youngmon/atlassian-qna huggingface dataset:
Crowd REST API security
Asked by Philip Colmer:

We heavily use Amazon EC2 instances for our infrastructure but one of the big drawbacks is that the IP addresses of the servers can change if a server is rebooted.

One of the developers is proposing that instead of using specific IP addresses, we use a subnet mask of 10.0.0.0/8 which would, essentially, allow any EC2 instance to try to authenticate against Crowd.

I realise that there is an extra layer of security here, i.e. application name and password, but presumably the IP address restriction was put into Crowd for a reason so I'm trying to understand what potential downsides there are to widen the subnet allowed.

The flipside would be that, in theory, I can use Amazon security groups to restrict the traffic reaching the Crowd server, the benefit being that security groups don't specify the actual IP addresses, just the virtual servers in the group so Amazon take care of the rules implicitly. The downside to this approach, though, is that the REST API uses the same port as normal human interaction with Crowd.

Is there any way to move the REST API onto a separate port so that I could lock that down at the network level?

Any other suggestions or comments on keeping this server secure whilst trying to meet the challenges of shifting IP addresses?

Thanks.


Answers:
author: Tiago Comasseto
body: Hi Philip,

That's correct, the *Remote Addresses* tab within the Application settings in Crowd is used to basically enhance security.

Regarding REST API port, it's not possible to set a different port, but as you can see in this [documentation](https://confluence.atlassian.com/display/CROWD/Specifying+an+Application%27s+Address+or+Hostname), you can use host names (e.g. `myhost.com)`, instead of range of IPs to restrict access to your Crowd instance.

I hope it helps.

Cheers

comments: author: Philip Colmer
body: Thanks for the clarification.


Tags: crowd-administration
SSO: stash -- crowd console, works one way but not the other
Asked by Robert Withrow:

I have crowd and stash installed behind a Apached proxy, all operating on the same machine (with the same IP address). I've configured both according to all the documentation I can find.If I log into Crowd Console, SSO works fine on Stash. If I log into Stash, there is no SSO for Crowd Console (IOW, I have to log into Crowd Console even though I'm logged into Stash via Crowd).I'm at a loss how to fix this. Suggestions?


Answers:
author: Robert Withrow
body: Apparently I wasn't correctly proxying in Apache. After I changed the proxy to be the following, everything worked.

```
ProxyRequests Off    ProxyPreserveHost On    ProxyPass /crowd  http://localhost:8095/crowd    ProxyPassReverse /crowd  http://localhost:8095/crowd    ProxyPass /stash http://localhost:7990/stash    ProxyPassReverse /stash http://localhost:7990/stash
```

comments: author: cofarrell
body: Hi Robert,

I just wanted to confirm. You managed to get SSO working?

Charles


author: Tiago Comasseto
body: Hi Robert,

The SSO configuration sometimes is tricky, but there are some key points that I'd suggest you to check, they are the following:

1. Ensure that the URLs being used to access each application and the [SSO Domain](http://confluence.atlassian.com/display/CROWD/Domain) value stored in Crowd are valid and match the pattern;  
2. Ensure that all applications are using the Crowd authenticator at their **WEB-INF/classes/seraph-config.xml** files;  
3. Ensure that the Directories that are assigned to each application in Crowd, If more than one, are in the exact same [order](http://confluence.atlassian.com/display/CROWD/Specifying+the+Directory+Order+for+an+Application);  
4. If there are proxy servers being used between Crowd and the applications, make sure to add their IP addresses to the[Trusted Proxy Servers](http://confluence.atlassian.com/display/CROWD/Configuring+Trusted+Proxy+Servers) list in Crowd.

I hope this information has helped.

Cheers

comments: author: Robert Withrow
body: Thanks. Here's what I've configured:

1. The URLs are all D.C.B.A/X, like D.C.B.A/stash or D.C.B.A/crowd. The SSO Domain is D.C.B.A
2. Stash doesn't use Seraph and doesn'thave a seraph-config.xml file.
3. The directories are in the same order, but aren't identical. No users are shared between directories. IOW, user X exists in only one directory.
4. There is a proxy server and its address in the Trusted Proxy Server's list, and also it is the same IP as each of the Atlassian applications which are standalone.

All of this was the existing configuration which had the problem described above. So none of this fixed the problem.


author: BernardoA
body: In addition, I'd suggest you specially to check if is correctly informed the application name in the crowd.properties file on your application.

Please check this documentation for more information:

<https://confluence.atlassian.com/display/CROWD/Troubleshooting+SSO+with+Crowd>

Bernardo

comments: author: Robert Withrow
body: Thanks. Yep, had did that already.


Tags: bitbucket-server

sso
How can I auto assign groups based on a registered user's domain in Crowd (or Confluence)?
Asked by Geert Graat:

Hi,

We use Confluence \& Crowd for our community. Users can register through Confluence in the Crowd directory. When the user authenticates through the Crowd directory, Crowd automatically adds a number of groups to the user, which allows the access general parts of our community. So far so good.

Now when a user registers that is an employee of one of our partners, this user is assigned a specific group which allows the user to access the partner specific part of our community. This is currently a manual action, based on the email address of the user that signed up.

I am looking for a way to automate this. Ideally I would like to define a rule or something in Crowd, that would say something like 'if a user with email domain X authenticates for the first time than automatically add group Y'. Optionally you could do this in Confluence.

I have seen this working on some sites that use Confluence, so maybe there is a plugin for this? I have not been able found it so far. Any help is appreciated.

Regards,

Geert


Answers:
author: Geert Graat
body: There does not seem to be a way to resolve this currently. I posted a feature request on the Crowd support site: <https://support.atlassian.com/browse/CWDSUP-8088>. I will update here when I hear back from them.

Geert


author: Tiago Comasseto
body: Hi Geert,

There isn't such option in Crowd and there isn't any plugin available either. If those users are coming from an LDAP, the best option in this case is associated the users to the groups directly on the LDAP.

Another option can be create two directories, define different default groups to each directory and set a filter in each one to synchronize only the users that match a given email domain. Example: (\&(objectClass=person)(sAMAccountName=\*)(mail=\*@domain_a.com))

I hope this helps.

Cheers

comments: author: Geert Graat
body: Hi Tiago,

Unfortunately the users are registered in a Crowd internal directory and not LDAP, so this will not work in my situation.

Geert


author: Stefan Broda
body: OK, I'll keep digging. thanks for the quick reply!


author: Geert Graat
body: Hi Stefan, unfortunately not. We still manually add groups to users.


author: Stefan Broda
body: Hi Geert, Have you found any good solution to your requirement?


author: BernardoA
body: I didn' find any external plugin for this case, but I think you can have something similar as Confluence going to Crowd \> Directories Tab \> select such directory \> finally click at Options tab, then when user in this directory authenticates successfully for the first time, they can be automatically added as members of such group created.

Bernardo

comments: author: Geert Graat
body: Hi Bernardo, thanks for your answer. What you describe is what is already in place. However, this happens for every user. I want to automatically add groups for specific users, based on the domain they belong to.

Geert


Tags: crowd-administration
How to refresh full name in Confluence when working with Crowd?
Asked by Frank P?chl:

I am currently facing a problem. We created a new user in Crowd with a spelling error in the full name. The user worked successful in Confluence and would like his full name to be corrected.

However, in Confluence I cannot change the full name - maybe this is because the users are configured in Crowd.

So I changed the full name in Crowd, but I do NOT see the changed name in Confluence.

Any guess?

Thanks,  
Frank


Answers:
author: Peter Van de Voorde
body: Hi Frank,

Some more information about external user management in Confluence 3.0.2 can be found here :

<https://confluence.atlassian.com/display/CONF30/Understanding+User+Management+in+Confluence>

Best regards,

Peter

comments: author: Frank P?chl
body: Thanks for the link to the documentation. However, I am not able to find the information how to update the Full Name in Confluence if user administration is done by Crowd.

User was created with a typo in the Full Name, after correction in Crowd the Full Name in Confluence is not updated and I am not able to update the Full Name within Confluence.

Any idea?


author: Peter Van de Voorde
body: Frank,

Can the user edit his name in the profile page?

I can't realy test anything because I don't have such an old confluence running.

Best regards,

Peter


author: Frank P?chl
body: Thanks for the quick response. Neither the user himself nor the administrator is able to edit the full name.

SORRY - but I haven't found that user was defined in two different Crowd directories and only one of the two entries was changed.

BIG EXCUSE to waste for wasting your time.

So, I have learnt first to clarify if my admin colleagues are telling me the complete truth ;-)


author: Frank P?chl
body: Thanks Peter. My fault, I forgot to mention that we are still using Confluence 3.0.2 (yes, we are going to upgrade this year, but still running this old version).

Any hint about running this sync, because I ahven't found the **'User Directories'** screen?

Thanks,  
Frank


author: Peter Van de Voorde
body: Hi Frank

You need to resync your user directory in Confluence to see the changes you made in Crowd.

You can do this manualy or wait untill it happens automatically.

More information can be found here : <https://confluence.atlassian.com/display/DOC/Synchronising+Data+from+External+Directories>

Best regards,

Peter
How to disable application login for system users?
Asked by Kiodex:

In crowd we have some system users that we use for assigning tickets: AS, dba, otps, pd, sd and qa

Is there a setting we can use within Crowd that would prevent those users from logging into the application?  
i.e. we never login as those users...they are only use to assigned tickets.


Answers:
author: William Zanchet [Atlassian]
body: Hi Kiodex,  

You can update a column in the database side, to make this specific user, be "disabled", the user will exist in the database, but will not be visible/counting against the license:

```
select * from cwd_user where user_name = 'admin';
```

Once you have the id from this user, you can run the following SQL statement, that will make the user be "disabled"

```
update cwd_user set active = 'F' where id = 'ID_FROM_THE_USER';
```

**Before running the update query, please do a full backup of your database.**

Cheers,  

WZ

```

```


author: Christian Czaia _Decadis AG_
body: Hey,

I have an internal group with those kind of users and simply don't grant them the "JIRA users" permission.

<https://confluence.atlassian.com/display/JIRA/Managing+Global+Permissions>
Retrieving attributes for a custom Crowd directory
Asked by David Clegg:

Does anyone have an example of how to retrieve the values in code for the attributes specified on the Attributes tab when configuring a custom Crowd Directory?


Answers:
author: David Clegg
body: Any attributes specified here are passed to your custom directory implementation via the RemoteDirectory.setAttributes method. So you can use the following to store the attributes, so you can fetch them later:-

```
private HashMap&lt;String,String&gt; attributes = new HashMap&lt;String, String&gt;();@Overridepublic void setAttributes(Map&lt;String, String&gt; attrs) {  for (Map.Entry&lt;String, String&gt; entry : attrs.entrySet())  {    attributes.put(entry.getKey(), entry.getValue());  }}
```


Tags: attribute

directory
Crowd doesn't see all users in AD
Asked by Sune M?lgaard:

Hi All,

A customer has a Crowd instance that has a connector to a company AD set up.

They recently migrated their AD from one server to two new, and since then, a number of users have been unable to login.

Searching for those users in crowd revealed that Crowd no longer sees them in the AD, even though they most certainly are there \*and\* are members of the relevant groups that I'm filtering for.

I don't know if it's relevant, but the two new DCs are running Windows Server 2012 - I don't know what the old DC was running.

What could be wrong, and how can I find out?

Best regards,

Sune M?lgaard


Answers:
author: Tiago Comasseto
body: Hi Sune,

It's a bit difficult to know what's wrong with only this information. Would be possible for you add some more details of your configuration and let us know if there is any error in your Crowd logs?

Also, have you created a new directory in Crowd for this new AD server or have just updated the existing one to point to the new server?

Cheers

comments: author: Sune M?lgaard
body: I initially created a new directory and ran into the problems I described.

Going back and just editing the old directory seemed to do the trick, however.

Worth noting was that I pointed the connector directly at the domain this time, instead of one of the actual servers.

Thus, I mark your post as the answer, since I take it to suggest editing the old directory if (as I did) I had tried to make a new one.

Cheers


author: Tiago Comasseto
body: Hi Sune,

It's a bit difficult to know what's wrong with only this information. Would be possible for you add some more details of your configuration and let us know if there is any error in your Crowd logs?

Also, have you created a new directory in Crowd for this new AD server or have just updated the existing one to point to the new server?

Cheers


author: Sune M?lgaard
body: Furthermore, trying the LDAP filter on the DC itself \*does\* find the missing users...


Tags: active-directory
Connecting Crowd with Wordpress site
Asked by Tarun Sapra:

Hi,

Whats the best possible way to connect Crowd with wordpress site, the existing connector seems to be deprecated.


Answers:
author: Craig Castle-Mead
body: We use <https://github.com/broadinstitute/wordpress-crowd-plugin> and it works well - looking to add SSO support as it doesn't do that.


author: William Zanchet [Atlassian]
body: Hi Tarun,

As far as I know, there's no way to connect Crowd with WordPress. Also I was able to find the an improvement request already closed about this subject as you can see here:  

<https://jira.atlassian.com/browse/CWD-1822>

Cheers,  

WZ


Tags: wordpress
Crowd Directory Server
Asked by Nakhil Bhandari:

I am currently looking at replacing Apache DS LDAP and was looking for the best DS for a Production enviroment.

Stubled upon Microsoft Active Directory Lightweight Directory Server, this ticked most of our requirements.

need some assistance moving the users from Apache DS to AD LDS. also having some issues with crowd creating users in the the AD LDS.


Answers:
author: Bruna Griebeler
body: Hi Nakhill:

Have you checked this documentation yet? <http://social.technet.microsoft.com/Forums/windowsserver/en-US/ff584845-f6e2-4c7a-93ee-0195ec337db4/export-structure-from-apacheds-to-adam>

It basically explains the differences between the LDAP vendors. In this case, the changes can be made directly in the LDIF file.

Hope it helps!


Tags: crowd-administration
In the Crowd GUI it take a considerable amount of time to display the list of user in a group.
Asked by Jerome Taylor:

Does anyone else have this problem and/or know how to resolve it.


Answers:
author: William Zanchet [Atlassian]
body: Hey Jerome,  

After researching in our Internal Support tools, it seems that we have this problem already tracked down, as you can see here: <https://jira.atlassian.com/browse/CWD-3266> and your version is under the affected ones.  

I would strongly suggest that you vote on this issue to increase its popularity and add it to your watchlist for future updates.

Cheers,  

wz


author: Harry Chan
body: What version of Crowd are you using? I find Crowd slower when it's limited by permgen - not always the case. How is this group of users connected? Does it use LDAP or local?

comments: author: Jerome Taylor
body: Version 2.6.2. I created my own delegated authentication directory, but displaying users in a group is also slow when selecting them from an internal directory. Also size of the group does not matter, it slow for a group containing one member.

<br />


Tags: crowd-administration
Can Crowd Manage an Application like BMC's FootPrints Service Core Internal Users?
Asked by Richard Kim:

Can Crowd Manage an Application like BMC's FootPrints Service Core Internal Users?


Answers:
author: Tiago Comasseto
body: Hi Richard,

I'm not familiar with this application, but Crowd supports the following [Applications and Directories](http://confluence.atlassian.com/display/CROWD/Supported+Applications+and+Directories). You may also be interested in this [documentation](https://developer.atlassian.com/display/CROWDDEV/Creating+a+Crowd+Client+for+your+Custom+Application) about developing a custom application.

Cheers
Filtering crowd users from ldap to a group without memberOf attribute
Asked by jlkenyon:

I am trying to use crowd to manage access to atlassian tools for my group at a larger company. We are using an open ldap instance as our directory, which holds tens of thousands of users. Our license only supports up to 500 users, so when I failed to constrain the users correctly, crowd shuts down saying that our license does not allow this many users.  

The obvious answer is to use the User Object Filter to reduce the imported users to only the users in our group. Unfortunately, the ldap admins have not enabled the memberOf attribute in their open ldap instance, and I do not have any sway with them to enable it. The group objects have the memberUid attribute set, which means I can find out who is in the group, however I am unable to craft an ldap search which returns the user records in a given group.  

Is there any other way of informing Crowd that it should pull both groups and users from an ldap server, but it should only consider users in a specific ldap group towards the users we want supported in crowd (and thereby counted for our license)?  

Note that I also need to pull many groups from ldap, some of which will have many users that I do not want to be imported into crowd.


Answers:
author: Bruna Griebeler
body: Hi John!

What about if you try to filter through OU? Not sure if the users you want to filter are in the same place, but if it's the case, you may create the filter as set on these examples: <https://confluence.atlassian.com/display/DEV/How+to+write+LDAP+search+filters>

Hope it helps!

comments: author: E Davies
body: no longer exists, Im finding this issue too


Tags: crowd-administration

ldap
Change page title in Crowd
Asked by Matthew J. Horn:

Does anyone know how to change the page title for the various pages that users access in Crowd? (such as forgot login details, reset password, etc).

The page title defines the text that appears in the tab of the browser. It is prefaced with the Crowd favicon, then the text "Atlassian Crowd" and then the value of a string set in the various console pages.

What I can't figure out is how to remove or change the "Atlassian Crowd - " part. I was hoping it was a property or something and didn't require modifying a class.

Here's a screen cap of what I'm talking about:

![](http://i.imgur.com/X7UWyUg.gif)  


Answers:
author: Matthew J. Horn
body: Thanks, William, I was mucking with that file (and other JSPs in the console, but could not seem to suppress the "Atlassian Crowd" part of the title. I finally tried a few more things, and just replacing application.title and removing the decorator:title element seemed to work. So now I use the following and it works great:

\<title\>

\<ww:text name="Verivo Login"/\>

\</title\>

Thanks for following up, but it seems like I don't need to find the source of the application.title property after all. Just removing it entirely works ok.

matt


author: William Zanchet [Atlassian]
body: That's awesome Matt! Thank you for sharing the solution with us. :)


author: William Zanchet [Atlassian]
body: That's awesome Matt! Thank you for sharing the solution with us. :)


author: William Zanchet [Atlassian]
body: Hi Matthew,  

I spent a bit of time, trying to get a clue where this option could be found, and it seems that we need to modify a .JSP class.

After researching, it seems that the *Atlassian Crowd* , isn't a string but is a content of an attribute called name, place inside the tag ww:text as you can see here:  

```
&lt;title&gt;        &lt;ww:text name="application.title"/&gt;&amp;nbsp;-&amp;nbsp;&lt;decorator:title/&gt;    &lt;/title&gt;
```

This file is located in the */crowd-webapp/console/decorator/default.jsp* I'm not sure where the application.title is coming from, but once we found it, will be easy to change.  

I know that doesn't help, but is just a lead to where to look. :)  

Cheers,  

WZ  

<br />


Tags: crowd-administration
"Current users" count
Asked by Milan Negovan:

We have a 50-user Crowd license. When I go to Administration \> Licensing, I see the "Current users" count at 45.

Realistically, I don't have that many people authenticating against our AD via Crowd. Where is the count coming from? Is it the count of all users within groups which are granted access to autenticate, or something else?

Cheers!


Answers:
author: C. Faysal
body: Hi Milan.

check this

<https://confluence.atlassian.com/display/CROWDKB/Crowd+users+counting+toward+application+user+limit>

comments: author: Milan Negovan
body: Bingo! Thank you!


author: C. Faysal
body: you're welcome


Tags: crowd-administration