Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
4,296,487
Community Members
 
Community Events
165
Community Groups

Crowd behind Nginx proxy

Hi,

We are currently evaluating Crowd because we want SSO login between all Atlassian applications in our domain (we plan to buy Confluence, JIRA, Bamboo, Stash and Crucible).
The install of Crowd 2.7.0 went fine on a Windows Server 2008 R2, following the guides in Confluence.

My setup is as follows :

  • A Nginx edge server, IP 192.168.42.11
  • The server with Crowd, IP 192.168.42.18

I want to connect to Crowd using this URL : https://sso.example.com/crowd
The idea is that Nginx will handle the SSL part and reverse proxy the request to Crowd. I followed this guide :https://confluence.atlassian.com/display/CROWDKB/How+to+use+NGINX+to+proxy+requests+for+Crowd
I entered the URL https://sso.example.com/crowd as base URL during setup using the wizard.
I changed the Tomcat 7 server.xml to be as follows :

<Connector 	acceptCount="100"
           	connectionTimeout="20000"
		   	disableUploadTimeout="true"
		   	enableLookups="false"
			maxHttpHeaderSize="8192"
			proxyName="sso.example.com"
			proxyPort="443"
			scheme="https"
			maxThreads="150"
			minSpareThreads="25"
			port="8095"
			redirectPort="8443"
			useBodyEncodingForURI="true"
			URIEncoding="UTF-8" />

        <Engine defaultHost="localhost" name="Catalina">
            <Host appBase="webapps" autoDeploy="true" name="localhost" unpackWARs="true"/>
        </Engine>

        <!-- To connect to an external web server (typically Apache) -->
        <!-- Define an AJP 1.3 Connector on port 8009 -->

            <Connector 	port="8009" 
						enableLookups="false"
						redirectPort="8443"
						protocol="AJP/1.3" />

 

I am able to access Crowd, to login, and go to the Administration section just fine. My problem is that I can't activate the SSO feature as Crowd complains that "The supplied domain is invalid.". I entered ".example.com." in the SSO domain field. Moreover, it seems that Crowd doesn't detect that it is accessed by SSL as the Secure SSO Cookie checkbox is grayed out.

Here is my crowd.properties file :

#Thu Nov 21 22:06:34 CET 2013
session.lastvalidation=session.lastvalidation
application.password=6dxPjMH1
session.isauthenticated=session.isauthenticated
application.name=crowd
crowd.server.url=https\://sso.example.com/crowd/services/
session.validationinterval=0
session.tokenkey=session.tokenkey
application.login.url=https\://sso.example.com/crowd

 

and my Nginx configuration file :

server {
    listen 443;
    server_name sso.example.com;

    location / {
            proxy_pass http://192.168.42.18:8095/;
            proxy_set_header    Host            $host;
            proxy_set_header    X-Real-IP       $remote_addr;
            proxy_set_header    X-Forwarded-for $remote_addr;
            port_in_redirect off;
            proxy_redirect   https://sso.example.com/ /;     
    }
}

 

Can you please provide some help here, as the SSO feature is pretty much the most important reason why we want to buy Crowd.

Thanks,
Nicolas Grussenmeyer

3 answers

1 accepted

1 vote
Answer accepted

That message appears when the entered domain is both:

  • Not equal to the host as tomcat sees it
  • Not a suffix of the host as tomcat sees it

Or putting it a bit more simply: if Crowd sees that you're accessing it from "sub.foobar.com", then

  • sub.foobar.com is a valid domain to enter there
  • foobar.com is also valid
  • .foobar.com (i.e. with a leading period) is also valid
  • foobar.com. (i.e. with a trailing period) is NOT valid
  • .foobar.com. (i.e. with both a leading and trailing period) is NOT valid

The logic is basically around to prevent people from being able to lock themselves out of Crowd.

Those last two cases might seem like they should be valid, but as of Crowd 2.5 (specifically CWD-1945), Crowd is following the spec https://tools.ietf.org/html/rfc6265#section-4.1.2.3.

So try entering in a domain of "example.com" or ".example.com" (you can also leave it blank, in which case Crowd will try to auto-detect the domain).

Moreover, it seems that Crowd doesn't detect that it is accessed by SSL as the Secure SSO Cookie checkbox is grayed out.

I wouldn't worry about this, because this is what I'd expect when your reverse proxy is handling SSL; Crowd enables that checkbox based on whether the connection Crowd is made via SSL, and your reverse proxy is proxy passing to Crowd without SSL.

Thank you, using .example.com solved the problem.

It was that simple :-)

To ungrey the SSO checkbox, you need to have this in your nginx config (assuming SSL terminated at nginx)

proxy_set_header X-Forwarded-Proto $scheme;

I have the following configuration

For NGinx

location /crowd {
  proxy_pass          http://localhost:8095/crowd;
  proxy_set_header    Host            $host;
  proxy_set_header    X-Real-IP       $remote_addr;
  proxy_set_header    X-Forwarded-for $remote_addr;
  port_in_redirect    off;
  proxy_redirect      $scheme://$server_name/crowd /crowd;
}

and for server.xml

<Connector port="8095" maxHttpHeaderSize="8192"
  maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
  enableLookups="false" acceptCount="100"
  connectionTimeout="20000" disableUploadTimeout="true"
  proxyName="my-proxy" 
  proxyPort="443" secure="true" scheme="https" redirectPort="8443" 
  useBodyEncodingForURI="true" URIEncoding="UTF-8"
/>

It seems to work like a charm for all applications so far, and the SSO button is not greyed anymore. Am I missing something?

Suggest an answer

Log in or Sign up to answer
TAGS
Community showcase
Posted in Jira Service Management

Jira Service Management Documentation Opportunities

Hello everyone, Hope everyone is safe! A few months ago we posted an article sharing all the new articles and documentation that we, the AMER Jira Service Management team created. As mentioned ...

320 views 0 10
Join discussion

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you