youngmon/atlassian-qna huggingface dataset:
crowd redirecting to https
Asked by lance_lyons:

Hi, We have a second instance of crowd setup that we are doing some testing with. Its setup on the same web server as the previous crowd but listening at a different port (8097 instead of 8095).

If I go to the straight ip addresses it works and does not redirect to https

<http://10.243.2.193:8097>

and

<http://10.243.3.11:8097>

and

<http://corp-jiraweb:8097>

all work

however when we setup using a pretty name like [crowd2.onlifehealth.com](http://crowd2.onlifehealth.com) in DNS (10.243.3.33) and use F5 load balancer pool to redirect to [crowd2.onlifehealth.com](http://crowd2.onlifehealth.com) to <http://10.243.2.193:8097> it does not work properly.

<http://10.243.3.33>

and

<http://crowd2.onlifehealth.com>

don't work and seem to redirect to <https://10.243.3.33/crowd/console/login.action> or <https://crowd2.onlifehealth.com/crowd/console/login.action>

respectively.

Of course the https does not work.

Any ideas on what is happening here? Our network guys swear up and down that there is no redirect happening in the F5 and a fiddler trace verifies this.

We did create this second crowd instance from our working crowd instance (backup and restore from xml) however all of the crowd.properties, build.properties, etc all reflect http for urls in this instance.

<br />


Answers:
author: Foong
body: Have you setup the trusted proxy server settings?

* <https://confluence.atlassian.com/display/CROWD/Configuring+Trusted+Proxy+Servers>
* <https://confluence.atlassian.com/display/CROWD/Debugging+SSO+in+environments+with+Proxy+Servers>
Cannot import crowd.model.user.UserTemplate
Asked by Ryan Cutter:

I'm using Crowd 2.4.2 but cannot import UserTemplate. I'm able get the crowd.model.user.User interface but cannot get to any of the classes in that package.

I've included crowd-integration-client-common, crowd-integration-client-rest, embedded-crowd-api, crowd-integration-api in my pom. Is there something else I need to bring in?

Thanks! Ryan


Answers:
author: joe
body: com.atlassian.crowd.model.user.User is implemented by com.atlassian.crowd.model.user.UserTemplate, which is in the crowd-api artifact.

comments: author: Ryan Cutter
body: Thanks Joseph.


author: Ryan Cutter
body: For those who encounter this issue in the future, I believe the preferred path is to create a class implementing the com.atlassian.crowd.model.user.User interface and run your changes through a CrowdClient. If you look at the demo app that shipped with 2.4.2, there's a good example of this in:

demo-webapp/com/atlassian/crowd/security/demo/model/DemoUser.java  
demo-webapp/com/atlassian/crowd/security/demo/action/user/UpdateUser.java
Can Crowd integrate with MediaWiki?
Asked by Dan Cho:

Hi,

We have Outlook, JIRA, Confluence and MediaWiki.

We are now getting Crowd -- to log into JIRA and Confluence using Outlook credentials.

Is it possible to use Crowd to also log into MediaWiki using Outlook credentials?


Answers:
author: JustinK
body: The answer is yes. There is an 'experimental' Crowd Authentication module offered by MediaWiki. Note that this is offered by the Media Wiki community and not Atlassian.

<http://www.mediawiki.org/wiki/Extension:CrowdAuthentication>

comments: author: Dan Cho
body: Thanks for the quick response. It does say "beta" -- I'll read about the risks and propose to our IT.


author: Ellen Feaheny [AppFusions]
body: Also happy to help with that Dan if does not work out - AppFusions has done alot of work with Crowd authenticators beyond the ones that come in the box.

Best,

Ellen

[info@appfusions.com](mailto:info@appfusions.com)
SSO integration with JIRA
Asked by saslam:

I m desigbing a custom Authenticator which in herits CrowdAuthenticator. I have thereby replaced SSOSeraphAuthenticator in seraph-config.xml by my custom Authenticator. How ever, my JIRA is unable to start as the log confirms that my authentificator which inherits CrowdAuthenticator bears the below constructeur could not be instantiated.

<br />

SsoCustomAuthenticator(CrowdHttpAuthenticator crowdHttpAuthenticator)

<br />

It is obvious because the construteur carries an argument as I dont have a choice(Implicit super). Have any one of you seen this kind of problem before?

<br />

P.S:

<br />


Answers:
author: saslam
body: I have solved the problem by myself, thereby the code below:

public VsjSsoAuthenticator(CrowdHttpAuthenticator crowdHttpAuthenticator) {  
super(crowdHttpAuthenticator);  
}  

public VsjSsoAuthenticator()  
{  
this(RestCrowdHttpAuthenticationFactory.getAuthenticator());  
}  


Tags: jira

sso
We are not able to update user details from Crowd to open LDAP server
Asked by Gavad Khan _PS_:

We are trying to connect our open LDAP server with the Crowd application. We are using Crowd directory connector for connecting open LDAP to the Crowd server. In directory connector configuration, if we use open LDAP default inetOrgPerson object class then we are able to do all types of user operations (add user, delete user, password change \& update user details etc.) from Crowd.

But if we use (in directory connector configuration) open LDAP custom jiraPerson object class (defined in LDAP schema) then we are not able to update user details (changing firstname/lastname/email etc) from Crowd. However we are able to do add user, delete user \& password change operations from Crowd.

Please let me know, why we are not able to update user details (with custom object Class) from Crowd.

Crowd Version: 2.4.2

OpenLDAP Version: 2.3.42


Answers:
author: fsim
body: Hey Gavad,

I guess it's best that I post the improvement request and the bug here so that other users can benefit from it as well: <https://jira.atlassian.com/browse/CWD-2892> and <https://jira.atlassian.com/browse/CWD-2888>

Regards,

Foogie
Crowd installation unable to continue
Asked by sanath kumara:

I am first time installing Crowd 2.4 on Centos 6.2 and unable to continue installation wizard Default Administrator creation. i am using default integrated data base and Base URl as <http://localhost:8095/crowd>.

<br />


Answers:
author: fsim
body: Can you make sure that you are able to ping localhost? If you are not able to ping localhost, then that would be a problem with your OS' hosts file (\<tt\>C:\\Windows\\system32\\drivers\\etc\\hosts\</tt\> for Windows and \<tt\>etc/hosts\</tt\> for Linux). Simply add the mapping for 127.0.0.1 to localhost in that file. Refer to your OS manual for more info on how to do that. But if you are able to ping localhost, then shutdown Crowd, Remove the Crowd Home Directory (to restart the Crowd installation), and restart Crowd. After Crowd is started, make sure that you are able to access Crowd via <http://localhost:8095/crowd> , and make sure that you set the base URL to <http://localhost:8095/crowd>, in 1 try.


author: Sultan Maiyaki
body: Hi Sanathw,

Any errors thrown in the UI when you access <http://localhost:8095/crowd> ? Have you tried using IP address rather than the localhost. Provide us with a screenshot of the error you are getting and a little bit of the stack trace logged in {{CROWDHOME/atlassian-crowd.log}} file
Multiple SSO Domains
Asked by Joseph Yamada:

Crowd is stamping the Domain to the cookie for SSO against the configured SSO Domain

(<https://confluence.atlassian.com/display/CROWD/SSO+Cookie>),

and I want to support SSO between multiple hosts within different domains.

I can stamp my own cookie within a different domain, but I want to use Crowd

directly to do so.

Is there anything you can suggest?


Answers:
author: Giuliano C.
body: Hello Joseph

Thank you for contacting us!

Unfortunately, Crowd cannot perform such feature, but we have \[this\|https://jira.atlassian.com/browse/CWD-1093\] Feature Request open to allow users to perform this action.

Please vote on this issue and add it to your JIRA watch list for future updates.

Also, feel free to add any comments you think are necessary/important.

Is there anything I can do for you today? If there is, please let me know it.

Cheers,

Giuliano Tenedini

Atlassian Support
Clear text passwords stored in cwd_directory_attribute - embedded Crowd and Standalone
Asked by Peter Meier:

Hi all

I just notiecd that Crowd (embedded version as well as standalone) stores passwords for directories and applications in clear text (table cwd_directory_attribute / ldap.password \& application.password). I believe that is a big security issue so I wonder if there is a workaround available or if this is just a matter of configuration?

Thanks

Peter


Answers:
author: joe
body: There is an open Crowd issue for this - [CWD-1876](https://jira.atlassian.com/browse/CWD-1876). However, if the password in the database is encrypted, this still leaves the problem of how to store the master key securely.


Tags: crowd-integration

ldap

security
How to reset the Domain Cookie Value for the Crowd instance using Embedded database HSQL ?
Asked by V:

Hi,

Regarding resetting the Domain Cookie Value for Crowd we followed the below URL

[https://confluence.atlassian.com/display/CROWD/Resetting+the+Domain+Cookie+Value?focusedCommentId=296097387\&#comment-296097387](https://confluence.atlassian.com/display/CROWD/Resetting+the+Domain+Cookie+Value?focusedCommentId=296097387&#comment-296097387)

But, there is no info if the crowd uses Embedded DB HSQL.

Please help us.

Thanks,

Venkat


Answers:
author: V
body: I got below reply from Atlassian Support

Although there is a possibility of running an SQL query on HSQLDB using [DBVisualizer](https://confluence.atlassian.com/display/DOC/Connecting+to+HSQLDB+using+DBVisualizer), we do not recommend you to perform such task as it will increase the chance of database structure being altered. We had a case previously whereby after executing an update SQL query on HSQLDB, the Crowd instance cannot be started anymore. Therefore, if you would like to do such task, we would strongly recommend you to migrate the database to a [supported external database](https://confluence.atlassian.com/display/CROWD/Supported+Platforms) first.

For more information regarding this, please refer to the following KB:

* [Migrate to Another Database](https://confluence.atlassian.com/display/CROWD/Migrate+to+Another+Database)


Tags: crowd-integration
Crowd not working anymore after adding to many users. How do I revert?
Asked by SamK:

Hi,

I added an application link with a few groups linked to it. After this I could not access to Crowd anymore. Here is the message I'm having:

*Your current license does not permit the number of users you have configured in Crowd, please upgrade to a new license, or contact Atlassian Sales Support.*

So I obviously want to fix this but there is no access to the admin panel anymore... HOW DO I FIX THAT?!


Answers:
author: Septa Cahyadiputra
body: The best way to do this is to create an evaluation license and implement it to your Crowd server so that you would be able to log-in into it.

After youa re able to log-in please reduce the number of licensed users on your Crowd and re-implement your commercial license.

Hope it helps.

Cheers,  
Septa Cahyadiputra

comments: author: SamK
body: Hi Septa, thanks for your answer.

I mark your answer as the correct answer.

However I did it otherwise: I just restored the backup database from yesterday.

Cheers!

Nevertheless I think this behaviour is totally unacceptable.


author: Septa Cahyadiputra
body: Yeah, that would work also :).


author: Toyota NZ
body: BTW: To get a eval licence to fix this you need the server ID which you can't get to as you can't log in. It can be found in \<crowd data dir\>/crowd.cfg.xml

comments: author: Jaume Vich Salas
body: Thanks for the file location.

This situation is totally ridiculous. shameful


author: jebteb
body: I am having the same problem. The 'fix' you described is a complete hack. I agree with Samuel that this behavior is totally unacceptable. I have a lot of appreciation for Atlassian and the products you make, but this ridiculous.


author: boris_alyurov_prcm
body: Is this behavior change in the latest Crowd versions? We are on 2.72 and just experienced this.


Tags: licence
Integration Crowd with ready billing system
Asked by Kirill Sakolin:

Hello.

I wonder if it is possible to integrate Crowd openID server with ready billing system? What opportunities does crowd provide for this?

Thanks.


Answers:
author: Kirill Sakolin
body: Nice support...

comments: author: Nic Brough -Adaptavist-
body: We are NOT support, we are a community of users, who share answers because we can (my reasons are because I get so much help here, I feel like giving something back). Atlassian support are nice, that is true.

Crowd is designed to be used by anything that might want to use it for authentication. Atlassian systems all have that built in, but if you want to integrate it with other systems, you usually need to do a bit of work. The best place to ask is probably the community that uses the software, but if you have no luck there as well, then start at <https://developer.atlassian.com/display/CROWDDEV/Creating+a+Crowd+Client+using+Crowd+Integration+Libraries>


author: Kirill Sakolin
body: Thanks for answer.


author: Kirill Sakolin
body: Thanks for answer.
Multiple LDAP URL's for Directory
Asked by Jason Slagle:

Howdy!

A customer of mine is using crowd with Active Directory - the recently had the domain controller crowd points to fail.

Is there any option there for high availability? Is it safe to just point crowd at the base level A record? Will it support the SRV record if I point it at _ldap._tcp.SITE._sites.domain.local


Answers:
author: LuizA
body: Hello Jason,

Actually exists a third-party solution for High Availability for Crowd, it's a solution from the Atlassian Expert Go2group, please check this article for more information:

<http://www.go2group.com/en/services/atlassian-services/atlassian-crowd-high-availability-for-demanding-environments/>

And you can make a contact with them by the following:

[http://www.go2group.com/en/contact-us/contact-form/](http://www.go2group.com/)

hope this helps.

Best Regards,

LJ.


Tags: active-directory
Cannot install crowd (Application does not exist)
Asked by Sergey Shmarkatyuk:

I have problem with installing Crowd on Red Hat 5.5 (with MySQL 5.0). I get SQL exception after specifying default Crowd administrator (unfortunately, I didn't save stacktrace of the error). After this exception I get message 'Application \<crowd\> does not exist'. This error does not allow to proceed with Crowd installation, I'm stuck on the 'Integrated Applications' phase.

![](../../upfiles/Screenshot_-_7_11_2012_,_5_20_07_PM.png)

How could I fix the Crowd installation?


Answers:
author: JustinK
body: Is "2-FRNAVSERV108-0" the name of the administrator you created for the instance?

I think the easiest thing to do atm. Would be to drop and re-create the database + delete the files in the home directory and restart the installation process.

My guess is somehow you have gone through the setup process twice (??) and now the database is in a very inconsistent state, a simple re-install of Crowd following what I have said abive is the best option.

Cheers,

Justin

comments: author: Sergey Shmarkatyuk
body: I did what you recommend (delete CROWD_HOME dir contents and truncate crowd database) at least 3 times. Unfortunately, it didn't help.

I don't know what 2-FRNAVSERV108-0 means, but FRNAVSERV108 is the hostname of the machine where I'm installing crowd. And I didn't supply this hostname explicitly. As far as I remember, crowd got it without asking me.


author: Sergey Shmarkatyuk
body: Here is the stacktrace of error happening after specifying of crowd administrator: (crowd-stacktrace.safe.txt)


author: Sergey Shmarkatyuk
body: ```
Here is the stacktrace of error happening after specifying of crowd administrator:
```
Unable to login to Crowd after migrating to new server
Asked by William Wells:

I'm setting up a mirror image for Crowd on a separate server for testing the upgrade from 2.0.7 to 2.4.1. I've created a separate MySQL database and imported the data. Initially, I'm able to login using the authentication with the production server, but once I follow the instructions in the link below and modify the crowd.properties file on the test Crowd server and remove the IP address from the production Crowd for the test Crowd server, I can no longer login. when I look at the tables in my test Crowd db, I see my user account name in the listing but it just doesn't let me in. I don't even get anything in the catalina.out file saying it fails or that there was even a warning or error. it simply just doesn't work. Any ideas?

<https://confluence.atlassian.com/display/CROWD023/Migrating+Crowd+between+Servers>


Answers:
author: William Wells
body: Found that this was an issue with the version we were trying to upgrade to on that particular server. Whatever the cause was exactly I'm not sure, but I chose to upgrade to a different version and that seemed to "unlock" whatever was causing the problem.


author: Colin Goudie
body: So this is logging in via the crowd web application you are refering to?

The Crowd web application (console) is actually a crowd client registered with the crowd server (i.e. under the Application tab)

If you look on your production server, Applications-\>Crowd-\>Remote Addresses you will probably find it has your production IP in there.

When you migrated crowd server (staging) is seeing you attempt to log in from another crowd console that it doesn't have the IP configured under that Remote Address.

So can you confirm that you indeed DID add the new server's IP to the remote addresses on the production server BEFORE migrating the data. (Under the Preparation section in that link you posted)

comments: author: William Wells
body: Yes, I did add the new server's IP address to the remote addresses on the production server prior to migrating. The IP address was/is showing up on the new server's remote IP address listing after I did the migration and brought it up. But once I go back to the production system and remove the new server's IP address I can no longer log in with the same credentials that work on production.


author: Colin Goudie
body: Another thing to check, your new server's install isn't pointing at the production crowd's home directory is it? and therefore picking up the old crowd.properties file?


author: William Wells
body: No, it is looking at it's own home location. They are very different locations just to ensure that doesn't happen. I recently did another installation and export to ensure that the steps were performed exactly as required and I'm still having the same problem.
How to change the Crowd URL and domain and keep SSO working?
Asked by dchisholm:

I am trying to change the URL (and IP) of my local, standalone Crowd instance, but it will not accept my new domain.

I changed the URLs in crowd.properties; changed the allowed remote addresses of registered applications; and changed the Crowd URL for the user directories in the remote applications (in this case, Confluence).

The changes did not go smoothly (e.g. I had to tweak the domain attribute directly in the database), but eventually, I got everything working except SSO.

Now, I keep getting this error (from the crowd logs):

Invalid SSO Domain value: '.newdomainname.com' found in settings. Domain currently in use is: 'oldhostanme.olddomainname.com'.

I have searched the entire installation and home folders for the "oldhostname" and I cannot find it. I have also searched the cwd_property table in the database.

Any suggestions?

Addendum:

I'm running Apache but not using Virtual Hosts.


Answers:
author: dchisholm
body: SSO is working now, but I still get the error message about the SSO domain value.

The problem with the SSO was that the Authenticator class in Confluence was not the SSO authenticator class (missed this during an upgrade).


Tags: domain

sso
Unable to log into new Crowd after migration
Asked by William Wells:

After following the instructions in <https://confluence.atlassian.com/display/CROWD020/Migrating+Crowd+between+Servers> for Crowd 2.0.7 in preparation for an upgrade, am unable to login using same credentials that work on my production system. Catalina errors are below:  
ERROR \[crowd.integration.springsecurity.CrowdSSOAuthenticationProcessingFilter\] Unable to unset Crowd SSO token  
com.atlassian.crowd.exception.InvalidAuthenticationException: Unable to unset Crowd SSO token com.atlassian.crowd.integration.exception.InvalidAuthorizationTokenException: Client host is invalid 192.168.1.2/192.168.1.2


Answers:
author: Septa Cahyadiputra
body: Seems like a known issue judging from the given stack trace. Please review the following knowledge base article and see if it helps

* [Client Host is Invalid](https://confluence.atlassian.com/display/CROWDKB/Client+Host+is+Invalid)

Cheers,  
Septa Cahyadiputra
crowd 2.3.2 - invalid login
Asked by James Gong:

I cannot login to the Crowd suddenly, here's the log file. It says unknow host name?

(atlassian-crowd.log)


Answers:
author: LuizA
body: Hello James,

Judging from the stack-trace at your log file it seems that the cause of this problem would be due to changes in your DNS server that cause Crowd to not able to resolve the host name, so as a first approach you could double check with your network administrator and see if there are any changes from the network side that may cause this issue.

Hope this helps.

Kind Regards,

LJ.
Crowd Import Error 'the password encoder 'atlassian-sha1' was not found in the encoders list by the PasswordEncoder Factory'
Asked by William Wells:

I've setup a test VM with the same version of Crowd 2.0.7 and want to import the backup file from my production Crowd. During the import I receive the error "the password encoder 'atlassian-sha1' was not found in the encoders list by the PasswordEncoder Factory". The import stops at that point. The catalina.out file reflects the same error.


Answers:
author: William Wells
body: The problem was that I hadn't setup my new crowd instance to communicate with the current production crowd. Once I added the application and tried the import it worked.
Could not replicate the entire batch using the BatchProcessor
Asked by William Wells:

I am cloning a production server for a staging, test with 4.1.2 to start a major upgrade of all of our Atlassian tools. I followed the instructions in <https://confluence.atlassian.com/display/CROWD020/Migrating+Crowd+between+Servers> and everything seemed to be working fine until I got to the import portion. It starts off fine, but as it is importing I get the error in my subject line. I'm using MySQL for both of the backend databases for test and production. The only difference between the two systems is that the original seems to have been installed as a WAR and the test is a standalone.


Answers:
author: William Wells
body: The problem I found was there was a duplicate user account created with the same user login. The account was for the same person, and it should have been identifiable by Crowd as a separate entity due to the assignment of a uuid to each account, but it didn't. I went into the backup xml file and removed one of the instances completely and was able to move forward in the import process.


author: David Feig
body: I had the same experience. I manually deleted duplicate users from the xml backup file. These were breaking database unique constraints. I just don't understand how these got into the backup.

I used the following bash command to find dups:

```
grep '&lt;name&gt;' atlassian-crowd-2.3.4-backup-2012-08-22-200326.xml.edited|sort|uniq -d|less
```

This finds more than just users but it was pretty easy to tell the wheat from the chaff.


author: David Feig
body: I had the same experience. I manually deleted repeat users. These were breaking database unique constraints. I just don't understand how these got into the backup.


author: JustinK
body: Will,

Could you provide the complete stacktrace here so we could get a little more context 'in code' of what the problem is during the upgrade process.

Cheers,

Justin