nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How can I have users log into crowd without using the login page?

kieran snapes

I have crowd running on apache, where apache is authorising our users based on their certificates.

Is there a way that I can get around the need for a user to login with their username and password as they are already trusted at this point?
I could just pass the user's name from the cert

Would I need to write a plugin to do this? If so, what kind?

TLDR: I want to remove user validation as I already trust my users based on their certs.

Accepted answers

Bruno Vincent

You will actually need to write some code but it is quite straight forward. Crowd's REST API allows you to authenticate a user without validating the password by setting the validate-password parameter to false when creating a new SSO token.

Please take a look at the REST API reference: https://docs.atlassian.com/atlassian-crowd/latest/REST/#usermanagement/1/session-authenticateUser

Then, all you need to do is add the newly created SSO token to your client's HTTP requests.

All comments

Bruno Vincent

Please take a look at the REST API reference: https://docs.atlassian.com/atlassian-crowd/latest/REST/#usermanagement/1/session-authenticateUser

Then, all you need to do is add the newly created SSO token to your client's HTTP requests.

kieran snapes

Thanks!

What kind of plugin do you think would be best suited to implement a call out to the REST API?

I was thinking servlet filter as it allows you to make use of the before-dispatch option.
However, this will be my first plugin to develop so I'm not 100% on where I should start.

Bruno Vincent

I do agree with you, this is what servlet filters are made for! But you'll have to add the SSO token as a Crowd cookie at the beginning of the filter chain so the value of the location parameter should be before-login.

(If not already done, please check Atlassian's documentation at https://developer.atlassian.com/display/CROWDDEV/Servlet+Filter+Module)

kieran snapes

To create the SSO token is it as simple as grabbing the token from this API call? -
https://docs.atlassian.com/atlassian-crowd/latest/REST/#usermanagement/1/session-authenticateUser

and in terms of adding the token as a crowd cookie, do we need to use an API to add it?

This is all really helpful, thanks again

kieran snapes

Also wondering if it makes sense to use this class to do the work for me?

https://docs.atlassian.com/crowd/2.8.0/com/atlassian/crowd/integration/http/CrowdHttpAuthenticator.html#getToken(javax.servlet.http.HttpServletRequest)

method - authenticateWithoutValidatingPassword seems to authenticate and add the token to the response/request on its own.

Bruno Vincent

Well, the thing is Atlassian might change this class in its Java API someday so it's probably not a bad thing to stick to the REST API.

kieran snapes

This guy uses it as an example

https://community.atlassian.com/t5/Answers-Developer-Questions/CrowdHttpAuthenticator-usage-with-Crowd-2-3-REST-api/qaq-p/492558

I'll look at doing this tomorrow, will post back

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

crowd

authentication

ssl