Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Crowd behind Nginx proxy

Nicolas_Grussenmeyer November 23, 2013


We are currently evaluating Crowd because we want SSO login between all Atlassian applications in our domain (we plan to buy Confluence, JIRA, Bamboo, Stash and Crucible).
The install of Crowd 2.7.0 went fine on a Windows Server 2008 R2, following the guides in Confluence.

My setup is as follows :

  • A Nginx edge server, IP
  • The server with Crowd, IP

I want to connect to Crowd using this URL :
The idea is that Nginx will handle the SSL part and reverse proxy the request to Crowd. I followed this guide :
I entered the URL as base URL during setup using the wizard.
I changed the Tomcat 7 server.xml to be as follows :

<Connector 	acceptCount="100"
			URIEncoding="UTF-8" />

        <Engine defaultHost="localhost" name="Catalina">
            <Host appBase="webapps" autoDeploy="true" name="localhost" unpackWARs="true"/>

        <!-- To connect to an external web server (typically Apache) -->
        <!-- Define an AJP 1.3 Connector on port 8009 -->

            <Connector 	port="8009" 
						protocol="AJP/1.3" />


I am able to access Crowd, to login, and go to the Administration section just fine. My problem is that I can't activate the SSO feature as Crowd complains that "The supplied domain is invalid.". I entered "" in the SSO domain field. Moreover, it seems that Crowd doesn't detect that it is accessed by SSL as the Secure SSO Cookie checkbox is grayed out.

Here is my file :

#Thu Nov 21 22:06:34 CET 2013


and my Nginx configuration file :

server {
    listen 443;

    location / {
            proxy_set_header    Host            $host;
            proxy_set_header    X-Real-IP       $remote_addr;
            proxy_set_header    X-Forwarded-for $remote_addr;
            port_in_redirect off;
            proxy_redirect /;     


Can you please provide some help here, as the SSO feature is pretty much the most important reason why we want to buy Crowd.

Nicolas Grussenmeyer

3 answers

1 accepted

1 vote
Answer accepted
Caspar Krieger
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
November 24, 2013

That message appears when the entered domain is both:

  • Not equal to the host as tomcat sees it
  • Not a suffix of the host as tomcat sees it

Or putting it a bit more simply: if Crowd sees that you're accessing it from "", then

  • is a valid domain to enter there
  • is also valid
  • (i.e. with a leading period) is also valid
  • (i.e. with a trailing period) is NOT valid
  • (i.e. with both a leading and trailing period) is NOT valid

The logic is basically around to prevent people from being able to lock themselves out of Crowd.

Those last two cases might seem like they should be valid, but as of Crowd 2.5 (specifically CWD-1945), Crowd is following the spec

So try entering in a domain of "" or "" (you can also leave it blank, in which case Crowd will try to auto-detect the domain).

Moreover, it seems that Crowd doesn't detect that it is accessed by SSL as the Secure SSO Cookie checkbox is grayed out.

I wouldn't worry about this, because this is what I'd expect when your reverse proxy is handling SSL; Crowd enables that checkbox based on whether the connection Crowd is made via SSL, and your reverse proxy is proxy passing to Crowd without SSL.

Nicolas_Grussenmeyer November 24, 2013

Thank you, using solved the problem.

It was that simple :-)

0 votes
David Yu
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
February 11, 2017

To ungrey the SSO checkbox, you need to have this in your nginx config (assuming SSL terminated at nginx)

proxy_set_header X-Forwarded-Proto $scheme;

0 votes
Raffi Enficiaud February 21, 2016

I have the following configuration

For NGinx

location /crowd {
  proxy_pass          http://localhost:8095/crowd;
  proxy_set_header    Host            $host;
  proxy_set_header    X-Real-IP       $remote_addr;
  proxy_set_header    X-Forwarded-for $remote_addr;
  port_in_redirect    off;
  proxy_redirect      $scheme://$server_name/crowd /crowd;

and for server.xml

<Connector port="8095" maxHttpHeaderSize="8192"
  maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
  enableLookups="false" acceptCount="100"
  connectionTimeout="20000" disableUploadTimeout="true"
  proxyPort="443" secure="true" scheme="https" redirectPort="8443" 
  useBodyEncodingForURI="true" URIEncoding="UTF-8"

It seems to work like a charm for all applications so far, and the SSO button is not greyed anymore. Am I missing something?

Suggest an answer

Log in or Sign up to answer
AUG Leaders

Atlassian Community Events