youngmon/atlassian-qna huggingface dataset:
Does the slack integration force everyone to see "Manage your connections" link underneath post?
Asked by Sierra:

Everyone will not need/won't have the ability to manage the componenets for our statuspage, wondering if people will see this.

![Screenshot.png](/t5/image/serverpage/image-id/282411iDF4334EDC416B1DA/image-dimensions/540x152?v=v2 "Screenshot.png")


Answers:
author: Mubeen Mohammed
body: Hello [@Sierra](/t5/user/viewprofilepage/user-id/4507420)

Thank you for contacting the Atlassian Community. This is Mubeen.

Yes, everyone with access to the Slack channel will see the message you shared in the screenshot as this is a component update notification.

However, you will be able to manage the component communications by editing the configuration in your Statuspage's Slack app. Please follow [the documentation](https://support.atlassian.com/statuspage/docs/set-up-a-slack-integration/) to further understand how this can be configured under the "**Manage component updates"**section of the page.

![Screenshot 2023-09-25 at 7.13.56 PM.png](https://community.atlassian.com/t5/image/serverpage/image-id/282716iD2D65C46D8D9BD62/image-size/large?v=v2&px=999 "Screenshot 2023-09-25 at 7.13.56 PM.png")

I hope the information provided is helpful.

Regards  
Mohammed Mubeen

Cloud Support Engineer


Tags: cloud
I'm the admin for statuspage. How do I remove myself and grant another?
Asked by Paul R:

I am the owner of the Atlassian account for my team and I setup Statuspage. I now need two other people to admin that product. How do I remove myself and grant admin rights to another person on my team? When I go into the Atlassian users admin, I cannot toggle off the Statuspage option.

Another post suggested to "spin up Statuspage product on a separate site, where you can assign 'site admin' role only to relevant users." I'm not clear how to do this with an existing product. I'm hoping Atlassian has fixed this issue by now.


Answers:
author: Egor
body: Hey Paul,  
Thanks for reaching out to Atlassian Community!   

Could you please go to admin.atlassian.com \>\> select your site \>\> three dots next to Statuspage \>\> manage product access \>\> select the administration access tab \>\> search for statuspage-admins group and make sure to add the needed users to this group.   

In case you want to grant a user with site admin rights, please follow the steps from here - <https://support.atlassian.com/user-management/docs/give-users-admin-permissions/>

I hope this helps.

Best Regards,  
Egor


Tags: cloud
Crowd Not Starting - Error
Asked by Courtney Dorsey:

Hi,

Our team has had a dev server set up for Crowd 3.7.0 for a few months now, and have had minimal issues with use. I went to update our database password today, and was unable to run the start_crowd.sh and stop_crowd.sh commands, and the web interface will not load. Last week our company did server patches, which in the past would affect the Java home path for Atlassian tools, but we have since written a script which made it so we don't have to change it. We did run into issues on the production side last week after the patches, but this error doesn't look to be the same as on them.

I went into the /opt/atlassian/crowd-3,7,0/apache-tomcat/logs directory and ran the tail command for catalina.out and received the attached output.

Any thoughts on what this means, or what went wrong?

Thanks!

Courtney

![tail catalina.out.PNG](https://community.atlassian.com/t5/image/serverpage/image-id/115935iC7C130E7A2F5C6F7/image-size/large?v=v2&px=999 "tail catalina.out.PNG")


Answers:
author: Nic Brough -Adaptavist-
body: The last few lines are a problem, they're saying that Java is not where Crowd has been told it is.

Either your script has done the wrong thing, the company patches affected the path, or they removed the Java your crowd is set up to use.


Tags: catalina

java

server
StartTLS with Crowd
Asked by MEDITECH ADMIN TEAM:

I'm looking for basic instructions to use StartTLS with Crowd directory and an active directory server currently using ldap. I've enabled StartTLS in the admin area and even though I am able to sync and pull users I get a ton of tls errors in the logs and some users are not getting authenticated. All is good if I don't use TLS. Do I need to install a cert on the Crowd server for it to use StartTLS? We don't want to control users in AD from Crowd, just a one way pull.

If we run this command from the Crowd Linux Console:  
sudo openssl s_client -connect ADserver.com:636

We do get a valid certificate from the AD server.

Here are some documents I've found but I'm not exactly sure what is needed in our case.

<https://confluence.atlassian.com/crowd/troubleshooting-ssl-certificates-and-crowd-164495772.html>

<https://confluence.atlassian.com/crowd/configuring-an-ssl-certificate-for-microsoft-active-directory-63504388.html>


Answers:
author: MEDITECH ADMIN TEAM
body: Just an update, I was able to add our wildcard cert which has allowed ldaps to work.

If I run java SSLPoke adserver.com 3269 it works connects. but if I change it to port 389 for tls it doesn't work:

java.net.SocketException: Connection reset  
at java.net.SocketInputStream.read(SocketInputStream.java:209)  
at java.net.SocketInputStream.read(SocketInputStream.java:141)  
at sun.security.ssl.InputRecord.readFully(InputRecord.java:465)  
at sun.security.ssl.InputRecord.read(InputRecord.java:503)  
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:973)  
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)  
at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:747)  
at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:123)  
at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:138)  
at SSLPoke.main(SSLPoke.java:23)


Tags: server
Tomcat connector for SSL on Windows with Crowd 4.1.x
Asked by Neal Culiner:

I'm running Windows Server 2012 R2 and using Crowd 4.0 and have had no problems to date until trying to upgrade to 4.1.x. Something has changed with Tomcat or Crowd that I cannot get the site to work with any 4.1.x version having tried 4.1.2 yesterday. I'm using SSL.

Can anyone provide information on how to setup a SSL connector for Crowd/Tomcat that will work in the newer 4.1.x version please?

Thank you.


Answers:
author: Gonchik Tsymzhitov
body: Hi!

You can do via next link

<https://confluence.atlassian.com/crowd/configuring-crowd-to-work-with-ssl-151520306.html>

Sorry for the delay


Tags: connector

ssl

tomcat
How do you disable the rest api response limit of users?
Asked by Jonas Walther:

In our case we have about 12000 users in crowd.

And we need to get all users in our response.

The limit we get are 1000 users.

Is it possible and if yes how can we disable the limit of the response.

Thank you very much.

LG Jonas


Answers:
author: Danyal Iqbal
body: no you cant disable the limit. it is there for a reason. You need to read up on pagination. ... \&startat=x
Crowd as an LDAP Server
Asked by Krzysztof Kiser:

Hi,  
I've been wondering, is there any relatively easy way to use Crowd as an LDAP server?  

I am currently considering using Crowd, but in addition to Atlassian Apps, I'd like to be able to use it to authenticate other services that support LDAP (e.g. Synology DS).  

Is there any way to implement such solution?


Answers:
author: Nic Brough -Adaptavist-
body: Crowd is not an LDAP server, it does not have any functionality that would make it look like one.


author: Charly
body: Is there any work-around based on that question?

For example crowd to be in constant sync with an LDAP server. Im not a dev but most likely they will use the same data ( user details) or whatsoever.

Im in the same boat as the original poster. To me it makes sense to have a single user directory in your infra. Having multiple can complicate the user's experience and also maintenance process. So it will be Crowd or if it does not fulfill the requirements it will be something else.

Im impressed with the UI of Crowd and how easily it can be managed but the luck of intergating it to other services makes me look for alternatives.

Just my 2 cents as a customer.

comments: author: Nic Brough -Adaptavist-
body: I'm not sure what you are trying to work-around here, but maybe a bit more about Crowd might help frame that for me.

Crowd provides a user directory for other applications. Off-the-shelf, that really means mostly Atlassian stuff, but it is possible to use it for others.

You can use Crowd on its own for this, but a lot of us actually use it in front of other directories. One of its main functions is to take its data from other directories to make it easier to manage for the Atlassian applications, and another function is that it can act as a management system for other directories.

The last time I worked on a serious Crowd installation, the client had something like:

* LDAP 1 (active directory)
* Internal directory
* LDAP 2 (openldap)

There were legal reasons for having 2 separate directories, and the internal directory was needed mostly for temporary (contractor/consultant) accounts for non-employees as they couldn't be added to the LDAPs. It was actually a lot more complex than that.

Crowd made user management far easier - the Atlassian applications had a single source of users (you didn't have to add eleventy twelve directories to each of them and non-employee accounts to all three separately), and the Crowd UI enabled the user-admins to maintain all the directories in one place.

So, the question is for me, what are you trying to "work around"?


Tags: ldap
Crowd SSO Domain Setting
Asked by ?? ?:

Hi

Crowd and Jira created a domain for SSO. Jira created jira.sec.test.net and Crowd created crowd.exm.sec.test.net. I have a question here. If I register a domain in Crowd, register sec.test.net I wonder if I can do SSO.


Answers:
author: ?? ?
body: First thanks for the answer.  
Currently, the domain setting in Crowd is set to .sec.test.net, and the SSO function is well utilized.  
You need to check if it is an option of crowd-exm.sec.test.net.  
You said you thought the SSO domain would not work. So, is there any problem in the future?  
Thank you.


author: Craig Castle-Mead
body: Hi,

I'm not 100% certain, however I do not believe this will work as for jira.sec.test.net you'd need to set the SSO domain to sec.test.net and for crowd.exm.sec.test.net you'd want to set it to exm.sec.test.net - I do not think that exm.sec.test.net would work under the sec.test.net SSO domain as you're shifting down 2 sub-domains.

Would crowd-exm.sec.test.net be an option?

CCM
Crowd CSV import Linux - where to put the files
Asked by Tom Lister:

Hi

We want to import user and groups via CSV into a crowd directory

Centos on AWS

The docs only give a windows location/

File-Location:

The CSV files must be on the local drive (e.g. C:) of the Crowd server.

What is the Linux equivalent of C:

/opt/crowd-home ?


Answers:
author: Ivan Lima
body: Hey [@Tom Lister](/t5/user/viewprofilepage/user-id/2065062), to my knowledge, there is only one filesystem in Linux, which starts at the empty path **/** . You can also mount other drives, for example, **/mnt/driver** . For the CSV import, as long as you map it to the correct path with the proper permissions, it should be fine. Looking at the section **Install Crowd** at [Installing Crowd and CrowdID](https://confluence.atlassian.com/crowd/installing-crowd-and-crowdid-191862.html), you will find the reference to both Windows and Linux as their installation directories.

Have you tried placing your file under /opt/crowd-home and it did not work? Did you get any error?

Cheers,  
IL.

comments: author: Ivan Lima
body: Btw, I noticed you tagged as DC deployment, so it's worthy to double-check if you're in the right node.


author: Tom Lister
body: Hi [@Ivan Lima](/t5/user/viewprofilepage/user-id/1351762)

We found the location that worked was the /home (root) of the user running crowd.

Not any of the crowd directories

I.e. the equivalent of c:/ on windows

Not obvious and not great IMHO - I'd prefer an option to import file from my machine as admin. We needed a server engineer to get involved in a simple task.


author: Ivan Lima
body: Yeah, that info would be a great addition to the docs. Anyways, I'm glad you worked that out. ?

Cheers.


Tags: data-center
Adding a user with CAC credentials using the REST API
Asked by robert_egan_305:

All of the examples I've been able find on the internet involve Crowd user accounts with a PASSWORD. I want to add users with CAC Credentials.


Answers:
author: Craig Castle-Mead
body: Hi,

I believe that your only option is a password. Can you confirm what you mean by CAC credentials though?

CCM

comments: author: Lonnie
body: Common Access Card, the DoD's PIV card variant. A badge card which stores X.509 SSL certificates and some profile properties. PIV cards, including CACs, are supported by the leading Operating Systems and Web Browsers. When a server and a client enter into an SSL handshake such that the client as well as the server must provide SSL certificates, the browser or a card-capable application will ask the user to insert the CAC (or the PIV), to enter a PIN, and to choose one of several X.509 certs to send into the SSL handshake protocol. The server can use the client's cert to retrieve profile fields that can be handed to an Identity Provider (such as MS AD, Ping Federate, etc) to retrieve any known identity for that client cert. With the SSL session established, the server knows that the client has the right pass phrase (their PIN) and the secondary factor (the card with the crypto certs) and the IdP verifies that the cert indicates a particular user - so the app-server can grant authentication to the incoming request.  

To support CAC access over the API calls, it is the Jira server that needs to come to demand Mutual TLS for incoming API requests and to pair with an IdP to look up users from the arriving certs (versus looking for either Basic Auth or Bearer Auth HTTP Headers)  

It's not something that a client of the API can implement on its own.


author: robert_egan_305
body: You are correct, the only option is a password. However, since I have posted this, I learned that my organization already has a process in place to handle it. Users are created with a psuedo random password, and then the CAC credentials are added via SQL as a second step.

Company policy prevents me from posting the exact code here, but I think I can safely say that we add a new entry in cwd_user_attribute with attribute_name = 'commonName' and attribute_lower_value = CAC credentials.
Vulnerability in CSRF test
Asked by carlos_gabriel_millaqueo_picunche:

Hi,

It has been identified that the forms do not have mechanisms to  
prevent CSRF attacks, because of this, a malicious user can force the browser to  
a victim user to generate and send requests that the application interprets as legitimate  
from the victim. A successful CSRF attack can compromise the data of a  
end user and through this enter "valid" requests that modify the  
behavior of the application in favor of the attacker

We have a lastest versi?n of crowd 4.1.0 dockerized with mysql database

Thank you.

Regards


Answers:
author: Nic Brough -Adaptavist-
body: Right. So have you reported this? Is it possibly fixed in a later version?

comments: author: carlos_gabriel_millaqueo_picunche
body: It has not been fixed in the latest version, we have reported it


author: Donn Gordon
body: yes, and also in the RelayState parameter, they are lacking the business logic of the anti-CSRF.
Error when loading the "Audit log" and "Users"
Asked by tracekey operations:

After Upgrading crowd from Version 4.0.0 to the new Version 4.1.1, error when loading the "Audit log" and "Users" in Browser and Support Zips can't be created with same error also.  
Before Upgrading to 4.1.1 it was working.

2020-08-31 14:19:36,031 http-nio-8095-exec-30 WARN \[common.security.jersey.XsrfResourceFilter\] Additional XSRF checks failed for request: <http://domain.com/rest/admin/latest/users/search> , origin: <https://domain.com> , referrer: <https://domain.com/console/secure/user/browse.action> , credentials in request: true , allowed via CORS: false  
2020-08-31 14:19:50,922 http-nio-8095-exec-22 WARN \[common.security.jersey.XsrfResourceFilter\] Additional XSRF checks failed for request: <http://domain.com/rest/admin/1.0/auditlog/query> , origin: <https://domain.com> , referrer: <https://domain.com/console/secure/auditlog/browse.action> , credentials in request: true , allowed via CORS: false  
2020-09-01 07:21:48,097 http-nio-8095-exec-22 WARN \[common.security.jersey.XsrfResourceFilter\] Additional XSRF checks failed for request: <http://domain.com/rest/analytics/1.0/publish/bulk> , origin: <https://domain.com> , referrer: <https://domain.com/plugins/servlet/troubleshooting/view/> , credentials in request: true , allowed via CORS: false  
2020-09-01 07:21:59,735 http-nio-8095-exec-30 WARN \[common.security.jersey.XsrfResourceFilter\] Additional XSRF checks failed for request: <http://domain.com/rest/troubleshooting/latest/support-zip/local> , origin: <https://domain.com> , referrer: <https://domain.com/plugins/servlet/troubleshooting/view/> , credentials in request: true , allowed via CORS: false

We have already checked the proposed solution, but we do not have a proxy in use: <https://confluence.atlassian.com/crowdkb/error-when-loading-the-audit-log-in-crowd-961801639.html>

Thanks in advance!

Regards,

Olaf


Answers:
author: tracekey operations
body: Problem solved:

I've add the following scheme into server.xml:

    scheme="https"

Now it works


Tags: server
Crowd Directory in Jira, user key different from username
Asked by Hans Pesata:

HI!  

Crowd 3.7.0 (Build:#1270 - 2019-10-03)  
Jira Server 8.5.2#805002-sha1:a66f935  

We are using a LDAP Directory and a Crowd Directory in Jira.  

The users from the LDAP Directory have the same values for "username" and "key", while the users form the Crowd Directory have different values:  

username: myusername  
key: JIRAUSERS2988  

How can we mange to have the "key" with the same value as "username" with the Crowd Directory ?  

Thanks in advance!  

Regards,  
Hans


Answers:
author: Craig Castle-Mead
body: Hi Hans,

You can't control the user key format in JIRA. Under the guise of GDPR, the userkey changed from being the username of a user when they first synced/existed in JIRA to the JIRAUSER#### format.

CCM

comments: author: Craig Castle-Mead
body: This is a Jira issue, not Crowd by the way


Tags: jira-server

user-management
Sharing of Crowd application between multiple services?
Asked by swestmeier:

Hi,

I have setup an application in Crowd to connect my Jenkins master 1. Works great.

Now I have setup another Jenkins master 2 and also want to connect it to Crowd. Can I reuse / share the same application here?

I have tested and it seems to work. Probably because I did not enable the SSO part in the application.

Is this an anti-pattern even though it works?

And pros and cons for doing so?


Answers:
author: Nic Brough -Adaptavist-
body: No, your two Jenkins are differenct services. You'll be able to re-use, as in copy, almost all the config and have them behave the same (in Crowd terms), but you can't have one application pointing to many applications

comments: author: swestmeier
body: I was assuming, because the two Jenkins are different services, that it would not work. **But actually using the same application (not a copy of it) works.**

Probably it works in my special case, because the application is actually not pointing to the services. The only part where they would point to the service, is the SSO ACS URL and Entity ID. But as I don't use it, there is no pointer.

Where would it break in my use case?


author: swestmeier
body: Actually I use the same service (not a copy of it) for both Jenkins instances. **And it works!**

I think it works, because the only pointer is in the SSO ACS URL and Entity ID. But I have this SSO tab disabled.

Still where would / will it break?


Tags: server
When upgrading Crowd to new version, do you need to take Database backup?
Asked by Application Services:

The Upgrade instructions <https://confluence.atlassian.com/crowd/upgrading-crowd-via-automatic-database-upgrade-213519474.html> have step to take up the database backup, however we are not touching the database, so why is this needed?

I have used these steps in my non-production environment to upgrade Crowd version, and it worked.

1. Stop Crowd service.  
2. Backup Crowd home directory.  
3. Rename Crowd installation directory.  
4. Remove Crowd Service.  
5. Unzip Crowd installation file to D:\\Atlassian\\Crowd.  
6. Copy crowd-init.properties file from backed up Crowd installation directory to new.  
7. Install and start Crowd service.


Answers:
author: Craig Castle-Mead
body: Hi,

The application upgrade may well change database schema/values as part of the startup process. If this happens, and then you need to roll back, you'll want to have the database backup to revert to. Even if there's no changes during the upgrade, things can go wrong and you may end up with corrupt data.

I've been running Crowd since 2.3 or so, and have been through many upgrades. While I've never had to revert the database cause of a failed user upgrade, ensuring there's a backup to restore from is always still part of the process.

CCM
How to encrypt database password for Crowd
Asked by Harry Tarnoff:

While we've been able to [encrypt the database password for Jira](https://confluence.atlassian.com/jiracore/advanced-encryption-975040999.html), it seems that those instructions do not work for Crowd. Does anyone know how to encypt (obfuscate, really) the password in the**var/crowd_home/shared/crowd.cfg.xml** file?


Answers:
author: Lei Wang
body: It is not possible to encrypt the database password listed in \<Crowd-Home\>/crowd.cfg.xml file.

Please vote on this enhancement request:

<https://jira.atlassian.com/browse/CWD-4071>


Tags: password
Security vulnerability in javascript_tabs.jsp
Asked by ?? ?:

HI

During a security check to introduce Crowd to the company, "**var totalTabs of javascript_tabs.jsp ='\<%= request.getParameter("totalTabs") %\>';**" A security vulnerability was pointed out in the phrase. I will ask you what role this part does and if it can be changed.

What emerged as a security vulnerability was cross-site scripting.

Thank you


Answers:
author: Nic Brough -Adaptavist-
body: That is trying to get a list of tabs. It does not appear to have any security problems.

comments: author: ?? ?
body: thank you
Is Crowd 4.1.0 supported for Microsoft SQL 2012?
Asked by Application Services:

My Crowd database is running on MS SQL 2012. I want to upgrade Crowd application to 4.1. Will this work?


Answers:
author: Daniel Eads
body: Hey there!

Unfortunately Crowd 4.1 no longer supports MS SQL 2012 - the [supported platforms documentation](https://confluence.atlassian.com/crowd/supported-platforms-191851.html) for Crowd shows that you'll need to upgrade to SQL Server 2016 or 2017.

The last version of Crowd to support SQL Server 2012 (and also SQL Server 2014) was Crowd 4.0.

Cheers,  
Daniel

comments: author: Application Services
body: There is a step in the upgrade: run start_crowd.bat. Is this needed if I am upgrading (from 2.11 to 4.0)? Would it be enough to simply start the Crowd service? (or as I did, remove the previous 00.Crowd service and then install it with 'service.bat install 00.Crowd'command and start it.


author: Daniel Eads
body: That should be sufficient - the start_crowd.bat file is there to start the application if you haven't installed it as a service. Since you've installed the service, you should be all set to manage it normally like any other Windows service.


author: Application Services
body: This information would be useful mentioning on the Upgrade Site!