Redirect crowd to https

Hello,

how can i redirect to https?

In the server.xml i configured an http connector on Port 8095, redirect Port 443 and proxyname, proxyport, scheme.

In the web.xml security constraints are inserts with pattern /* or /crowd/*

The apache http server listen on Port 80 and 443 with proxy to Port 8095.

Any ideas?

Best regards

Falk

1 answer

This widget could not be displayed.
Ann Worley Atlassian Team Sep 14, 2017

Hi Falk,

I understand you want tomake sure all traffic to your Crowd server goes through https (SSL).

To redirect at the Apache proxy, please see: Redirect Request to SSL and Redirect.

To redirect at the Tomcat level, please make sure you are editing the web.xml at <Crowd_install>/crowd-webapp/WEB-INF and not the one at <Crowd_install>/apache-tomcat/conf. 

Add the following declaration to the end of the file, before the </web-app>tag:

<security-constraint>
<web-resource-collection>
<web-resource-name>Restricted URLs</web-resource-name>
<url-pattern>/</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>

Crowd will have to be restarted to pick up the change to the web.xml.

I look forward to hearing whether either of these redirect methods work for you.

Thanks,

Ann

Hello,

I know this question is semi-old, but it's a top hit on google and wanted to provide some more guidance here

This "works" but only for when you visit the actual crowd webapp at http://<server>/crowd

It does not apply to the main landing page of crowd (i.e. the tomcat ROOT page) at http://<server>/

This is because the Crowd root page, as well as the openidserver and openidclient applications are each considered a separate webapp by Tomcat, and therefore each one has its own web.xml which you have to edit and add this block of configuration text into.

So, in total you have to edit a whole bunch of web.xml files if you want to ensure that all Crowd pages are always served over HTTPS:

  • ${CROWD_DIR}/apache-tomcat/webapps/ROOT/WEB-INF/web.xml
  • ${CROWD_DIR}/crowd-webapp/WEB-INF/web.xml
  • ${CROWD_DIR}/crowd-openidclient-webapp/WEB-INF/web.xml
  • ${CROWD_DIR}/crowd-openidserver-webapp/WEB-INF/web.xml

You also need to ensure that in your tomcat Connectors in ${CROWD_DIR}/apache-tomcat/conf/server.xml has valid values for redirectPort (typically 443 or 8443 for HTTPS).

I'm trying to run Crowd 2.12.0 on HTTPS per the instructions below, but am not having any success:

https://confluence.atlassian.com/crowd0212/configuring-crowd-to-work-with-ssl-935372574.html

In addition to the steps in the link, I also updated the four web.xml files, putting in what Ann recommended (although I was wondering if I needed to replace the "Restricted URLs" and "CONFIDENTIAL" strings with something else).

After doing this and restarting Crowd, I was not able to sucessfully log into either Confluence or Jira (which are using Crowd). Whether I had the information in the web.xml files, I'm getting a message that "your connection is not private" when I go to https://{localhost}:8443/crowd/console.

I'm running all of my Atlassian Apps on Linux. Both Jira and Confluence are on the latest/greatest (6.8.2 for Confluence, 7.9.2 for Jira).

Is there something simple that I'm missing?

Thanks,
Matt

Ann Worley Atlassian Team May 29, 2018

Hi Matt,

Are you using a self signed certificate and getting the insecure connection message from Firefox, similar to this:

Screen Shot 2018-05-29 at 10.30.42 AM.png

If so, the browser may be alerting you that the redirection is working but the cert is not in the browser's trusted certificates. If you cancel the error can you still log in? What if you use a different browser?

Thanks,
Ann

Ann,

I'm using Chrome, but the underlying issue is very similar. I'm getting the "Your connection is not private" message. I am able to log in, but the https portion of the address has a strikethrough and the big "Not secure" warning is showing up next to the URL. I am able to log in to the Crowd console.

Going through IE gives me the "There is a problem with this webite's security certificate", but I can go past that and log in. The "Certificate error" warning shows up next to the URL in that case.

So it looks like the problem is that I'm not trusting the certificate. I followed the steps as written in my previous post, but I guess I'm not sure how to make sure that the certificate is trusted. I was under the impression that doing a self-signed basically did that for you, so maybe there's another step that I missed?

Thanks,
Matt

Hi Matt,

Browsers trust established Certificate Aauthorities like Versign by default, but you have to "tell" the browsers to trust your self signed certificate. Please try these instructions: Configure Your Browser to Trust a Self-Signed Certificate

Later on, if you integrate Confluence and Jira for example, the Java Trust stores of the applications will have to be setup to trust each other's certificates, as in Connecting to SSL services

Java will normally use a system-wide keystore in $JAVA_HOME/jre/lib/security/cacerts, 

I look forward to hearing how it goes.

Thanks,
Ann

Ann,

I had originally saved the self-signed into the path you specified above (../../security/cacerts).

After following the steps in the link you provided, I'm still getting the same message. Do I need to clear my cache or anything else?

I'm not sure if this matters, but I had set up https for both Jira and Confluence previously, using a self-signed cert, and didn't have to do any additional steps at the browser level. Is there something different with Crowd that would require it?

Thanks,
Matt

Ann Worley Atlassian Team May 29, 2018

HI Matt,

As far as the Java keystore, I was giving you a heads up about integrating the other apps later on. It does not impact the connection between Crowd and your browser. For your Chrome issue did you follow these steps?

  1. When you see a message saying your connection is not private, click Advanced, then click the Proceed to link log in.
  2. Save the presented certificate to a file. To do this:
  3. Click the View site information icon (a padlock) in the address bar:
  4. Click Certificate Information.
  5. On the Details tab, click Copy to File and save the file using defaults.
  6. Locate and double-click the certificate file you just saved.
  7. On the certificate General tab, click Install Certificate.
  8. In the Install Certificate Wizard, select Place all certificates in the following store.
  9. Click Browse and select Trusted Root Certification Authorities, then continue through the remaining steps to install the certificate.

If so, the connection should appear as safe/private/SSL. If not, please post a screen shot of the message you are seeing afterward.

Thanks,

Ann

Ann,

I apologize for the confusion. I did execute those steps and it still looks the same per the screenshot below:

 

Certificate Screenshot.PNG

Ann Worley Atlassian Team May 29, 2018

Some of the other instructions I am finding do include clearing the cache, I also wonder if antivirus is a factor or if the procedure would work on an incognito window.

  1. Clear all browsing data ( cache, cookies, hosted app data and so on). Then restart your browser.
  2. Restore your browser default settings. Restart your browser. ...
  3. Navigate to your browser “settings” →”change proxy”.
  4. In Security and Privacy Tab, adjust the level to “medium”.
  5. Clear and restart your browser.

Ann,

Thanks for all of your help on this. I guess my big question is not necessarily whether logging into the crowd console is secure, but whether the traffic going between Crowd and Jira/Confluence for authentication purposes is secure. Are the steps I'm taking working toward that end or am I going down the wrong path?

Matt

Ann Worley Atlassian Team May 29, 2018

If the base URLs are SSL and you used the https URLs to configure the application links and user directories to integrate the applications, the traffic between the apps will be encrypted. If the certificates have problems the connections will fail with conspicuous errors in the logs.

All three apps (Jira/Confluence/Crowd) were originally set up with HTTP. Several months ago, we reconfigured Jira/Confluence to use HTTPS both for themselves and the Application Links to each other. All of that has been working without a problem.

We are using Crowd to authenticate logins from Active Directory.

Then, we wanted to configure Crowd to use HTTPS as well. After running the configuration steps, I tried to access the crowd console to make sure it was using HTTPS and I encountered the behavior I've explained here.

At no time have I seen any problems logging in while everything was configured correctly (I made some early mistakes in the Crowd HTTPS configuration and then started over with a new snapshot, but it's fine now). So, is there anything else I need to do, or are the browser changes just necessary if I want to log into the console securely?

Ann Worley Atlassian Team May 29, 2018

The browser changes are just for convenience - after you click continue the browser trusts the cert and encrypts the session.

The https URLs in the application links and user directories ensure that in-between-app traffic is encrypted.

So it sounds like apart from the nuisance factor you are all set.

Ann,

After following the instructions to install the certificate on IE and clearing the cache, I am no longer seeing the certificate error. It looks like everything is working perfectly.

Thank you very much for your assistance and patience.

Matt

Suggest an answer

Log in or Sign up to answer
Atlassian Summit 2018

Meet the community IRL

Atlassian Summit is an excellent opportunity for in-person support, training, and networking.

Learn more
Community showcase
Published Feb 27, 2018 in Crowd

The Crowd team is looking for feedback on Server & Data Center customers' identity strategies!

Do you own more than one Server or Data Center product? Do you have challenges provisioning users across your Atlassian products? Are you spending a lot of time integrating each Atlassian product wit...

1,391 views 6 14
Read article

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you