How should I configure Crowd’s SSO domain so apps on different sub-domains authenticate correctly?

Question

I’m setting up Atlassian Crowd for SSO across multiple apps (Jira, Confluence, etc.). What’s the best way to set the Crowd SSO domain so that login works smoothly when apps are on different sub-domains? Any tips on cookie/domain settings would be helpful.

Fabio Racobaldo _Catworkx_ · Answer

Hi @Anna Wilson ,

it is important that all applications must share the same parent domain, because Crowd uses a browser cookie for SSO. Browsers will only send that cookie to hosts within the configured domain.

Please use always HTTPS for all applications.

Hope this helps,

Fabio

Tinker Fadoua · Answer

Welcome to the Atlassian Community  !

Is this still an issue for you?

Tomislav Tobijas · Answer

Hi @Anna Wilson ,

I guess in this particular case, you would configure the SSO domain to the parent domain that is common to all your subdomains. Something like ".example.com"

For the SSO cookie (and if you follow the principle above), it should also be set with the domain attribute as ".example.com"

Some additional tips/insights:

* Always use HTTPS (to ensure cookies are transmitted securely)
* For multi-domain SSO scenarios, you could rely on Crowd SSO 2.0

Pretty much everything (recommendations and such) should be stated within the official docs.

Now, I've only played around with Crowd, and I mainly configured IdP connections on cloud, so it's all more theoretical from my side when it comes to actual best practices from experience from my side 👀

Cheers,
Tobi