youngmon/atlassian-qna huggingface dataset:
Crowd + Google Apps Connector + Google Apps
Asked by Ivan Varbanov:

Hi all,

my goal is to be able to login to Stash with my google apps mail accounts. Preferable this to be done with Crowd Google Apps Connector SSO setup.

I have setup Crowd + Google Apps Connector + Stash. I follow the documentation in Atlassian but in this documentation/configuration the SSO provider is Crowd, which means when I try to login to google apps email I'm redirecting to Crowd/Stash. I want this to be opposite way. Which means when logged in to google apps email to be logged in also in Crowd/Stash. Is there any way to reconfigure Crowd Google Apps to use Google Apps SSO as provider? Or to accomplished my goal?

Any info is much appreciated.

Thank you!


Answers:
author: Caspar Krieger
body: Unfortunately Crowd currently does not support using Google Apps as an authentication provider (we only support Google Apps using Crowd as an authentication provider, so that when a user logs into Google Apps then Google Apps delegates the authentication check to Crowd, as you pointed out).

[CWD-1601](https://jira.atlassian.com/browse/CWD-1601) is probably the most appropriate issue to vote on (please also leave a comment explaining your use case) if this is important to you.


Tags: crowd-administration
Crowd - Mail config error - "unable to find valid certification path to requested target"
Asked by Andrew Khoury:

I'm trying to configure Crowd for outbound mail (AWS SES, [email-smtp.us-east-1.amazonaws.com](http://email-smtp.us-east-1.amazonaws.com) which is available through ports 25, 465 or 587).

I configured SMTP with login credentials (via Crowd console).

I verified connectivity and authentication at the command line, via "openssl s_client -crlf -quiet -starttls smtp -connect email-smtp.us-east-1.amazonaws.com:587".

I cannot send mail. Here are the errors in Crowd when I try ...

**With port 587 configured:**Unrecognized SSL message, plaintext connection?

**With port 465 configured:**unable to find valid certification path to requested target

After reading up online I tried importing the certificate via "keytool -import", which I verified via "openssl x509 -fingerprint" and "keytool -list -keystore". It all looks good however I'm still getting the unable to find valid certificate file error.  
I read up on the following (but have NOT tried it yet):  
-Djavax.net.ssl.trustStore=trustStore  
Crowd is version: 2.6.5 (Build:#607 - 14-08-2013)  
I'm not sure if I'm on the right path, or misssing something. Can somebody help point me in the right direction? Is there any more information I need to provide?

In an effort to make sure this isn't a configuration issue or connectivity issue here are some further tests...

**Port 25 (Use SSL NOT selected):**

Could not send email to [email@mail.com](mailto:email@mail.com). Reason:220 Ready to start TLS

**Port 25 (Use SSL selected):**

Caused by: javax.mail.MessagingException: Could not connect to SMTP host: [email-smtp.us-east-1.amazonaws.com](http://email-smtp.us-east-1.amazonaws.com), port: 25;  
nested exception is:  
javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?

**Port 10 (Use SSL selected):**

...AFTER A LONG WAIT...

Caused by: javax.mail.MessagingException: Could not connect to SMTP host: [email-smtp.us-east-1.amazonaws.com](http://email-smtp.us-east-1.amazonaws.com), port: 10;  
nested exception is:  
java.net.ConnectException: Connection timed out


Answers:
author: Andrew Khoury
body: After looking further into the issue I decided to give "-Djavax.net.ssl.trustStore=trustStore" a shot.

I pointed the trust store to my cacerts folder (that's where I had already imported my mail certificate), restarted crowd and was able to send mail without errors.

There error message was kind of pointing to this as the problem, though it wasn't clear to me that it wasn't already looking at the global cacerts.


author: Caspar Krieger
body: Unfortunately I'm not familiar with Amazon's SES offering; if you don't get any helpful responses here you may want to [raise a support request](http://support.atlassian.com/) for Crowd so our friendly support team can help you troubleshoot.


Tags: crowd-administration

email
Unable to login to crowd after migration
Asked by Software Asset Management:

Hi Team,

I have migrated the crowd data from the demo to the production (new setup).

However, I have not added the production ip address before the back up.

Now, I am not able to login to crowd using the demo/production admin credentials.

Error:

Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException:   
unable to find valid certification path to requested target  
2013-11-29 16:50:48,182 http-443-2 ERROR \[crowd.console.action.Login\] Failed to connect to the authentication server, please check your crowd.properties  
org.springframework.security.authentication.AuthenticationServiceException: Could not invoke service.. Nested exception is org.codehaus.xfire.fault.XFireFault: Couldn't send message.

Regards,

Aurobindo.


Answers:
author: Tiago Comasseto
body: Hi Aurobindo,

Regarding adding the production ip address, you can follow the steps of this [KB](https://confluence.atlassian.com/display/CROWDKB/Client+Host+is+Invalid) to insert it manually via database.

Cheers


Tags: crowd-administration
Could not replicate the entire batch using the BatchProcessor.
Asked by gao biling:

I want to create a new crowd . I import existing crowd data, some problems

like this Could not replicate the entire batch using the BatchProcessor.


Answers:
author: Caspar Krieger
body: That's the final log entry when an import fails. Look higher up (earlier) in the log to find what went wrong with adding the problematic entities. You should see a number of errors and warnings which will give you a clue as to what went wrong.


Tags: data

import
Nested groups to manage permissions
Asked by Christian Schulz:

Hello,

I am trying to use nested groups in the crowd internal directory to manage permissions.  
I have created a group called administrators and added jira-administrators, confluence-administrators etc as sub groups.  
Then I added an user to that administrator group.  

I tried to authenticate, but it seems there is no inheritance for membership to subgroups.  
Is such a scenario possible or do I have to add the user to each application administrator group?


Answers:
author: Tiago Comasseto
body: Hi Christian, in fact the expected behavior is different. When adding users to the parent group (administrators), the users won't be members of the sub-groups.

The expected behavior is when adding users to the sub-groups (e.g jira-administrators) those users will be also members of the parent group (administrators).

You may want to see this [documentation](https://confluence.atlassian.com/display/CROWD/Nested+Groups+in+Crowd) for more details.

Cheers


Tags: crowd-administration
Pushing changes to crowd clients
Asked by Christian Schulz:

Hello,

I have noticed that I need to synchronize the user directory manually if an user tries to authenticate but I haven't set the right groups in Crowd yet.

For example:  
User authenticates in Jira, the user credentials are checked against delegated AD and user is created in Crowd. After it the user is created in Jira too, but haven't any groups. I have to set them manually.  
After setting them the login isn't possible til I synchronize the directory manually.

Do I really need to decrease the synchronization intervall or is there another possibility?


Answers:
author: Caspar Krieger
body: Yes, decreasing the synchronization interval is the current recommended workaround.

This situation is covered by [CWD-2650](https://jira.atlassian.com/browse/CWD-2650), so please vote on that if you'd like this to improve.

Edit: when I say "this situation", I mean the situation of a user not being able to login straight away.

comments: author: Christian Schulz
body: It is really bad to see that the issue isn't in progress since 2011.  
In some applications like Crucible it is only possible to set the time intervall in hours.


Tags: crowd-administration
Verifying git commit authors in Stash against Crowd users
Asked by Michael Schnupp:

We have a Crowd server containing names and mail addresses of all developers.

Now in Stash we want to make sure that each push contains only commits from authors known to Crowd, i.e. for each commit there should be a entry in crowd matching the authors real name and email.

Is there already some kind of hook plugin for that?

If not, I probably have to write my own plugin. Any hints about that?


Answers:
author: Roger Barnes
body: There is an [Enforce Author Hook](https://marketplace.atlassian.com/plugins/com.risingoak.stash.plugins.stash-enforce-author-hook) available in the marketplace that is similar but not quite the same as your requirement. A similar plugin could be created, or perhaps the author could adapt it for this use case also.


Tags: bitbucket-administration

bitbucket-server

hook
sso crowd+ldap+jira+Crucible/Fisheye
Asked by mai mai:

crowd2.4.10+jira5.1.8+Crucible/Fisheye2.10.1

JIRA and Crucible were connected to a Crowd server setup with an LDAP directory.

I can use a user from crowd to login in jira.And I can also the same user to login in crucible with the same username and password.

When I login in jira , I have still to enter username and password to login in crucible.SSO between jira and crucible isn't work.

The SSO Optional about seraph-config.xml and crowd.properties is already changed in JIRA.

I do not understand why the SSO isn't work in jira and crucible.Is there anythings I missed?

What the reason?


Answers:
author: Caspar Krieger
body: I think you should read Crowd's documentation, especially [An Overview of SSO](https://confluence.atlassian.com/x/HR6yCg), carefully; that page tells you how to configure each application. However, it's a prerequisite of that to already have the applications accessible through sub domains of whatever domain you pick, so I suggest you get that working first before you tackle getting SSO working (because SSO definitely won't work if you're accessing applications on different ports or IPs).


author: mai mai
body: I found the domains were not set.I used ip not domain.

eg:

<http://172.21.1.2:8095/crowd>

<http://172.21.1.2:8080/jira>

<http://172.21.1.3:8888/cr>

The older version about crowd1.3+jira3.2+confluence2.7 seemed not using domains.

How to set domains in crowd+jira+confluence+crucible?

How to set domains like the following?

<http://172.21.1.2:8095/crowd> -\> <http://crowd.example.com/>

<http://172.21.1.2:8080/jira> -\> <http://jira.example.com/>

<http://172.21.1.3:8888/cr> -\> <http://cr.example.com/>

In Crowd, go to 'Administration' -\> 'General Options' -\> 'SSO Domain'.

In jira or crucible?what can I do?


author: Caspar Krieger
body: It's not the machines which matter, but the domain names through which users are accessing each app (and hence also whether the cookie config for each of the apps is correct). What domain names are the apps under?


author: mai mai
body: Crucible and CROWD are in the same machine,JIRA is in another machine.Is the reason?


author: Caspar Krieger
body: Have you got Crucible/Fisheye and JIRA sharing a domain? (That's a prerequisite for SSO to work, because cross-domain SSO isn't supported yet - [more info here](https://confluence.atlassian.com/display/CROWD/Troubleshooting+SSO+with+Crowd))
Export user and groups from confluence and jira
Asked by EHE Admin:

How to export users and groups from confluence and jira database is my sql 5.1

How I can import these user's to crowd


Answers:
author: Lasse Langhorn
body: Hi,

You can use the Jira User Export app: [https://marketplace.atlassian.com/apps/1220535/jira-user-export?hosting=server\&tab=overview](https://marketplace.atlassian.com/apps/1220535/jira-user-export?hosting=server&tab=overview)

It is free but for Jira server only

Regards

Lasse


author: Brendan Patterson
body: Hi! The [Bulk User Upload AddOn](https://marketplace.atlassian.com/plugins/com.artemistech.confluence.plugins.bulkuserupload) makes it single click easy to export your Confluence users to a CSV file.

- Brendan

![](http://www.evernote.com/shard/s5/sh/6312d2ff-6b63-48cd-8f15-1926254f3e58/da8670313f703e129d82cc06624a9e81/res/4aadb91d-20b6-4598-984d-10fde027d7fc)


author: Renjith Pillai
body: <https://confluence.atlassian.com/display/CROWD/Importing+Users+from+Atlassian+JIRA>

<https://confluence.atlassian.com/display/CROWD/Importing+Users+from+Atlassian+Confluence>
How to block inactive user in CROWD?
Asked by Dmitry Kruppa:

How to block inactive user in CROWD?

1. Logging in the application, user management which provides CROWD

2. CROWD to remove the user check the "active"

3. We return to the application, we still have all of our permissions, we can take any action available to us to lock.

Lock comes into effect only after the log out of the application.


Answers:
author: Caspar Krieger
body: This is a bug; thanks for the report. I've filed it as CWD-3718 on [jira.atlassian.com](http://jira.atlassian.com), but I've set the security level to developers only because it impacts Crowd security. I've left a note there to comment on this question/answer once the issue is resolved.

(I'm a developer on the Crowd team.)

comments: author: Dmitry Kruppa
body: Thank you for your response!


author: darylchuah
body: Hi Dmitry

You can refer the below documentation on how to deactivate user in Crowd itself:

<https://confluence.atlassian.com/display/CROWD/Deleting+or+Deactivating+a+User>

comments: author: Dmitry Kruppa
body: i know how to deactivate user. I don't know because don't close session for inactive user
Jira and confluence password policy
Asked by EHE Admin:

I need some help for setting up password Policy for jira and confluence.

We are using Jira and confluence on our production. Now we need to implement password policy for jira and confluence. We need to apply password policy for our exiting jira and confluence users .

I did some search identified password policy plugin can apply to jira 6.1 . But i didn't find any plugin for confluence.

For a testing purpose i installed Crowd software. How i can import production jira and confluence user and groups to crowd and apply the password policy.

Please give me some advice .


Answers:
author: Daniel Bajrak
body: Here is plugin Password Policy for Confluence: <https://marketplace.atlassian.com/plugins/com.intenso.confluence.plugins.confluence-password-policy>


author: BernardoA
body: <https://confluence.atlassian.com/display/JIRA/How+to+Export+Users+to+CSV+from+JIRA>


author: Erik Saline [BlackPearl PDM]
body: Here is how to import users from JIRA, <https://confluence.atlassian.com/display/CROWD/Importing+Users+from+Atlassian+JIRA>. Once import to crowd a a Pass regex, [https://confluence.atlassian.com/display/CROWD/Configuring+an+Internal+Directory](https://confluence.atlassian.com/display/CROWD/Configuring+an+Internal+Directory.). Setup JIRA and Confluence to use authenticate to Crowd, [https://confluence.atlassian.com/display/DOC/Connecting+to+Crowd+or+JIRA+for+User+Management](https://confluence.atlassian.com/display/DOC/Connecting+to+Crowd+or+JIRA+for+User+Management.).
Log Crowd directory queries
Asked by Oleksiy Brushkovskyy:

Hi there,

How to configure logging of directory queries from any connected applications?

Thank you.


Answers:
author: Caspar Krieger
body: I don't think we have a way to log just the directory queries from connected applications, but you can turn on debug logging from the administration section of Crowd to get all the logs. Just be aware you'll get a lot of unrelated noise in your logs too!

comments: author: Oleksiy Brushkovskyy
body: This solution is quite obvious. I thought there are some logable events that are disabled by default.

But thank you anyway.
Using Crowd with redundant LDAP servers
Asked by e:

Hi everybody,

in our company we have three LDAP-servers which point to one AD. This redundancy enables to use update/restart one of them, when the others are still online.

My question is now, do I encounter any problems when i configure three LDAP connectors in Atlassian Crowd which point to he same AD?

kind regards,

Andreas


Answers:
author: Tiago Comasseto
body: Although it's not officially supported, I've seem cases where customers have two identical LDAP servers and a load balancer in front of them. In this scenario Crowd could be configured pointing to the IP of the load balancer, instead of the actual servers.

Cheers


author: Tomasz Kontusz
body: You can add multiple LDAP addresses for one directory:

In Crowd 2: "ldaps://1.1.1.1:636 ldaps://2.2.2.2:636"

In Crowd 3: "1.1.1.1:636 ldaps://2.2.2.2" (Crowd will just concatenate "ldaps://" + address + ":636").

comments: author: Tomasz Kontusz
body: In the end this solution broke too. Setting up a simple load balancer, as in the accepted answer, works well.


author: Mike Monette
body: ...But why? Why do you guys put yourself into this position? It can be done......so......easily. Why not support it?

Using things like ucarp/relayd/carp/pacemaker and point crowd at the virtual shared IP works just fine...So why not allow us to enter 2 ldap servers in crowd to be used for redundancy? I don't get it.


author: BernardoA
body: Basically you can create several different LDAP directories but not for redundancy purposes.


author: Renjith Pillai
body: Connecting to replicated/redundant LDAP servers is not something which is is supported - <https://confluence.atlassian.com/display/JIRA/User+Management+Limitations+and+Recommendations> (that article is for JIRA and I guess it is the same for Crowd as JIRA has embedded crowd inside it)

Also - <https://jira.atlassian.com/browse/CWD-422>


Tags: active-directory

ldap
Crowd connection with Apache DS 2.0
Asked by Emidio Stani:

In Crowd 2.7.0, the last Apache DS connector provided is for 1.5.x releases, where the latest version is 1.5.7 is from 24 April 2010 and listed as not maintained (see: [http://directory.apache.org/apacheds/download-old-versions.html](http://directory.apache.org/apacheds/download-old-versions.html))).

Is there an intention to continue to update the connector for Apache DS 2.0 ?

Thanks in advance for the answer,

Emidio


Answers:
author: Caspar Krieger
body: We haven't spent time adding support for ApacheDS 2 largely because it hasn't had a final version released yet; we're not sure whether we'd be able to reliably and successfully support a product which is still releasing milestones.

It doesn't look like there's an open feature request to support it (or at least, I couldn't find it quickly!), so if this is important to you, please [create an issue of type New Feature in the Crowd project](https://jira.atlassian.com/secure/CreateIssue!default.jspa) and call it something like "Support Apache DS 2". If supporting the current milestones is important to you, then please mention that in an issue comment or as part of the issue description.

comments: author: Caspar Krieger
body: Forgot to add: if you do create this issue / feature request, please add a comment here \& link to the issue in the comment, so that successive people looking for ApacheDS 2 support can find and vote on the issue.


author: Ryan Hoegg
body: I have created the feature request: <https://jira.atlassian.com/browse/CWD-4006>


author: Emidio Stani
body: Thanks Caspar, I will evaluate it. At the moment I prefer to stick to Apache DS 1.5.7 since it is quite stable, if new requirements will come up for migrating to Apache DS 2 I will create an issue.


Tags: crowd-administration
Installed Crowd Standalone not starting
Asked by ???? ????????:

Hello everyone!

I have some problem with 'start_crowd.bat'. I follow documentation, but Crowd not started. I use command panel with admin rules and write 'netstat -a', but i'm not looking '127.0.0.1:8095' or anyone service who listening '8095' port.

What's may be wrong?


Answers:
author: Peter Van de Voorde
body: Hi Ilya,

Did you check if your Java Home is indeed filled in?

You can do this easily by going to the command line and executing **echo JAVA_HOME**.

If that doesn't return the location you would expect you can follow the steps detailed here to set you JAVA_HOME variable : <http://stackoverflow.com/questions/2619584/how-to-set-java-home-on-windows-7>

Best regards,

Peter

comments: author: ???? ????????
body: Thank's Peter and Jobin. I'm set JAVA_HOME in installed path Java and Tomcat with Crowd is starting.


author: Jobin Kuruvilla [Adaptavist]
body: Any error in the catalina logs? Do you have Java properly setup?

comments: author: ???? ????????
body: Folder logs is empty ({CROWD_INSTALL}\\\\apache-tomcat\\logs).

Java has been installed with basic properties. Java version is 1.7.0_45.


author: Jobin Kuruvilla [Adaptavist]
body: Open a command window, navigate to the folder where start_crowd.bt resides and execute the batch file from command window. That should give some more details.


author: ???? ????????
body: In command panel i look this:

JAVA_HOME "" contains spaces. Please change to a location without spaces if this

causes problems.

Neither the JAVA_HOME nor the JRE_HOME environment variable is defined

At least one of these environment variable is needed to run this program  

<br />

But my java installed in "D:\\ProgFiles\\Java" and not have spaces ...


author: ???? ????????
body: Folder logs is empty ({CROWD_INSTALL}\\\\apache-tomcat\\logs).

Java has been installed with basic properties. Java version is 1.7.0_45.


Tags: crowd-administration
I need approvers that don't have JSM license put a value on a custom field.
Asked by Sofia G:

Hi! I have this requirement, when a ticket is approved the approvers must put a value on a custom field. When I received, I've created the custom field and add it in a transition screen in the approve transition in the workflow. The problem is, the approvers doesn't have JSM license so they won't see the transition screen.

How can I implement a solution for this? I hope you can suggest me a solution. Thanks


Answers:
author: Mikael Sandberg
body: Hi [@Sofia G](/t5/user/viewprofilepage/user-id/5551958),

Welcome to Atlassian Community!

In order to modify any fields on a request after it has been submitted you have to have a JSM license and be an agent in the project. A way to work around it is if you add a form as part of the approval, add the approver as a request participant, and then have the approver fill that form out and link the form field to the Jira custom field.


Tags: cloud

jira-service-management

jira-service-management-cloud