Craig Castle-Mead_20fp9z Expert

Hi @강준모-테스트 Access now supports multiple IDPs, so I expect you would be able to add two IDP connections in Access, one to each of your AADs CCM

Hey @Kieren While this is absolutely a step in the right direction, https://jira.atlassian.com/browse/ID-6677 (the Atlassian Access request) was duplicated from the original on-premise ticket ( https://jira.atlassian.com/browse/JRASERVER-1391 ) so retained it's original creation date. The frustration you apologised for the…

Hey @Bastian Stehmann I'm not aware of any GDPR functionality in Crowd (native or on the marketplace). https://confluence.atlassian.com/gdpr/crowd-right-to-erasure-949761091.html does have some information on where PII may be stored in the database - even if you anonymise the user entry itself. CCM

Hi @Jakob KN I'm not sure if you can really achieve what you're after, but the way I'd approach it (in testing, on a non-prod environment </disclaimer> ) * Setup a Crowd directory with two applications linked to it (one you use for SAML, one you use for "traditional" Crowd auth) use the "Groups that can authenticate"…

Hi @_string_ I believe the Jenkins Crowd plug-in you’re using only supports “on demand” user provisioning, ie: a user is only created/synced in Jenkins when they successfully authenticate with Crowd, so if you have 100,000 users in Crowd cause you need them as JSD customers, but then have a group that is able to…

Hi @Phil Tayles You are correct - there is no way to enforce SSO by product automatically. Access is about securing user accounts, not enforcing policies by product/instance. Access now gives you the option to auto claim all accounts for a domain, or selectively, so you could move to selective claim and then only claim…

hi @Bernd Pörner A feature/option was added earlier this year that allows selective claiming or accounts, or auto-claiming all accounts in a domain. You can view/change the settings on your Access Directory > Domains page CCM

Hi @of7085 Based on your description, I assume you have the below in Access: * A local authentication policy that contains all of the users who you claimed/added before you setup your AzureAD connection in Access * An SSO authentication policy that contains all of the users you’ve provisioned in AzureAD since the…

https://jira.atlassian.com/browse/ACCESS-568 Is the JAC for this type of feature, but it’s closed as won’t fix.

Hi @Aya AlJboor https://support.atlassian.com/security-and-access-policies/docs/understand-authentication-policies/ outlines the options available for auth policies, and there is no option to stop password reuse. If you connect Access to an external IDP (Okta/AzureAD etc), then you can likely enforce this type of policy…

Hi, As far as I know, there’s no way to automatically achieve this (assign auth policies by product access), you would need to have a non-billing/No SSO auth policy and assign users who you knew only used Trello to that policy. This may be scriptable (get all users, review the products they have access to), but I don’t…

Hi, you should be able to move the account from the local authentication policy to your SSO authentication policy. CCM

Hi, in Crowd, find the application (wiki) then go then go to the Permissions tab and review the enabled permissions. Change to suit your needs. CCM 

I’d absolutely recommend the internal directory approach above if you’re not sure when the AD changes are going to be made, or your AD > Crowd > application sync time isn’t near real time. You could also do the opposite of this by setting up an internal directory and add the new group names to it, then start adding the new…

Hey @SG You’re well aware of the problem here it’s sounds like. When the groups change in AD - the Atlassian applications will see them as a brand new group that happens to have the same members as the old group, which it now thinks has been deleted, so any permissions relying on the old group are broken. Bitbucket and…

Hey @James Devos We had issues with 4.4.4 or up as well due to the default behaviour change that doesn’t allow username changes by REST API, however we were given the below startup parameter to add and all has been fine since -Dcrowd.email.change.by.external.apps=true Add this, and you’ll be able to upgrade to 4.4.4 (or…

Hi @KB Bulk deleting users could also be done by writing a bash (or powershell, or batch) script that loops through your list of users and calls the delete REST API for each user. Take a look at the miniOrange offerings as @Harshit_miniOrange mentioned though. We use a number of their products and have found the pricing…

Hi @Jacob Dokos You’re not able to see this data via the UI, there’s no “Member Of” type of output. You can query the cwd_membership table from the database, but this approach is at your own risk. CCM

Hi @Aaron.Khan , Accessing any content via the database is never the recommended option. There may be changes to the structure with version upgrades, you’d need to reverse engineer the structure of the tables to figure out how to extract the right information - safely and reliably. There may be an existing Marketplace app…

Hi, you should find the database connection string in your bitbucket.properties file see jdbc.url under https://confluence.atlassian.com/bitbucketserver/configuration-properties-776640155.html CCM

This post just came in handy - 8 years later! NB: the "users.each {userName ->" looks like it was URL encoded on paste/save and should be "userName ->" CCM

Hey @Marc Nemes The behaviour is outlined on https://confluence.atlassian.com/conf713/delete-or-disable-users-1077914300.html "When a user account is deleted > Their account is deleted and anonymised permanently, and can't be restored" - so seems this user is permanently anonymised. I would suggest trying to change the…

Ask your BB admin to use the mail send/debug tool to check you get the test email. Id also check you’ve got no spam filter/junk/rules etc that might be intercepting the emails. CCM 

@Brandon Shinault You may want to check out if Jira’s GraphQL support can help. This is one of those use cases a mature GraphQL should be a slam dunk. https://developer.atlassian.com/platform/atlassian-graphql-api/graphql/#examples CCM

Piotr’s answer is correct if you’re terminating SSL with Crowd directly, but if you’re using Apache/nginx/etc as your reverse proxy in front of crowd, you’ll need to update the SSL there instead/as well. CCM 

Hi @JooHyun Park What errors are shown in the crowd log files when the 500s are displayed? Is Jira configured to use Crowd for SSO? CCM

https://github.com/redradishtech/activeobject_views/blob/master/jiraplugins.csv has a pretty exhaustive list - but last commit was 2022. Content stuffing each of the AO's currently listed in the above GitHub link so they'll at least show in search results AO_8496F9 AO_BF7624 AO_299380 AO_1EF9DD AO_788523 AO_499D56…

Hey Baxter, Huge disclaimer on the below - these are updates directly in the DB and are NOT supported or recommended by Atlassian, however we have used these a number of times with success to resolve issues where data "had" to be reassigned from old to new users. These queries only handle native Jira objects (eg: plugins…

Hey @benjamin easter If you're using Crowd 3.3 or newer, there is Group Level Administration - https://confluence.atlassian.com/crowd/group-level-administration-958762255.html - which can be used to give non-sysadmin users access to manage groups. I believe this could be what you're after. CCM

Hey Chris, I'm not 100% sure what you mean by "out of support" - however, since 3.7 was released in October 2019, and Crowd is now on 5.x - my suspicion would be that if you had any issues you reached out to Atlassian to resolve - bugs/features/security - one of the first steps would be requesting you moved to a MUCH more…