JIRA throws Application failed to authenticate error when configuring a Crowd User Directory
Platform notice: Server and Data Center only. This article only applies to Atlassian products on the Server and Data Center platforms.
Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Problem
When configuring JIRA to use Atlassian Crowd as a user directory and everything is already configured correctly (including credentials), JIRA still throws the following error in the UI
Connection test failed. Response from the server:
com.atlassian.crowd.exception.InvalidAuthenticationException: Application failed to authenticateThe following stack trace is thrown in atlassian-jira.log
2015-06-16 19:43:12,114 http-bio-8080-exec-3 ERROR admin 1183x1167x1 17i2lib 192.168.0.1,127.0.0.1 /plugins/servlet/embedded-crowd/configure/crowd/ [crowd.embedded.admin.ConfigurationController] Configuration test failed for user directory: [ Crowd Server], type: [ CROWD ]
com.atlassian.crowd.exception.runtime.OperationFailedException: com.atlassian.crowd.exception.InvalidAuthenticationException: Application failed to authenticate
at com.atlassian.crowd.embedded.core.CrowdDirectoryServiceImpl.testConnection(CrowdDirectoryServiceImpl.java:78)
at sun.reflect.GeneratedMethodAccessor787.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:497)
at com.atlassian.plugin.osgi.hostcomponents.impl.DefaultComponentRegistrar$ContextClassLoaderSettingInvocationHandler.invoke(DefaultComponentRegistrar.java:134)
at com.sun.proxy.$Proxy230.testConnection(Unknown Source) <+2> (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:497)
...
Caused by: com.atlassian.crowd.exception.InvalidAuthenticationException: Application failed to authenticate
at com.atlassian.crowd.integration.rest.service.RestExecutor$MethodExecutor.throwError(RestExecutor.java:643)
at com.atlassian.crowd.integration.rest.service.RestExecutor$MethodExecutor.andReceive(RestExecutor.java:485)
at com.atlassian.crowd.integration.rest.service.RestCrowdClient.searchUsers(RestCrowdClient.java:553)
at com.atlassian.crowd.integration.rest.service.RestCrowdClient.testConnection(RestCrowdClient.java:541)
at com.atlassian.crowd.directory.RemoteCrowdDirectory.testConnection(RemoteCrowdDirectory.java:834)
... 217 more
Diagnosis
- JIRA and/or Crowd is running behind a reverse proxy
- The Server URL field when configuring the user directory in JIRA uses the proxied URL
- When bypassing proxy by adding an additional HTTP connector and then using the unproxied URL in the Server URL field, connection works fine
- The following
RequestHeader unset Authorizationline has been added to the apache configuration page as per Troubleshooting Apache
<Location /jira>
RequestHeader unset Authorization
ProxyPreserveHost On
ProxyPass http://jiraserver/jira
ProxyPassReverse http://jiraserver/jira
</Location>Cause
The RequestHeader unset Authorization line added to the proxy configuration is the cause of a failed authentication from JIRA to Crowd.
Resolution
Remove or comment that line out
<Location /jira> # RequestHeader unset Authorization ProxyPreserveHost On ProxyPass http://jiraserver/jira ProxyPassReverse http://jiraserver/jira </Location>- Restart the Apache service