, and use it as normal. I just see no options anywhere that push this portal to the "Features portals" or permission settings. Thank you!![2024-08-20_13-35-25.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/342788i316C03C04016B5DC/image-size/large?v=v2&px=999 "2024-08-20_13-35-25.jpg")


Answers:
author: Josh Costella
body: Hi [@Tyler Giles](/t5/user/viewprofilepage/user-id/5525501)

You can find the documentation on how to configure that here:

<https://support.atlassian.com/jira-service-management-cloud/docs/feature-service-projects-in-your-help-center/>

comments: author: Tyler Giles
body: Thank you! This is exactly what I needed.


Tags: cloud

jira-service-management

jira-service-management-cloud
Howdy, within an organization. Is there a way to restrict user access to files?
Asked by Einar.Jordan:

Howdy, within an organization. Is there a way to restrict user access to files?

Different divisions inside our organization have access to files from other divisions. Since we are regulated by HIPAA it is an issue for us. Is there a way to create boards that are highly restricted to other teams within the organization?


Answers:
author: Josh Costella
body: Hi [@Einar.Jordan](/t5/user/viewprofilepage/user-id/5572580)

Can you clarify what you mean by "files?" Do you mean tickets? If you mean tickets then you have a few options depending on how the Jira projects in your instance are configured.

The Browse Project permission in the project permission scheme controls view access to the tickets within a Jira project. More here: <https://support.atlassian.com/jira-cloud-administration/docs/permissions-for-company-managed-projects/>

If you have to grant view access to users but only on some tickets, then you would utilize an Issue Security scheme. More here: <https://support.atlassian.com/jira-cloud-administration/docs/configure-issue-security-schemes/>

Please let me know if you have any further questions.


author: Nikola Perisic
body: Welcome to the community [@Einar.Jordan](/t5/user/viewprofilepage/user-id/5572580)

Since boards are based on your filters, you can configure your board and to determine who are you sharing this board with. By default, a board can be shared with:

* Project
* Group
* User
* Organisation
* Private

![Screenshot from 2024-08-20 19-34-47.png](https://community.atlassian.com/t5/image/serverpage/image-id/342785iE9B98A732471DB98/image-size/large?v=v2&px=999 "Screenshot from 2024-08-20 19-34-47.png")

Configure Board \> Filter Permissions \> Edit Permissions

You can also define the editors as well.

As an additional layer of security, you can set up issue security scheme where you will define your security level which is tied to an issue type (you can create a new issue type only for this purpose). These issue security schemes can define which project role will ONLY be able to see the issues that have been created under the issue type that is tied with the issue type.


Tags: cloud

jira-service-management

jira-service-management-cloud
Assigned tickets are showing in the default "unassigned" que but also showing assigned to me.
Asked by Kosko, Andrew:

We recently implemented a new hire hardware request in Jira. Everything works well but when a user creates this type of request, and we assign the ticket to someone, it stays in our "unassigned" que.

It only happens for this particular request.

I have done plenty of googling and I don't see any solution to my issue. I have included a screenshot below of the tickets in the unassigned que.

I apologize but I'm pretty new to Jira Service Management and I'm not sure what other information would be helpful.

![Jira unassigned.PNG](/t5/image/serverpage/image-id/342757i8E868E184713F858/image-size/large?v=v2&px=999 "Jira unassigned.PNG")


Answers:
author: Christopher Yen
body: Hi [@Kosko, Andrew](/t5/user/viewprofilepage/user-id/5572307) , welcome to community!

What will help us here is if you can edit the queue and show us the filter/query for it. The fix should just be a simple update to the queue filter. If you make sure the assignee = unassigned that should fix it

![2024-08-20 08_59_16-Window.png](https://community.atlassian.com/t5/image/serverpage/image-id/342761i27EF72E308088A59/image-size/large?v=v2&px=999 "2024-08-20 08_59_16-Window.png")![2024-08-20 08_56_42-Window.png](https://community.atlassian.com/t5/image/serverpage/image-id/342759i3B84D9042F5B7AEE/image-size/large?v=v2&px=999 "2024-08-20 08_56_42-Window.png")

comments: author: Kosko, Andrew
body: Here is the query filter and a screenshot. All other unassigned tickets are showing correctly. It is only when a user uses this specific request in Jira.

assignee in (EMPTY) AND issuetype in (Incident, Problem, Request) AND resolution = Unresolved AND "Group" = "Service Desk" OR issuetype = Requisition AND resolution = Unresolved

![Jira query.PNG](https://community.atlassian.com/t5/image/serverpage/image-id/342764iB4953D5F0C4FDDEE/image-size/large?v=v2&px=999 "Jira query.PNG")


author: Christopher Yen
body: Hi [@Kosko, Andrew](/t5/user/viewprofilepage/user-id/5572307)

So because you have the OR statement you need the unassigned to be on that side too.

```
assignee in (EMPTY) AND issuetype in (Incident, Problem, Request) AND resolution = Unresolved AND "Group" = "Service Desk" OR issuetype = Requisition AND resolution = Unresolved AND assignee in (EMPTY)
```


author: Christopher Yen
body: Your current query is like this

|----------------------------------------------------------------------------------------------------------------------------|----|-----------------------------------------------------|
| assignee in (EMPTY) AND issuetype in (Incident, Problem, Request) AND resolution = Unresolved AND "Group" = "Service Desk" | OR | issuetype = Requisition AND resolution = Unresolved |


Tags: cloud

jira-service-management

jira-service-management-cloud