Integrating Bamboo with Crowd
You can configure Bamboo to use Atlassian Crowd for user and group management, and for authentication and authorization.
Atlassian Crowd is an application security framework that handles authentication and authorization for your web-based applications. With Crowd you can integrate multiple web applications and user directories, with support for single sign-on (SSO) and centralized identity management. See the Crowd Administration Guide.
Connect to Crowd if you want to use Crowd to manage existing users and groups in multiple directory types, or if you have users of other web-based applications.
On this page:
To connect Bamboo to Crowd:
- Log in as a user with 'Admin' permission.
- In the Bamboo administration area, click User Directories (under 'Security').
- Click Add Directory and select Atlassian Crowd.
- Enter settings, as described below.
- Test and save the directory settings.
- Define the directory order, on the Directories tab, by clicking the blue up- and down-arrows next to each directory. The directory order has the following effects:
- The order of the directories is the order in which they will be searched for users and groups.
- Changes to users and groups will be made only in the first directory where the application has permission to make changes.
Server settings
Setting | Description |
|---|---|
Name | A meaningful name that will help you to identify this Crowd server amongst your list of directory servers. Examples:
|
Server URL | The web address of your Crowd console server. Examples:
|
Application Name | The name of your application, as recognized by your Crowd server. Note that you will need to define the application in Crowd too, using the Crowd administration Console. See the Crowd documentation on adding an application. |
Application Password | The password which the application will use when it authenticates against the Crowd framework as a client. This must be the same as the password you have registered in Crowd for this application. See the Crowd documentation on adding an application. |
Crowd permissions
Bamboo offers Read Only permissions for Crowd directories. The users, groups and memberships in Crowd directories are retrieved from Crowd and can only be modified from Crowd. You cannot modify Crowd users, groups or memberships using the Bamboo administration screens.
Advanced settings
Setting | Description |
|---|---|
Enable Nested Groups | Enable or disable support for nested groups. Before enabling nested groups, please check to see if the user directory or directories in Crowd support nested groups. When nested groups are enabled, you can define a group as a member of another group. If you are using groups to manage permissions, you can create nested groups to allow inheritance of permissions from one group to its sub-groups. |
| Enable Incremental Synchronization | Enable or disable incremental synchronization. Only changes since the last synchronization will be retrieved when synchronizing a directory. Note that full synchronization is always executed when restarting the application. |
Synchronization Interval (minutes) | Synchronization is the process by which the application updates its internal store of user data to agree with the data on the directory server. The application will send a request to your directory server every x minutes, where 'x' is the number specified here. The default value is 60 minutes. |
Single sign-on (SSO) with Crowd
Bamboo supports the following options for configuring Crowd SSO:
- Cookie-based single domain SSO, Learn how to configure cookie-based SSO
- Crowd SSO 2.0. Learn how to configure Crowd SSO 2.0
For more information, see 2024-04-19_12-06-41_Overview of SSO.
Use only one configuration option at a time.
Using multiple directories
When Bamboo is connected to Crowd you can map Bamboo to multiple user directories in Crowd.
For Crowd 2.8, and later versions, there are two different membership schemes that Crowd can use when multiple directories are mapped to an integrated application, and duplicate user names and group names are used across those directories. The schemes are called 'aggregating membership' and 'non-aggregating membership' and are used to determine the effective group memberships that Bamboo uses for authorization. See Effective memberships with multiple directories for more information about these two schemes in Crowd.
Note that:
- Authentication, for when Bamboo is mapped to multiple directories in Crowd, only depends on the mapped groups in those directories – the aggregation scheme is not involved at all.
- For inactive users, Bamboo only checks if the user is active in the first (highest priority) directory in which they are found to determine authentication. The membership schemes described above are not used when Crowd determines if a user should have access to Bamboo.
- When a user is added to a group, they are only added to the first writeable directory available, in priority order.
- When a user is removed from a group, they are only removed from the group in the first directory the user appears in, when non-aggregating membership is used. With aggregating membership, they are removed from the group in all directories the user exists in.
An administrator can set the aggregation scheme that Bamboo uses when integrated with Crowd. Go to the Directories tab for the Bamboo instance in Crowd, and check Aggregate group memberships across directories to use the 'aggregating membership' scheme. When the checkbox is clear 'non-aggregating membership' is used.
Note that changing the aggregation scheme can affect the authorization permissions for your Bamboo users, and how directory update operations are performed.