Crowd: User invite/onboarding flow with other products (Jira, Confluence, Bitbucket)

[Matthias Kannenberg]

Hi,

we have a full Atlassian stack (Jira, Confluence, Bamboo etc) and user management is done via Crowd.

I would like to know what the supposed/designed workflow is if we want to onboard a new user which should only use some of the products but not Crowd itself.

What we are currently doing:
1) Create the user in crowd with all necessary details and a temporary password
2) Add the new user to all desired groups
3) Click the password reset page, which will send a password change link to the user via mail
4) The user gets to a password change dialog and changes the password (up until here this is fine)
5) (The problem) After successfully changing the password, the User is directed to the Crowd login page, where he has no access (we obviously do not allow all users Crowd access) so if the user now tries to input their new credentials they will fail and with a "username/password wrong" error message

Now, while this is all clear and expected from a technical perspective, it is quite bad UX and has lead to confusion ("I changed my password but now I can not log in!") in the past, So I would be interested if we are missing a "right" way.. If we would only use Jira without Crowd I believe there is a proper invitation workflow? Also, we have users which are allowed to f.e. Bamboo for deployments but not into Jira, so having a password change option in Crowd is great, it's just that everything after is very confusing?

[Ed Letifov _TechTime - New Zealand_]

How exactly do you prevent users from Crowd access?

Is there a group-based restriction in "Directories & Groups" on your main user directory mapping in Crowd applications set on Crowd Console itself?

Is there actually any reason to prevent users from Crowd access? After all unless they are admins in Crowd they only get a very basic profile-like portal that would allow them to view their own info, change password etc.?