nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

When would do you purchase Crowd?

Jonathan Smith

How many Atlassian applications should you have before getting Crowd?

Note: Currently all of my apps are running user directories though active directory so enabling/disabling is handled outside the apps. Knowing this, how would I benefit in having Crowd?

Accepted answers

All comments

Vick Khera

I got it once we went from just Jira to Jira + Confluence. I use Crowd as the directory itself.

As for if it will benefit you given you already have AD, I don't know. Maybe the authentication of the application to the authentication server may be easier with Crowd.

AnnWorley

When to get Crowd is not dependent on how many Atlassian applications you have. Rather, you should buy Crowd when you want to handle user management for all the apps from a single console or you want to use the SSO capability Crowd provides.

The best practice is to connect the LDAP directories to Crowd and then Crowd to the individual applications.

Eager to hear what others have to say about when/if to implement Crowd.

Vick Khera

Does SSO still work? As of Crowd 3.2 you cannot specify a bare domain beginning with a dot as the cookie domain anymore and still login to crowd itself.

AnnWorley

Hi Vick,

It does still work - please see our guide:

SSO within a Single Domain

If you wish to have single sign-on (SSO) support for *.mydomain.com, you will need to configure the SSO domain in Crowd as .mydomain.com — including the full stop ('.') at the beginning

Have you had an experience where it has not worked, or run into a bug? Please let us know how to help.

Thanks,

Ann

Marcin Kempa

Hi @Vick Khera

As @AnnWorley noted the SSO still works and you do not need to specify a base domain starting with a dot. The RFC 6265 states regarding the domain attribute in the Set-Cookie header:

If the first character of the attribute-value string is %x2E ("."):

      Let cookie-domain be the attribute-value without the leading %x2E
      (".") character.

   Otherwise:

      Let cookie-domain be the entire attribute-value.

I believe the problem you are seeing in the Crowd 3.2 (and in Crowd 3.1) is related to this issue.

Indeed Crowd should not act in a way where this leading dot is not permitted as the same RFC 6265 states in the server requirements (4.1.2.3):

[...]

(Note that a leading %x2E ("."), if present,
   is ignored even though that character is not permitted,

[...]

however this is the way Tomcat 8.5.x works by default and this is the Tomcat version that is being included since Crowd 3.1.x

Sorry for the inconvenience but we are already working on resolving this problem. In order to resolve it by yourself just remove the leading dot in the SSO cookie domain in Crowd config.

Hope that helps,

Marcin Kempa

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

jira