Connecting local crowd to upstream crowd

[colorfingers]

How do I connect our Crowd to an upstream crowd without it locking us out of our license?  The corporation has a network and their crowd is connected to the AD.  We have a separate Crowd server that connects to it so that users of the network can logon to our services in the same domain. 

We are a subset of the domain and only want logged on users to be cached in our Crowd.  After a few minutes of being connected to the upstream crowd we get locked out with the message we have gone over our license and need to puchase a new one.  Nobody is logging on at the time but me.

[Craig Castle-Mead]

Hi @colorfingers 

Theres quite a lot of detail missing from your explanation, so the below may not be relevant for your org/setup, but some thoughts:

• Crowd licenses are about users in a directory - not just who has logged in.
• assuming you downstream Crowd server is using a Remote Crowd directory to pull users from the Upstream Crowd server, you can limit the users who are being exposed between the two instances by adjusting the “Who can login” options for the upstream Crowd application that the downstream Crowd directory uses. You would have to uncheck the “anyone can authenticate” checkbox and then add group(s) that represent your subset of users. You then need to set “All groups, but only users with access rights” option as per https://confluence.atlassian.com/crowd/syncing-users-based-on-their-access-rights-1085203681.html#:~:text=When%20you%20map%20a%20user,is%20redundant%20in%20most%20cases. This would only expose the users in the selected groups to your downstream Crowd server.

CCM