Crowd: Importing users and groups

Question

Crowd V3.1.3

Here I am again with yet another question concerning our initial configuration. There is an import function in the "Users" tab but none in "Groups". The "import" in "Users" does import users and groups from remote directories, but not the memberships - as I would have expected.

I had planned to configure one directory per application with all non-LDAP users from this application. I would manage all users in the active directory connected to Crowd by memberships in:

* server specific groups (serverX-user, serverY-user, ...) to control the access to this server
* role specific groups (serverX-reviewer, serverY-author, serverZ-admin...) to control the permissions for a specific user on this server

The server admins would not be allowed to allocate group memberships (no write permission in the Crowd directories).

Does this look like a reasonable plan to you?

In this scenario it would be nice to be able to import groups alone into the LDAP connector, without importing the users. It would further be nice to have a renaming function for groups - but I have already seen that this is a feature that will not be implemented by Atlassian in the near future.

Craig Castle-Mead_20fp9z · Answer

Hi Jean,

The user import UI can actually import groups (and memberships), but you need to trick it a bit (we've done this MANY times).

* Create a users file (even if you don't want to create users) and give it one line with just the following content* ,,,,,

* Create a groups file with a line for each user (username as it exists in the existing Crowd directory) and the group they should be a member of
* Place each of these files on the filesystem of the Crowd server
* Login to the Crowd console, go to Users > Import Users
* Select CSV Importer* Select your directory
* Leave delimiter as ,
* Enter the path of the users file
* Enter the path of the user + group file

* On the next page, you'll need to map the users file to the all the fields (first name, last name, email, username, password) cause your users file is just empty values separated by commas, just map any of the lines to any of the fields (just to bypass error checking - it won't actually create any users as there's no values)
* On the next screen, map your user and group to the right fields
* Hit next / import (don't have the exact button names for reference, but it's pretty obvious what you need to do to keep moving along the process)
* As mentioned above, as there's no real values in the users file, it won't try and create any users
* The values from the groups file are read in, and if the group you specify the user should be a member of doesn't exist, it will first try and create the group and then add the user to the group

If you just want to bulk create groups (but not memberships), you can follow the above process but select one user who you assign to every group you want created, once the groups have been made, search for the user and remove from all the newly created groups.

NB:  You'll need to make sure that in your Crowd directory permissions for the directory you're importing the groups/memberships in to, that Add Group and Modify Group are checked (I think that's all that's needed).

CCM

unknown · Answer

Hi @Marcin Kempa,

yes, this is (almost) correct. Only that we don't use groups taken from the Active Directory, but define our own in Crowd (like server1_administrator, server2_user, server3_reviewer or server4_projectxy_user).

I think we've got the idea. I only miss migration function that would permit to redefine the current users (configured in the servers' own directories) in Crowd. It seems to ask for a lot of manual work.

If all goes well we will have only the AD with our group memberships attached to the allowed users and we would like to use SSO among the applications.

Marcin Kempa · Answer

Hi @[deleted]

I am not sure I correctly understand your scenario, so let me try to share what I think you are trying to achieve.

* You have Active Directory where you have all of users and some groups
* You have several applications connected to Crowd (Jira, Confluence etc.)
* You would like to be able to control which user has access to which application
* You would like to be able to control permissions to specific projects / confluence spaces using groups in Crowd

Is that a fair summary?

BTW if you have multiple directories and each of your applications in Crowd is mapped to a different one there might be problems to setup Crowd SSO between them.

Best Regards,

Marcin Kempa