Hello,
I try to get Azure AD integration with Crowd 3.0 running with an Azure subscription for Azure GermanyCentral, i.e. using cloud environment "AzureGermanCloud"
When configuring the Azure AD in Crowd, I have to enter the "tenant id", but there is no input for selecting a different cloud environment, which in my case is "GermanAzureCloud".
As a result, when I try to synchronize from Crowd I got the following error in server log:
2017-10-23 09:05:34,252 Caesium-2-3 INFO [atlassian.crowd.directory.DbCachingRemoteDirectory] failed synchronisation complete for directory [ 98306 ] in [ 1024ms ]
2017-10-23 09:05:34,283 Caesium-2-3 ERROR [atlassian.crowd.directory.DbCachingDirectoryPoller] Error occurred while refreshing the cache for directory [ 98306 ].
com.atlassian.crowd.exception.OperationFailedException: java.util.concurrent.ExecutionException: com.google.common.util.concurrent.UncheckedExecutionException: com.atlassian.crowd.exception.Op
erationFailedException: java.util.concurrent.ExecutionException: com.microsoft.aad.adal4j.AuthenticationException: {"error_description":"AADSTS90038: Confidential Client is not supported in Cr
oss Cloud request.Trace ID: 7108517d-5bd7-494b-9fd4-1536b8a86300Correlation ID: cb8a8e3d-93f8-47db-90aa-720e3455faddTimestamp: 2017-10-23 09:05:34Z","error":"invalid_request"}
Those "AADSTS90038: Confidential Client is not supported in Cross Cloud request." is the typical error message because the Crowd client is using the default URLs of "AzureCloud" for accessing GraphAPI, but I need to use the GermanAzureCloud-specific settings to get access to Azure AD working.
Is it possible to configure Crowd to use "cloud_environment=AzureGermanCloud"?
Thanks in advance,
Rainer
To see Urls - e.g. GraphUrl - using PowerShell:
> Get-AzureEnvironment
...
Name : AzureGermanCloud
EnableAdfsAuthentication : False
ActiveDirectoryServiceEndpointResourceId : https://management.core.cloudapi.de/
AdTenant : Common
GalleryUrl : https://gallery.azure.com/
ManagementPortalUrl : http://portal.microsoftazure.de/
ServiceManagementUrl : https://management.core.cloudapi.de/
PublishSettingsFileUrl : https://manage.microsoftazure.de/publishsettings/index
ResourceManagerUrl : https://management.microsoftazure.de/
SqlDatabaseDnsSuffix : .database.cloudapi.de
StorageEndpointSuffix : core.cloudapi.de
ActiveDirectoryAuthority : https://login.microsoftonline.de/
GraphUrl : https://graph.cloudapi.de/
TrafficManagerDnsSuffix : azuretrafficmanager.de
AzureKeyVaultDnsSuffix : vault.microsoftazure.de
AzureKeyVaultServiceEndpointResourceId : https://vault.microsoftazure.de
...
