youngmon/atlassian-qna huggingface dataset:
LDAPS Installation
Asked by RGC:

I am currently using Crowd to install LDAPS and LDAPS for other applications in our server..

However, I am not sure if I am using LDAPS or just LDAP..

LDAPS.png

So as you can see from the picture..

my URL is set to ldaps and using port for 636..

However, Secure SSL in unchecked.

When I click on Secure SSL thing.. it gives me an error..

\[Root exception is [javax.net](http://javax.net).ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative names matching IP address ???.??.??.???

It looks like I didn't install certificates.. but I did install all SSL certificates..

So my question is.. am I using LDAPS ? or is it just LDAP?

Also whats the purpose of Secure SSL... if I am using the LDAPS?  
[](https://community.atlassian.com/t5/Crowd-questions/LDAPS-Installation/qaq-p/315019?attachment-id=12192){#link_1159ffb8b59356}  
[](/tnckb94959/attachments/tnckb94959/crowd-questions/1378/1/task.png){#display_1159ffb8b59356_0}  
[](https://community.atlassian.com/t5/Crowd-questions/LDAPS-Installation/qaq-p/315019?attachment-id=12193){#link_1159ffb8b59356_0}  
[](/tnckb94959/attachments/tnckb94959/crowd-questions/1378/2/LDAPS.png){#display_1159ffb8b59356_2}


Answers:
author: Paulo Hennig
body: Hello Team,

Could you also run the test using the SSL poke as well ?
> `java -`[Djavax.net](http://Djavax.net)`.ssl.trustStore=``/your/jira/keystore` `SSLPoke SERVER (port)`

<https://confluence.atlassian.com/display/JIRAKB/Unable+to+Connect+to+SSL+Services+due+to+PKIX+Path+Building+Failed+sun.security.provider.certpath.SunCertPathBuilderException>


Tags: ldap

ssl
How often does Crowd sync with LDAP?
Asked by Andrew Morin:

I have searched high and low for this and can't seem to find this information. How often does Crowd sync with LDAP and is this configurable? Is there any way to force a synchronization?

Thanks

Andrew


Answers:
author: gustavo_refosco
body: Hi Andrew,

This can be configured directly in the directory configuration you add to connect to AD. You can go, for instance, in `Directories > Add Directory` and select the option **Connector** . In the configuration of this you can then go to the **Connector** tab and look for the setting **Polling Interval** which will define, in minutes, how often it will search for updates in AD.

After your Directory is configured and saved you can go to `Directories`, click in the name of the directory you created to open its configuration and hit **Synchronise Now** to immediately start a synch.

Regards,

Gustavo Refosco


Tags: crowd-administration
You will now need to restart Crowd to continue. Please click here once you have restarted
Asked by rahuldanwade:


Answers:
author: Rodrigo Girardi Adami
body: Hi Rahul,  
When this message appears to you? Have you checked if this occurs to the latest versions of Crowd?  
Regards,  
Rodrigo


author: rahuldanwade
body: I had restarted application twice but same problem persist.


author: rahuldanwade
body: This is long time problem pending.I have configured SSO with all atlassian products


Tags: crowd-administration
Crowd: hosted vs in-house
Asked by SallyD:

I have multiple Atlassian products, including Crowd, hosted in a data center. Our IT will not connect Active Directory to Crowd because it is 'out in the wild.'

Is it possible to bring Crowd in-house and still leave the other Atlassian products in the external data center? Oh, yeah. One more detail...Crowd has to continue to work correctly. :wink:


Answers:
author: SallyD
body: thank you. I will forward this to IT and see if this will work for us.


author: no_longer_in_sudoers_file
body: Prior to joining Atlassian, I used Crowd for authenticating customer users to a product that operated outside of our corporate network (in another data center). What I ended up with may meet your needs.

(1) I had an Active Directory that represented our internal user base. This consisted of two (2) Active Directory domain controllers used by most every service internal to our company and one (1) READ-ONLY active directory domain controller setup for the purpose of this scenario.

(2) I had another LDAP directory that represented all customer-users because I needed to be sure customers and internal users were never co-mingled--a management requirement.

(3) I setup Atlassian Crowd as the bridge between the two LDAP directories and then exposed the Crowd end points to the remote data center (which I then white-listed by IP address). A better solution would have been to use a VPN tunnel, but at the time that was not an option due to what we will just call "vendor relationship issues."

(4) Here's the important part. Because I pinned Crowd to authenticate first against the customer LDAP then against the read-only domain controller (with no ability to resolve to the other DCs), I was pretty certain that (a) customer accounts would be resolved first (and fastest), (b) no one could update information in the Active Directory via Crowd and (c) given my Active Directory group policies that locked accounts after three (3) attempts, I was pretty certain that my corporate VPN (which was also on Active Directory) was more vulnerable than my crowd installation when it came to external attacks.

(Disclaimer: What I just described was done before I joined Atlassian and I'm not entirely sure if it complies with Atlassian best practices...I just know it worked.)


Tags: crowd-administration
Crowd:LDAP Customize User's Name
Asked by David S:

We have a user that we'd like to use their common name.

Example: John Howard Doe.

Which has Firstname = "John" Lastname = "Doe".

We would like to change the user's name to "Howard Doe" (Firstname = "Howard" Lastname = "Doe").

Is this possible? When editing name via Crowd, Crowd attempts to update the LDAP server and fails.

We have no control over what is in LDAP server.

Please advise.


Answers:
author: HarryH
body: You have to write crowd plugin to do this translation. For example, the user add listener is triggered, you can customize the name logic you listed above in the user add listener.

You can even add a servlet in your plugin to handle all once


Tags: crowd-administration

jira

jira-administration
import crowd backup xml error
Asked by menggy:

When import crowd 2.8.0 baickup xml to another server crowd 2.8.0 ,I found some errors as following,anyone can help me?

**org.springframework.dao.DataIntegrityViolationException: not-null property references a null or transient value: com.atlassian.crowd.model.directory.DirectoryImpl.createdDate; nested exception is org.hibernate.PropertyValueException: not-null property references a null or transient value: com.atlassian.crowd.model.directory.DirectoryImpl.createdDate**


Answers:
author: Marcus Silveira
body: Hi Menggy,

It's possible you are hitting into the problem described here

<https://confluence.atlassian.com/display/CROWDKB/Importing+Crowd+XML+Backup+Fails+due+to+Different+Locale>

Hope this helps.
Where are the backup to xml details stored?
Asked by Adam Flinton:

I am wondering where the back up to xml details are stored. i.e. I use the web app, set the backup to happen to folder A with a periodicity of B etc.... is this info stored in the db \& if so in which table or is it in a config file somewhere?


Answers:
author: Diego Berrueta
body: The backup folder is a subfolder of the Crowd home directory, which is configured in the crowd-init.properties file.

The details of the scheduled backup are stored in the database, table cwd_properties. Search for the "backup.scheduled.enabled" and "backup.scheduled.time.hour".


author: Adam Flinton
body: "The details of the scheduled backup are stored in the database, table cwd_properties. Search for the "backup.scheduled.enabled" and "backup.scheduled.time.hour"."

thankyou.

Allows my to use our automation framework to set these values .

Adam


author: HarryH
body: Not sure I understand you question correctly, the xml is under your JIRA data/export folder.


Tags: crowd-administration
atlassian crowd will support bugzilla and jenkins
Asked by sgcsekar:


Answers:
author: Nic Brough -Adaptavist-
body: Your question is the wrong way around. It's more about those applications supporting the use of Crowd as a user management system.

From memory, there's an addon for Jenkins which enables you to use Crowd for users, but I don't know about Bugzilla - I've certainly not seen it done.


Tags: crowd-administration
What is the Logout URL for OpenID based application while connecting CrowdID
Asked by itstayyab:

HI Folks

I've configured CrowdID with Crowd and want to connect SonarCube using OpenID. I'm confused what should I give in logout URL.

Can you anyone please help me on this

    # This property must be set to truesonar.authenticator.createUsers=true # Enable OpenID pluginsonar.security.realm=openid # URL of OpenID providersonar.openid.providerUrl=http://ch2dlfx048.in.ibm.com:8095/openidserver/op

    # URL of logout pagesonar.openid.providerLogoutUrl=http://ch2dlfx048.in.ibm.com:8095/openidserver/op

    # URL of SonarQube serversonar.openid.sonarServerUrl=http://localhost:9000 # Optional properties:sonar.authenticator.updateUserAttributes=true# If set to 'true', at each login, user's attributes (name, email, etc.)# are re-synchronized. If set to 'false', user's attributes are not# re-synchronized except when creating the user for the first time

More details about Plugin: <https://github.com/SonarCommunity/sonar-openid>

Best Regards

Tayyab Khan


Answers:
author: Caspar Krieger
body: Assuming the URL of the logout page is "the page that the user is redirected to when they click the logout button in SonarCube", you would enter in the URL of

```
http://pathtomyserver:8097/openidserver/logoff.action
```

This URL comes from the logout link in the server UI of Crowd's openidserver:

image2015-6-23 10:14:15.png  
[](https://community.atlassian.com/t5/Crowd-questions/What-is-the-Logout-URL-for-OpenID-based-application-while/qaq-p/27506?attachment-id=5417){#link_115a00ac495535}  
[](/tnckb94959/attachments/tnckb94959/crowd-questions/126/1/image2015-6-23%2010%3A14%3A15.png){#display_115a00ac495535_0}


Tags: crowd-integration

openid

sonarqube
Can I automate an import of xml backup?
Asked by Adam Flinton:

I would like to create a backup crowd server which simply downloads last night's XML backup from the "master" crowd server \& imports so as to make the 2 in sync.

I can happily do this manually but was wondering if there is a way (rest or otherwise) of automating an XML import.


Answers:
author: Adam Flinton
body: I can do the download from where the xml files are stored etc.

We are using ansible which is similar to puppet

<br />

It is the automation of the "restore" part from xml I am looking for.  
ATM I can only appear to do this via using the web app etc \& then clicking submit etc.  
looking @ the html it is calling:  
\<form id="import" class="aui" action="/crowd/console/secure/admin/restore!import.action" method="post"\>  
\& I am wondering if there is anyway to post the information from outside of crowd (e.g. curl) (or to call the java directly from within)

I.e. I would like to be able to "restore" my backup of crowd via an xml file every night @ 1.00AM.

i.e. to have a script call "import.action" in some manner (directly in java if need be or via an http post/rest call).

Clearly I can recreate the html form, find how to generate/acquire the relevant login perms etc. but I was wondering if there is a less screenscraper way of doing it.

Adam


author: rrudnicki
body: Hi Adam,

You can do this from different ways, there isn't right or wrong but which way best fits your needs and environment.

Basically, this will depends of what OS you are running Crowd. If you are running on Linux, you can do this by a Shell script and schedule this on crontab. Or also add a rsync command on crontab to get the xml backups. On windows, you can use the robocopy which is a kind of rsync (I'm not too familiar with Microsoft OS).

Another possibility would be you instead of use the xml backup, do a database replication (active-passive).

However, if you want go beyond, did you already heard about Puppet? ![laugh](/html/@BEA1CC333F4D830F5303329D7DC07DE4/images/emoticons/laugh.png "laugh")

<https://puppetlabs.com/puppet/what-is-puppet>

Hope this helps.

Cheers,

Renato Rudnicki


Tags: crowd-administration
Manually update Crowd Client libraries in JIRA/Confluence
Asked by David Yu:

Back in the old days, I remember you could always update the Crowd clients that ship with JIRA/Confluence to the newer version.

Is that still true today? I don't see this recommended anymore in the documentation and maybe this is no longer encouraged with Crowd Embedded, and other dependencies introduced with this.

Does this mean we have to wait for the next version of JIRA/Confluence if we wanted to get the newest Crowd library? Or is it safe for me just drop in the latest crowd-integration-client-rest-2.8.X.jar?


Answers:
author: Diego Berrueta
body: Please do not replace the version of Crowd in the JIRA/Confluence unless specifically instructed to do so by our Support team.

We carefully test the integration of particular versions of the products with particular versions of the Crowd libraries. Any other combination may cause problems since we sometimes introduce changes that break binary compatibility.

We also frequently upgrade the version of the Crowd libraries in the products. Are you interested in any particular change that has not shipped yet in the products?

comments: author: David Yu
body: Yes, we're waiting for the features from this fix: <https://jira.atlassian.com/browse/CWD-4337>. Last release of Confluence 5.7.4 contains 2.8.2. The latest JIRA is also stuck on 2.8.2.


Tags: crowd-administration
Can I tell crowd what groups to sync with an application?
Asked by Justin Shapiro:

Like I choose certain groups are JIRA groups and some are Confluence groups etc. That way the drop downs aren't so cluttered and people don't choose wacky groups when protecting spaces or pages. Oh and all of the system groups from my LDAP or AD don't find their way to the tools where they aren't relevant.


Answers:
author: Felipe Kraemer
body: Hi Justin,

Wouldn't it be just a matter of not allowing everyone from a directory to authenticate (<http://localhost:8095/crowd/console/secure/application/viewdirectories.action?ID=3>), and then configure specific groups to authenticate (<http://localhost:8095/crowd/console/secure/application/viewgroups.action?ID=3>)?

I hope this helps!

comments: author: Justin Shapiro
body: No, not really. Yes, that controls who can authenticate and use the tool, but staying with Confluence, if I want to protect a page my available groups include hundreds of choices which have nothing to do with Confluence. This makes my ability to protect data extremely difficult. What I am asking about is a method where when I configure the application in Crowd, I choose which groups will sync with that application. If ten out of 500 are applicable then Confluence only has ten groups.


Tags: crowd-administration
Crowd SSL
Asked by Young__Hahn:

I am currently working on SSL to do HTTPS for my applications.

Only problem I have left is Crowd SSL..

I am following <https://confluence.atlassian.com/display/CROWD/Configuring+Crowd+to+Work+with+SSL> to do SSL however, it is not working.

Main problem is.. I am trying to use same port for https.. Default port for http crowd is 8095 and I want to use 8095 for https..

On Step 1 of the link above, I couldn't find  
`<``Connector` `port``=``"8443"` `protocol``=``"org.apache.coyote.http11.Http11Protocol"`  
` ``maxThreads``=``"150"` `SSLEnabled``=``"true"` `scheme``=``"https"` `secure``=``"true"`  
` ``clientAuth``=``"false"` `sslProtocol``=``"TLS"`  
` ``keystoreFile``=``"${user.home}/.keystore"` `keystorePass``=``"changeit"`  
` ``keyAlias``=``"tomcat"` `keyPass``=``"changeit"``/> `  
in my config file.. but there was original config  
\<Connector acceptCount="100" connectionTimeout="20000" disableUploadTimeout="true" enableLookups="false" maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25" port="8095" redirectPort="8443" useBodyEncodingForURI="true" URIEncoding="UTF-8"/\>  
So I deleted that original connector statement and add the new connector statement on the link (1st connector statement) in that new statement I modified according to my key pass and set port to port="8095" instead of port="8443"  
On step 2 I did the steps in JIRA SSL <https://confluence.atlassian.com/display/JIRA/Running+JIRA+over+SSL+or+HTTPS#RunningJIRAoverSSLorHTTPS-commandline> which should be the same... (Also tried crowd link step 2)  
On step 3  
I modified all 3 config files.. My modification was just changing the http to https since I want to use the same port which is 8095.. so all I did was to change http to https in all 3 files..  
After all this steps, when I run ./start_crowd.sh it does not start the crowd..  
netstat -plten \|grep java returns only port 8020 which is the server port instead of 8095 with 8020..

tried accessing to http and https.. both of them does not work..

When I take out the new connector statement in step1, and put original one, at least it lets me go into http but not https (of course)

Followed step1 exactly like the link... except my certificate config..

JIRA, Confluence, Stash is working fine with SSL except Crowd..

Can someone help me on this part?


Answers:
author: rrudnicki
body: Hi Young,

We received your support request. I'll be working through the ticket, and soon as we solve the issue I'll be posting the answer here for future references.

Regards,

Renato Rudnicki

comments: author: Brian Simms
body: I'm having the same issue. Was this ever resolved?


Tags: crowd-administration

https

ssl

system-administrator
Crowd authentication with Directory based LDAP issue with Git/Gerrit.
Asked by Mohan .S:

Hi Team,

This is regarding crowd authentication with Directory based LDAP issue with Git/Gerrit.

My Environment details:

Operating system: Ubuntu 12.4 LTS -- 64 bit.

Crowd Version - Atlassian Crowd Version: 2.8.2

++Problem description:-++

I have configured Delegated directory type Microsoft Active Directory with our LDAP settings and provided necessary permissions to crowd-openid-server settings and to our git/gerrit server.

Currently my (gerrit.config) file has below settings to access our git/gerrit portal.

\[auth\]

type = OPENID_SSO

openIdSsoUrl = <http://100.101.102.103:8095/openidserver/>

logoutUrl = http:// 100.101.102.103:8095/gerrit_logout.html

But when tried access my gerrit portal, the authentication not giving place to enter my login-id and password.

So kindly advise me to fix the same.

Thanks,

Mohan


Answers:
author: HolgerS
body: You may have to append `/op` to your URL:

<http://100.101.102.103:8095/openidserver/>op


author: Mohan .S
body: Hi Team,

Any update?

-Mohan


Tags: crowd-administration
active directory
Asked by Alessandro Paggi:


Answers:
author: Luiz Maia
body: Hi Alessandro,

Not sure exactly what would be your question, since we have no description here, but if you need help configuring AD with Crowd, please refer to [this guide](https://confluence.atlassian.com/display/CROWD/Configuring+an+LDAP+Directory+Connector).

Please let us know should you have any questions.

Thank you!

Kind regards,

Luiz Maia  
Atlassian Support


Tags: crowd-administration
Crowd - How can I change the server ID?
Asked by LYNN ARDERNE:

Is this possible, if so how? Help much appreciated!


Answers:
author: Felipe Kraemer
body: Hi @LYNN ARDERNE,

That's surely possible. According to [this document](https://confluence.atlassian.com/display/CROWD/Important+Directories+and+Files), the Server ID can be found inside *CROWD_HOME/crowd.cfg.xml:*

*`<``property` `name``=``"`[crowd.server.id](http://crowd.server.id)`"``>B9AN-B9AN-B9AN-B9AN</``property``>`*

If this answer was helpful, please allow me to ask you to mark my answer as accepted in order to have it in the top of the thread, also helping other customers.

Thanks in advance!

Kind regards,  
Felipe Kraemer

comments: author: Prasobh Kollattu
body: cool. its works well.. Thanks


Tags: crowd-administration
How to Load users using Crowd LDAP?
Asked by Young__Hahn:

I am currently using CROWD for LDAP and having problem loading the users.

I guess I will have to explain my problem first..

Our company LDAP contains over 10,000 accounts and over 100 groups.. and in that LDAP, we have a AD group that contains 50 accounts.

On Crowd setting up the LDAP, I set Base DN as where ALL accounts are in there.. which is over 10,000 accounts.

and on configuration page, I leave User DN blank, and set the Group DN as the location of the Group which should contains 50 accounts..

When I update this, it loads ALL the accounts in LDAP and just that specific group.

When I set Base DN as the location of the Group that I want to use, and leave everything blank, it loads JUST THAT GROUP but not the accounts...

I am guessing it is because account belongs to different AD or different location than the Group...

How can I just load the Group that I want to use, and the accounts in that Group only?


Answers:
author: Daniel Santos
body: Hi,  

The users and groups in LDAP are separated objects.  
The Base DN is the root location for JIRA to search in the AD.  
When you leave the User DN blank you tell JIRA to search all users from that Base DN root, if your search pattern is default.  

When you specify the Base DN to the specific group path is expected to get only that group. Since the user search will be done over that specific path that probably does not contain any user object.  

I believe you need the first configuration that get all the users and the specific group and change the users filter to something like this:  
(\&(objectCategory=Person)(sAMAccountName=\*)(memberOf=CN=foo group,DC=example,DC=com))

This will filter all users that are member of foo group.

Cheers,  
Daniel P santos


Tags: crowd-administration

ldap
Crowd : How best to ensure fault tolerance?
Asked by Adam Flinton:

Dear All,

We are looking to use crowd as the central ID server. The one obvious thing about such a system is that it must be resilient. We are mostly cloud based (Digital Ocean) \& as such can have many instances or possible instances of crowd.

So .. what is the best way to guard against machine/OS/app failure ?

Postgres replicating out?

Doing a nightly xml dump \& importing it into clone crowd instances?

e.g. in essence if "crowd1" goes down for whatever reason we'd rather people/users didn't even know \& as such "crowd2" takes over etc.

Has anyone done a multi-instance crowd setup with fault tolerance as a key goal?

TIA

Adam


Answers:
author: rrudnicki
body: Hi Adam,

There's a similar topic on this question where you also can find some ideias as well:

<https://answers.atlassian.com/questions/10392005/best-practices-for-high-availability-for-atlassian-products>

Also, there is this improvement request which I suggest you to vote:

<https://jira.atlassian.com/browse/CWD-1053>

To sum up, if you haven't already, we recommend you check out Go2Group's white paper on a clustering solution:[http://www.go2group.com/en/services/atlassian-services/atlassian-crowd-a-simple-clustering-solution/](http://www.go2group.com/en/services/atlassian-services/atlassian-crowd-a-simple-clustering-solution/ "Follow link"). Whilst running Crowd in a cluster is unsupported, this may help some of you, although be aware that there are known unresolved configuration issues: [https://jira.atlassian.com/browse/CWD-2925](https://jira.atlassian.com/browse/CWD-2925 "Follow link")

Regards,

Renato Rudnicki
forgot login details for crowd
Asked by Jayesh Baviskar:

I forgot the User name \& password for Crowd. How I can get it.

<https://confluence.atlassian.com/display/CROWD/Requesting+Forgotten+Usernames>

is not working for me. I am not getting email.


Answers:
author: Jayesh Baviskar
body: Yes !!! I did it.

<https://confluence.atlassian.com/display/CROWDKB/Getting+InvalidAuthenticationException+in+the+Log+File+When+Logging+into+Crowd>

I succeed to reset password for crowd application.

cheers,

Jayesh


Tags: crowd-administration