Crowd 'add application' setup with Active Directory Authentication

[trevoc]

I've setup confluence and crowd so far without problems (Great documentation so far guys)

I have the default crowd directory setup during install (MS SQL) and have successfully setup an AD Directory (connector) that has synced properly with my DC. I can browse all my users via crowd admin console.

All is good.

Now I only have the admin user in Confluence so far, figured I would pull the users from AD

while reading the Crowd docs .../Integrating Crowd with Atlassian Confluence

it says that I have to create a Confluence directory (can I assume this to be my AD that I created or do I have to create another directory for confluence users? having crowd dir / ad dir / confluence dir) Is the AD Connector I setup fine for the confluence dir if I want to authenticate against AD?

I noticed that it says to create two groups:

confluence-users and confluence-administrators

Should I create those groups in AD and add my user account in AD to the confluence-administrators account and all of the users that I want to give access to confluence to the confluence-users account including mine also of course.

If that is the case,

Will those AD users be able to use their AD login to access confluence now?

will they have to type their AD login information if they have already authenticated their login on their computer (logged on?), or once a user logs on to their computer with AD, and access http://confluence, confluence will automatically authenticate against crowd>AD and the user will be logged in?

Sorry for the basic questions, everything so far with the setup has been a cake walk, but the doc at this point is confusing me a bit.

TIA

[trevoc · Accepted solution]

As Kerem mentioned above, there are other options, and I thank him for his input, but my question was more specific, and I definatley didn't want to start managing users in Crowd and AD. I've figured it all out... here it goes:

it says that I have to create a Confluence directory (can I assume this to be my AD that I created or do I have to create another directory for confluence users? having crowd dir / ad dir / confluence dir) Is the AD Connector I setup fine for the confluence dir if I want to authenticate against AD?

You don't have to create another directory... In my case the AD Connector directory that I created is perfect for the "Confluence" directory mentioned in the docs... I just create a confluence-users and confluence-administrators group in either AD, or Crowd (which as long as it has create group permissions) which will create it for you in AD.

Will those AD users be able to use their AD login to access confluence now?

Yes, after the rest of the setup steps which where all a piece of cake.

will they have to type their AD login information if they have already authenticated their login on their computer (logged on?), or once a user logs on to their computer with AD, and access http://confluence, confluence will automatically authenticate against crowd>AD and the user will be logged in?

Yes, they will have to type their AD login informaiton again into the Confluence website even though they are already logged onto their Domain (AD) Account on their computer.

They WILL NOT be SSO'd from their windows authentication, but rather SSO'd between anything that is added as an application within CROWD, atlassian apps and others.. ldap AD Apache etc... OPENID.

I had thought and wished that the SSO would work like sharepoint and have a SSO at the point of entry, and the site as the users hompage that would not require another logon.

Seems I was wrong.

Unless someone can point me in the right direction... is this even possible?

[Kerem Caglar [Solveka]]

For domain SSO you can check this discussion

https://answers.atlassian.com/questions/22920/ntlm-authenticator-does-not-work-any-more-with-confluence-4-x-probably-same-problem-with-3-5-x

[Kerem Caglar [Solveka]]

Should I create those groups in AD and add my user account in AD to the confluence-administrators account and all of the users that I want to give access to confluence to the confluence-users account including mine also of course.

This depends on the type of the directory. If you use delegated authentication, you do not have to create any groups in AD. You can create the groups in Crowd internally. Read only users from AD. and handle the group memberships in Crowd.

If you select connector type directory, then all of the user and group management are handled by AD, so you have to create the groups in AD and add the appropriate users into the groups in AD.

In both cases authentication is done via AD so users are able to use their domain passwords to login to Confluence.

See https://confluence.atlassian.com/display/CROWD/Configuring+a+Delegated+Authentication+Directory and https://confluence.atlassian.com/display/CROWD/Microsoft+Active+Directory for details.