Domain

On this page

Still need help?

The Atlassian Community is here for you.

Ask the community

The SSO domain is used when setting HTTP authentication cookies in a user's browser. If this attribute is not correct, single sign-on (SSO) will not work when the user switches between applications.


Overview

The core Crowd functionality supports SSO across applications within a single domain, such as *.mydomain.com. Crowd uses a browser cookie to manage SSO. Because your browser limits cookie access to hosts in the same domain, this means that all applications participating in SSO must be in the same domain.

Example 1: If you wish to have single sign-on (SSO) support for *.mydomain.com, you will need to configure the SSO domain in Crowd as mydomain.com. All your Crowd-connected applications must be in the same domain. For example:

Crowd

crowd.mydomain.com

(tick)

Jira

jira.mydomain.com

(tick)

Confluence

confluence.mydomain.com

(tick)

FishEye

fisheye.mydomain.com

(tick)

FishEye in different domain

fisheye.example.com

(error)

Example 2: If you wish to have single sign-on (SSO) support for mydomain.com/*, you will need to configure the SSO domain in Crowd as mydomain.com. All your Crowd-connected applications must be in the same domain. For example:

Crowd

mydomain.com/crowd

(tick)

Jira

mydomain.com/jira

(tick)

Confluence

mydomain.com/confluence

(tick)

FishEye

mydomain.com/fisheye

(tick)

FishEye in different domain

example.com/fisheye

(error)

You can find information the comparison of host name strings in RFC 6265 (section 5).

(info) When developing on your local machine, you should set the domain to localhost.

Setting the SSO Domain

To specify the domain:

  1. Log in to the Crowd Administration Console.
  2. In the top navigation bar, click .
  3. Type the new domain into the SSO Domain field.
  4. Click Save.

Setting the SSO Domain when Crowd is behind a Proxy Server

If Crowd is being run behind a proxy server, before setting the SSO domain value, make sure that the domain specified in the proxy (that is currently being used to access the Crowd console) was specified in the Tomcat connector proxyName attribute. Example:

File: Apache-Tomcat/conf/server.xml

<Connector acceptCount="100" connectionTimeout="20000" disableUploadTimeout="true" enableLookups="false"
maxHttpHeaderSize="8192" maxSpareThreads="75" maxThreads="150" minSpareThreads="25"
port="8095" redirectPort="8443" useBodyEncodingForURI="true"
proxyName="mycompany.com" />

Notes

  • Avoiding problems with old cookie versions. In order to avoid problems with hosts or domains defined in old cookie versions, after setting the SSO Domain in Crowd, log out of Crowd and the integrated applications and delete all the web browser cookies.
  • SSO domain. The 'SSO Domain' field will accept only values based on the domain that is used to access the Crowd console. For instance, if you are using 'www.mycrowd.com/crowd/console' to access the console in the web browser, this field will accept the following values:
    • Empty
    • mycrowd.com
    • .mycrowd.com

      If you enter any other value, Crowd will show an error message: The supplied domain is invalid.
  • IP addresses. SSO will not operate when sites are accessed using IP addresses rather than domain names. This is a limitation of the cookie technology implemented in web browsers.
Last modified on May 16, 2019

Was this helpful?

Yes
No
Provide feedback about this article
Powered by Confluence and Scroll Viewport.