Showing results for 
Search instead for 
Did you mean: 
Sign up Log in
Deleted user
0 / 0 points
badges earned

Your Points Tracker
  • Global
  • Feed

Badge for your thoughts?

You're enrolled in our new beta rewards program. Join our group to get the inside scoop and share your feedback.

Join group
Give the gift of kudos
You have 0 kudos available to give
Who do you want to recognize?
Why do you want to recognize them?
Great job appreciating your peers!
Check back soon to give more kudos.

Past Kudos Given
No kudos given
You haven't given any kudos yet. Share the love above and you'll see it here.

It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

Crowd behind Nginx proxy


We are currently evaluating Crowd because we want SSO login between all Atlassian applications in our domain (we plan to buy Confluence, JIRA, Bamboo, Stash and Crucible).
The install of Crowd 2.7.0 went fine on a Windows Server 2008 R2, following the guides in Confluence.

My setup is as follows :

  • A Nginx edge server, IP
  • The server with Crowd, IP

I want to connect to Crowd using this URL :
The idea is that Nginx will handle the SSL part and reverse proxy the request to Crowd. I followed this guide :
I entered the URL as base URL during setup using the wizard.
I changed the Tomcat 7 server.xml to be as follows :

<Connector 	acceptCount="100"
			URIEncoding="UTF-8" />

        <Engine defaultHost="localhost" name="Catalina">
            <Host appBase="webapps" autoDeploy="true" name="localhost" unpackWARs="true"/>

        <!-- To connect to an external web server (typically Apache) -->
        <!-- Define an AJP 1.3 Connector on port 8009 -->

            <Connector 	port="8009" 
						protocol="AJP/1.3" />


I am able to access Crowd, to login, and go to the Administration section just fine. My problem is that I can't activate the SSO feature as Crowd complains that "The supplied domain is invalid.". I entered "" in the SSO domain field. Moreover, it seems that Crowd doesn't detect that it is accessed by SSL as the Secure SSO Cookie checkbox is grayed out.

Here is my file :

#Thu Nov 21 22:06:34 CET 2013


and my Nginx configuration file :

server {
    listen 443;

    location / {
            proxy_set_header    Host            $host;
            proxy_set_header    X-Real-IP       $remote_addr;
            proxy_set_header    X-Forwarded-for $remote_addr;
            port_in_redirect off;
            proxy_redirect /;     


Can you please provide some help here, as the SSO feature is pretty much the most important reason why we want to buy Crowd.

Nicolas Grussenmeyer

3 answers

1 accepted

1 vote
Answer accepted

That message appears when the entered domain is both:

  • Not equal to the host as tomcat sees it
  • Not a suffix of the host as tomcat sees it

Or putting it a bit more simply: if Crowd sees that you're accessing it from "", then

  • is a valid domain to enter there
  • is also valid
  • (i.e. with a leading period) is also valid
  • (i.e. with a trailing period) is NOT valid
  • (i.e. with both a leading and trailing period) is NOT valid

The logic is basically around to prevent people from being able to lock themselves out of Crowd.

Those last two cases might seem like they should be valid, but as of Crowd 2.5 (specifically CWD-1945), Crowd is following the spec

So try entering in a domain of "" or "" (you can also leave it blank, in which case Crowd will try to auto-detect the domain).

Moreover, it seems that Crowd doesn't detect that it is accessed by SSL as the Secure SSO Cookie checkbox is grayed out.

I wouldn't worry about this, because this is what I'd expect when your reverse proxy is handling SSL; Crowd enables that checkbox based on whether the connection Crowd is made via SSL, and your reverse proxy is proxy passing to Crowd without SSL.

Thank you, using solved the problem.

It was that simple :-)

I have the following configuration

For NGinx

location /crowd {
  proxy_pass          http://localhost:8095/crowd;
  proxy_set_header    Host            $host;
  proxy_set_header    X-Real-IP       $remote_addr;
  proxy_set_header    X-Forwarded-for $remote_addr;
  port_in_redirect    off;
  proxy_redirect      $scheme://$server_name/crowd /crowd;

and for server.xml

<Connector port="8095" maxHttpHeaderSize="8192"
  maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
  enableLookups="false" acceptCount="100"
  connectionTimeout="20000" disableUploadTimeout="true"
  proxyPort="443" secure="true" scheme="https" redirectPort="8443" 
  useBodyEncodingForURI="true" URIEncoding="UTF-8"

It seems to work like a charm for all applications so far, and the SSO button is not greyed anymore. Am I missing something?

To ungrey the SSO checkbox, you need to have this in your nginx config (assuming SSL terminated at nginx)

proxy_set_header X-Forwarded-Proto $scheme;

Suggest an answer

Log in or Sign up to answer
Community showcase
Published in Jira Service Management

JSM June Challenge #2: Share how your business teams became ITSM rockstars

For JSM June Challenge #2, share how your non-technical teams like HR, legal, marketing, finance, and beyond started using Jira Service Management! Tell us: Did they ask to start using it or...

307 views 9 7
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you