Customer cannot login to customer channel

Question

I can reproduce the following simplified behaviour:

* Jira is connected to Crowd
* I have a "jira-users" group in Crowd, used for Jira Software Access
* I have a "project-A-customer" group in Crowd
* I assigned "John Tester" ONLY to "project-A-customer"
* In Jira project A settings -> "Users and roles", I added the group "project-A-customer" to role "Service Desk Customer"
* In my project A permission scheme, the "Service Desk Customer - Portal Access" role do have several permissions, e.g. "Browse Projects", "Create Issues", "Assign Issues", "Add Comments", "Create Attachments", ...
* I go to project A customer channel and try to login with user "John Tester"
* Nothing happens; the progress indicator circle keeps spinning forever
* Now I add "John Tester" to group "jira-users"
* Retry login to project A customer channel
* login succeeded

Obviously, I DON'T want John Tester grant acces to Jira Software ("jira-users" group), only to the customer channel.

What am I doing wrong?

Andy Heinzer · Answer

I'm afraid our community site does not have the ability to attach files directly here.  You could use a service like dropbox or google drive to upload the file and then share the link with us here to take a closer look.  When we have finished you can then remove the shared file in case you have any concerns about sensitive data.   Technically a HAR file could contain a cookie about your session, but whether or not that could be exploited, I'm not sure.

Another thing to try here.  Instead of adding that user to a group and that group to the project role.  Try to just add this specific user account to the project role called 'Service Desk Customers', and then see if they can login to the customer portal.

You are correct that your jira-users group is likely being used to grant application access to licensed users and that service desk customers (unlicensed users) should not belong to this group.

Steffen Becker_5ohwy3 · Answer

Thank you!

Where should I drop the file?

(I'm not sure if I removed all sensitive data. I removed the user-password - is there something else to be removed?)

Regarding the KB article: It describes how to add a user as "Jira Software User" (Applications -> Application access):

In my case, this is the "jira-users" group. Maybe I have a misunderstanding: Must a user be in this group to be able to access the customer channel? Or is this group not required for customer channel access? If case 1 is true, this would explain everything.

Andy Heinzer · Answer

I'm not convinced you're actually doing anything wrong here.  You could be running into a known bug.  There are several different approaches to this problem we could take to try to troubleshoot this.

The one I am favoring towards is as follows:

* Remove the test account from the jira-users group, and make sure they are in the other group that has the service desk customer role for that project
* Try to login to the customer portal with those credentials again
* Generate a HAR file when trying to login.

I suggest this route because I know there exists at least two bugs in regards to Service Desk's login page not displaying any error messages when a login failure happens.  Details in

* https://jira.atlassian.com/browse/JSDSERVER-5786
* https://jira.atlassian.com/browse/JSDSERVER-5791

You might be running into one of these bugs, or something similar.  The HAR file should be able to capture a response from the Jira site about why the login is failing.  I suspect you might see an HTTP error code of somekind with a brief error message giving us more details.  I wish that error would appear in the web browser, where the end user can easily see it, but alas I think these existing bugs could be why we can't see the login failure here.   With that information, we should have some better understanding of why this is failing.

More thoughts and other possible approaches:

Using crowd here is an interesting detail.   When you integrate Crowd to handle authentication in Jira, there is a setting in the user directory configuration in Jira called 'Update group memberships when logging in'.  The options for this field are

* For newly added users only
* Never
* Every time the user logs in

My fear is that this crowd group membership might not be getting applied to this user in part because of the setting you might have here.   But this is hard to tell for sure because I don't know what your setting is here.

The other approach you could try there, if the first doesn't work, would be to follow this KB: Unable to login to JIRA applications

It details some debug logging packages you can enable in Jira in order to get better insights from the Jira logs about why any particular user login fails in Jira.  The two differences being, authentication failed, or the user does not have authorization.   With this information we can then better try to understand where else we would need to look to troubleshoot this.