youngmon/atlassian-qna huggingface dataset:
I am unable to access the Crowd 4.0.5 web application after installing Crowd.
Asked by John Oliver:

After installing Crowd Server 4.0.5 on Windows Server 2019, I am unable to navigate to the setup screen and am getting the error:

Type Status Report

Message /crowd/console

Description The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.

I have gotten Crowd to work on Crowd 2.8.3 on this same server and I have the jdk and jre for Java 8 installed, but for some reason, I'm having trouble with Crowd 4.0.5.


Answers:
author: Ruslan Tkachuk
body: Hi [@John Oliver](/t5/user/viewprofilepage/user-id/4800578)   

If look into the Crowd 4.0.5 archive you can find, that it contains a web server (apache-tomcat folder), but Crowd 2.8.3 has the option to be downloaded with a web server (2.8.3 - Standalone) and without (2.8.3 - Crowd Server) see attachment.

As you mentioned, on your Windows Server 2019 was deployed Crowd 2.8.3, so I can suppose that it was "2.8.3 - Crowd Server" and additionally installed Apache Tomcat (with the specified environment variable CATALINA_HOME). And when you run Crowd 4.0.5 through the command "start_crowd.bat" in fact you run a web server that is installed separately.

Solution: delete environment variable CATALINA_HOME and try to run Crowd 4.0.5 through the command "start_crowd.bat"

<br />

![Screenshot 2022-05-19 at 19.13.57.png](https://community.atlassian.com/t5/image/serverpage/image-id/198197i0F6E46C3CBABAE69/image-size/large?v=v2&px=999 "Screenshot 2022-05-19 at 19.13.57.png")
Unable to login few existing users on non prod applications as crowd, jira, confluence
Asked by Peruma Chinnasamy:

Unable to login few existing users in non prod applications are crowd, jira, confluence, bitbucket \& bamboo even though the user name and password are correct.

Error message detail:-

Error message in application: " Incorrect user name and password"

Log details:-

1 ." Caused by: com.atlassian.crowd.exception.InvalidAuthenticationException: Account with name \<user_name\> failed to authenticate:  
\[LDAP: error code 49 - 80090308: LdapErr: DSID-0C090447, comment: AcceptSecurityContext error, data 52e, v3839\\u0000\];  
nested exception is javax.naming.AuthenticationException: \[LDAP: error code 49 - 80090308: LdapErr: DSID-0C090447,  
comment: AcceptSecurityContext error, data 52e, v3839\\u0000\]

2. "2022-05-02 15:28:59,453 http-nio-8081-exec-66 INFO \[crowd.manager.application.ApplicationServiceGeneric\] Invalid credentials for user user_name in directory directory_name, aborting"

Kindly help me to fix this issue.


Answers:
author: Roman Kovalov
body: Hi [@Peruma Chinnasamy](/t5/user/viewprofilepage/user-id/4879891)

I can confirm that I have same error, when I try to login with wrong credentials.

You said that you cannot login by few users, by others you can?

Also if you are using **connector** or **delegated** type of directory, passwords for this users are stored directly in directory (for example in LDAP), where crowd is trying to find user credentials for each authentication. More about this you can find in [this](https://confluence.atlassian.com/crowd/configuring-a-delegated-authentication-directory-128287004.html) spec.

And one more suggestion from me, maybe this users have different type of hashing password in directory SHA-256/SHA-512/Plaintext, etc

comments: author: Peruma Chinnasamy
body: Hi Roman,

We are using delegated types of directories.


author: Roman Kovalov
body: Sorry, but like I say before, Crowd doesn't store user credentials for **delegated** type of directory. This means that the directory delegates user authentication to LDAP.  
You can try to use [internal](https://confluence.atlassian.com/crowd/configuring-an-internal-directory-18579551.html) type of directory, which will store user, group and role information in Crowd database .

Also you can check that usernames are the same in the Crowd Delegated Authentication directory and in the LDAP directory.


author: KAGITHALA BABU ANVESH
body: Hello [@Peruma Chinnasamy](/t5/user/viewprofilepage/user-id/4879891) ,  

If you using any external user directory configured, Please check the Directory sync is happening or not.  

and also check the users are available in Jira or not in user management.  

<br />

<br />

comments: author: Peruma Chinnasamy
body: Thank you [KAGITHALA BABU ANVESH](https://community.atlassian.com/t5/user/viewprofilepage/user-id/4194998) I will check that
Couldn't find the Centralized license visibility plugin on Crowd 4.4.0 Data Sever
Asked by L:

Couldn't find the Centralized license visibility plugin on Crowd 4.4.0 Data Sever

I can see the add-on must be installed on Crowd 3.4 but I was curious if I can install it on Crowd 4.4.0 data sever


Answers:
author: Ruslan Tkachuk
body: Hi [@L](/t5/user/viewprofilepage/user-id/4871961)   

This functionality is available for **Data Center.** You can read more here: <https://confluence.atlassian.com/crowd/monitoring-license-usage-973480265.html>  

I tested the integration Crowd v4.4.1 Data Center (**not Server** ) with Bitbucket v7.21.0 and all works pretty fine.  

![CrowdLicenseSolution.png](https://community.atlassian.com/t5/image/serverpage/image-id/195271i54A111282F1DF748/image-size/large?v=v2&px=999 "CrowdLicenseSolution.png")
Issue with crowd SSL certificate
Asked by Nayan Gupta:

My URL says that cert is expired :  
Certificate Name: crowd.abc.net  
IP: XXXX  
Category: any  
Issuer: crowd.abc.net  
Status: expired  
Reason: expired certificate  
User:XXXX

But certificate is not expired on the server

Alias name: tomcat  
Creation date: Feb 24, 2022  

**Valid from: Thu Feb 24 11:42:10 UTC 2022 until: Wed May 25 11:42:10 UTC 2022**   
**Certificate fingerprints:**   

Not sure what to check here


Answers:
author: Ruslan Tkachuk
body: Hi [@Nayan Gupta](/t5/user/viewprofilepage/user-id/4877675)   
If talking about the SSL certificate, then Crowd doesn't directly integrate with it. Only Apache Tomcat holds all required configurations for support SSL.

I checked the proposed configuration (official Atlassian Crowd documentation) with the Self-Signed certificate and with a certificate issued by CA (<https://letsencrypt.org>). In both cases, everything works as it should, but the Connector configuration for a certificate issued by Let's Encrypt is a little bit changed (see below).

So, if you are sure that it is all configured correctly, then I recommend trying to find the root cause of the problem on the client-side and maybe some recommendations provided in this article help you <https://geeksadvice.com/fix-net-err-cert-date-invalid-error>

![11.png](https://community.atlassian.com/t5/image/serverpage/image-id/197633i9150410EA777D4C9/image-size/large?v=v2&px=999 "11.png")![11+.png](https://community.atlassian.com/t5/image/serverpage/image-id/197634iEB83D0339520E858/image-size/large?v=v2&px=999 "11+.png")![11+++.png](https://community.atlassian.com/t5/image/serverpage/image-id/197635iADF0565A76C57F8A/image-size/large?v=v2&px=999 "11+++.png")
Can CROWD continue with Server license while Jira upgraded to DC license?
Asked by Murthy A M:

Hello Team,

I would like to know if CROWD can continue to be in server license(we have unlimited user license and valid for next 2 years) and upgrade only Jira from server to DC license?

Regards,  
Murthy


Answers:
author: Fabio Racobaldo _Herzum_
body: Hi [@Murthy A M](/t5/user/viewprofilepage/user-id/4466639) ,

yes, you can! There's not dependency through different tools about server and dc. I do that in some contexts and it works!

Hope this helps,

Fabio


Tags: compatibility

data-center

upgrade
Manually trigger user sync through Crowd command line
Asked by Rachit Garg:

Hello

Can you let me know if there is a way to trigger a manual user sync through the command line?

We have disabled some users as our limit was reached from the backend but still, we are unable to login into the console as it says our user limit is reached so a manual sync is needed.


Answers:
author: Craig Castle-Mead
body: Hi Rachit,

Outside of using a REST API call from the CLI (which cause the same issue as running from the UI).

Check out <https://confluence.atlassian.com/crowdkb/how-to-log-into-crowd-when-the-number-of-users-for-the-license-has-been-exceeded-644416441.html> - though if you're using Crowd Server, you likely won't be able to generate a Server license now Server has been sunset. Applying a DC trial license if you're running server may cause issues as <https://confluence.atlassian.com/crowd/migrate-from-server-to-data-center-935372358.html> specifies you need to setup a shared home when moving from Server to DC.

Hopefully you're on DC already, so a DC trial should be straight forward, but if you're Server, I'd suggest doing a non-production environment test first.

BTW - Is your directory not setup on an automated sync schedule? Any sync should have automatically run by now.

CCM
atlassian.crowd.licensing.ApplicationLicensingServiceImpl
Asked by Edward England:

I am receiving an error in my logs and it is occurring ever 60 minutes which is the time set to refresh the connector. Here is a copy of the error from the log:

Caesium-2-3 ERROR \[atlassian.crowd.licensing.ApplicationLicensingServiceImpl\] Failed while fetching data for the application: confluence-crowd-connector

Any suggestions as to what is happening would be appreciated. I have done as much searching as I can online but I have not been able to find any suggestions. Which usually means that it is something easy.


Answers:
author: Roman Kovalov
body: Hey Edward,

I tried to reproduce this behavior by myself. And looks like everything works pretty fine, from my side (screens below).

Can you add additional details about your issue please? What type of connector do you use? Does it synchronize some users from directory and crashes on specific one?

![Screenshot 2022-05-06 at 15.13.08.png](https://community.atlassian.com/t5/image/serverpage/image-id/196178i4F0E83EB749DCFC6/image-size/large?v=v2&px=999 "Screenshot 2022-05-06 at 15.13.08.png")![Screenshot 2022-05-06 at 15.19.01.png](https://community.atlassian.com/t5/image/serverpage/image-id/196180iE91912BD874048AA/image-size/large?v=v2&px=999 "Screenshot 2022-05-06 at 15.19.01.png")


author: Craig Castle-Mead
body: Hey Edward,

Do you have an active license for Crowd?

Is there anything in Crowd that is functioning - eg: non-Confluence related syncs and/or can you login to the Crowd UI?

CCM
Best way to change from LDAP & AD identity services to just AD
Asked by Aaron Andrade:

Currently we maintain two separate identity services, a legacy OpenLDAP service and Active Directory. Crowd is currently using the legacy OpenLDAP service (configured as a "Delegated authentication directory" in Crowd). We are decommissioning the OpenLDAP service and need to convert Crowd to use AD for authentication, while retaining all of the users/profiles currently configured. All user data (usernames/passwords/etc.) are synchronized between LDAP \& AD, so all user details will remain the same. What would the least-disruptive process be to complete that migration?


Answers:
author: Craig Castle-Mead
body: Hey [@Aaron Andrade](/t5/user/viewprofilepage/user-id/741643)

This should generally be pretty straight forward - we've done numerous switches between various directories with the same users. As always with a significant change though, it's always best to try in a non-production environment

1. Ensure your username fields are the same in OpenLDAP and Active Directory
2. I don't believe local groups are supported in Crowd for a delegated directory - but if for some reason you are using Local Groups on a directory you're getting rid of, there are extra steps involved (run an SQL query to get any user,group membership values from the cwd_membership table, then use this as the input for a CSV import file - as you're not importing any users, but a users file is mandatory, just create a dummy file with the first line of "u,e,f,l,p" and map these to User, Email, First name, Last name, Password on the import)
3. Setup a new "Microsoft Active Directory" connector with the appropriate filters, run a sync (assuming you're using a cached directory), or do a user search if you're not caching
4. Import groups from #2 if necessary. Spot check to validate the data looks similar to what you expect
5. To each Crowd Application, add the new AD connector directory ABOVE your delegated authentication directory
6. Go to each application, sync the user directories
7. When a user logs to an application, crowd will attempt to login to the first directory mapped to that application that contains that username
8. eg: say a users email is first.last@domain.com in your delegated directory currently mapped to your Jira Application, and their password is Password1. The user is currently logging in to Jira with first.last@domain.com and Password1. If you then add an AD connector to the Jira application in Crowd and drag it above the Delegated directory - if there's an account first.last@domain.com and Password2 as the password, they would then need to login to Jira with Password2 - you COULD NOT login to Jira using first.last@domain.com with Password1

CCM


Tags: active-directory

identity-manager

ldap
Getting proxy error while users are trying to login into Atlassian applications
Asked by Janaki.R:

Hi Team,

We are using crowd for user authentication and we have configured some directories with in the crowd in that one of the directory synchronization is getting failed sometimes and crowd application is showing proxy error and in the logs we find that connection is getting aborted and the directory skipping the user authentication.


Answers:
author: Nic Brough -Adaptavist-
body: I'm afraid there's not a lot we can help you with here. If there are intermittent proxy errors between your Atlassian applications and the Crowd serving their user directories, you'll need to fix the network or the proxy that's not allowing the connection.


author: Roman Kovalov
body: Hey, [@Janaki.R](/t5/user/viewprofilepage/user-id/3740636)

I can confirm, that if you are using **connector** or **delegated** type of directory and if your directory is offline or have some connection issues, you can't login to your application.

![Screenshot 2022-05-10 at 15.21.01.png](https://community.atlassian.com/t5/image/serverpage/image-id/198308i69E1CAC15246860C/image-size/large?v=v2&px=999 "Screenshot 2022-05-10 at 15.21.01.png")

According to [this](https://confluence.atlassian.com/crowd/configuring-a-delegated-authentication-directory-128287004.html) specification, looks like this logic is works properly. Because crowd doesn't store users credentials for connector/delegated directories, it is stored in your directory where crowd is trying to find user credentials for each authentication.

I can recommend you to fix connection issues to your directory or to use internal type of directory. More information you can find [here](https://confluence.atlassian.com/crowd/managing-directories-193037.html).


author: Roman Kovalov
body: Hey, [Janaki_R](https://community.atlassian.com/t5/user/viewprofilepage/user-id/3740636) !

What type of directory type do you use?

I can confirm, that if your directory is offline, crowd cannot authenticate user from this directory to application, if you are using **connector** or **delegated** type of directory.

![Screenshot 2022-05-10 at 15.21.01.png](https://community.atlassian.com/t5/image/serverpage/image-id/196644i8D677F08BBB8F1C4/image-size/large?v=v2&px=999 "Screenshot 2022-05-10 at 15.21.01.png")

According to [this specification](https://confluence.atlassian.com/crowd/managing-directories-193037.html), looks like this logic is works properly.Because crowd doesn't store user credentials for connector/delegated directories, it is stored in your directory, where crowd is trying to find user credentials.

From my side I can advice you to fix connection with your directory or try to use internal type of directory.

More information you can find here:  
<https://confluence.atlassian.com/crowd/managing-directories-193037.html>  
<https://confluence.atlassian.com/crowd/adding-a-directory-18579549.html>
Anyone else having trouble with having crowd start automatically as a Windows service
Asked by Patrick Smith:

Followed instructions to the tee and still no luck


Answers:
author: Roman Kovalov
body: Hello, [@Patrick Smith](/t5/user/viewprofilepage/user-id/1199220) !

Can you describe your problem more clearly please? What exactly error do you have, when you trying to start *Crowd service* with **net start Crowd**command in cmd?

From my side everything works well (the only thing was to change tomcat from 32-bit to 64-bit) :  
![Screenshot 2022-05-16 at 17.49.46.png](https://community.atlassian.com/t5/image/serverpage/image-id/197507iE140F7A2CB45D4A9/image-size/large?v=v2&px=999 "Screenshot 2022-05-16 at 17.49.46.png")

If you trying to start Crowd as Windows service in 64-bit system, I can advice you this guides, which are helped me a lot:  
<https://confluence.atlassian.com/crowd/installing-crowd-as-a-windows-service-82870454.html>  
<https://confluence.atlassian.com/crowd/installing-crowd-and-crowdid-191862.html>
Crowd Port 8095 open to public(?)
Asked by Matt Donagan:

Does port 8095 REALLY need open to the public?

Or is that port used just to talk between Jira/Confluence/Crowd?

My server has Jira/Confluence/Crowd all on the same server (I know, one server...shame ...not my decision!) so do I really need to open a firewall port to be accessed by anyone outside of that server?

Documentation isn't really clear on that.

Thank you!


Answers:
author: Craig Castle-Mead
body: Hi [@Matt Donagan](/t5/user/viewprofilepage/user-id/4816339)

:8095 is how anything (the apps, or administrators) talk to Crowd. If Jira/Conf/Crowd are all running on the same server, you'd likely have Confluence and Jira setup with localhost:8095/crowd as the Crowd directory hostname - that's fine, your apps can all talk to each other.

What you'd be missing in this scenario is how any of your admins can access the Crowd UI. If this is a Windows box and you've got RDP access, you could go to <http://localhost:8095/crowd/> to administer, and this would function, but may limit how your admins can access Crowd.

CCM
How do you get the json values required by the Crowd group-level-admin REST method?
Asked by thomas.fregin:

Im using a local crowd environment for development and i would like to add a group admin via rest api as described in =\> <https://docs.atlassian.com/atlassian-crowd/4.0.0/REST/#admin/1.0/group-level-admin-addGroupAdministrators>  
So far i couldn't understand the json schema needed to add a group administrator =\>

    {    "id": "https://docs.atlassian.com/jira/REST/schema/list-of-directory-entity-rest#",    "title": "List of Directory Entity Rest",    "type": "array",    "items": {        "title": "Directory Entity Rest",        "type": "object",        "properties": {            "id": {                "title": "Directory Entity Id",                "type": "object"            },            "type": {                "type": "string",                "enum": [                    "USER",                    "GROUP"                ]            }        },        "additionalProperties": false    }}

<br />

As value for the id i used the groupId as mentioned here=\><https://community.atlassian.com/t5/Crowd-questions/How-do-you-get-the-groupId-required-by-the-Crowd-group-level/qaq-p/1127534> which worked for a rest api get on a group but i dont understand the other values in the schema.


Answers:
author: GRENIER REMI
body: Hi

Are you able to use it ?

The entityName, it's the group name (base-64 encoded) right ?

I have the error:
> Can not deserialize instance of java.util.ArrayList out of START_OBJECT token

Then, I have surunded the payload by "\[" and "\]". I get this error:
> Unrecognized field "grantEntities" (Class com.atlassian.crowd.plugin.rest.entity.directory.DirectoryEntityRestDTO), not marked as ignorable  
> at \[Source: org.apache.catalina.connector.CoyoteInputStream@4ac58d90; line: 1, column: 82\] (through reference chain: com.atlassian.crowd.plugin.rest.entity.directory.DirectoryEntityRestDTO\["grantEntities"\])

Thanks


author: Nikita
body: On this endpoint you need to follow next json schema to post data  

```
{
  "grantEntities": [
    {
      "id": "directoryId-entityName",
      "type": "GROUP"
    },
    {
      "id": "directoryId-entityName",
      "type": "USER"
    }
 ]
}
```

curl --location --request POST '{{host}}/crowd/rest/admin/1.0/group-level-admin/{{groupId}}/admins' \\  
--header 'Authorization: Basic Base64 username:password' \\  
--header 'Content-Type: application/json' \\  
--data-raw '{  
"grantEntities": \[  
{  
"id": "{directoryId}-{entityName}",  
"type": "GROUP"  
},  
{  
"id": "{directoryId}-{entityName}",  
"type": "USER"  
}  
\]  
}'


Tags: administration

group
Turn off password expiration reminder
Asked by Zachary Hayes:

Crowd version 4.4.0

I would like to disable users receiving emails when their password is about to expire.

Crowd has a mail template "Password expiration reminder template", but no option to disable the reminders. Would leaving the template empty stop the notifications, and if so is that how Atlassian expects them to be disabled?

If not through UI, is there a way to disable them from the server?

I'm unable to find documentation about this template, so I believe password expiry reminders are a newer feature to Crowd.


Answers:
author: Zachary Hayes
body: Go to Directories, and find the directory you'd like to disable expiration notifications.

If it's a Crowd Internal Directory, you can go to its Configuration menu and find the option for "Notify the user of password expiry in". Leaving this field blank disables notifications.

![Screen Shot 2022-03-07 at 2.16.30 PM.png](https://community.atlassian.com/t5/image/serverpage/image-id/186800iE1C19039BF7B5DBF/image-size/large?v=v2&px=999 "Screen Shot 2022-03-07 at 2.16.30 PM.png")
Using apps like Jenkins, How do you deal with IPs to apps that are not static?
Asked by Mark Hubers:

When you add a custom app to Crowd like Jenkins server. It asks for the app URL and it takes then it lookup the IP of that URL and it adds that IP to the app settings. In a docker/kubernetes world those IPs are not static anymore. How do others deal with apps having no-static IPs?


Answers:
author: Nikita
body: Hello Mark, for this case elastic api should be used and i recommend use AWS

To ensure connectivity to your docker containers, check :

-if security group(s) on the instance allow inbound traffic to the ports of interest.

-same, please check network ACL on your subnet if they do not block the connections - both inbound and outbound.

-ensure that the instance is in a public subnet and is reachable from the internet.

-check if you can connect to the containers from inside of the instance, to make sure that your application is working as expected

Alternatively, if you do not want to manage the instance and docker yourself, you can look into using AWS Fargate or Amazon ECS which will greatly simply management of your containers.


author: Craig Castle-Mead
body: Hey Mark,

The easy and unsecure answer is adding 0.0.0.0/0 to the Crowd Application Remote Addresses - obviously not recommended though!

It's not clear where you're hosting your Docker/K8S, but using AWS terminology, if you run your cluster from a private VPC that has a NAT VPC gateway with a fixed Elastic IP, outbound traffic from any of the containers running within that environment will be seen to the internet as coming from the Elastic IP address - so that's the one you add to the Remote Addresses list.

Lots of factors could impact if/how this would work - so take the above with a grain of salt. YMMV.

CCM