Integrating Crowd with Apache

Crowd provides a number of modules that allow you to configure Crowd to authenticate HTTP Basic Authentication requests made to an Apache web server.

The following features are supported:

• Authentication: Use Crowd to password-protect resources on your website.
• Authorization: Configure website locations to restrict access to specific Crowd groups or users.

This version of the connector is supported under Linux. Please see Choosing the Correct Apache Connector for your Operating System for details and alternatives.

Note: These instructions apply to Crowd 2.1 and later. We assume some UNIX system and Apache configuration knowledge.

On this page:

Prerequisites

Download and configure Crowd. Refer to the Crowd installation guide for detailed information on how to do this.

Step 1. Disabling any Previous Version of the Crowd Apache Connector

If you are upgrading from a previous version of the Connector, you must disable it by following these instructions before proceeding.

Step 2. Configuring Crowd to Talk to Apache

Crowd needs to be aware that Apache will be making authentication requests to Crowd. In brief, you will need to do the following:

1. Define Apache as a Crowd-connected application to Crowd.
2. Add and configure the directories visible to Apache.
3. Add and map the groups which are allowed to authenticate with Apache.

Step 3. Choosing the Correct Apache Connector for your Operating System

The installation procedures for Apache and the Crowd Apache connector vary depending on the operating system you are using. Use the links below to find installation instructions for your chosen operating system. If you have not chosen an operating system yet, you will probably find one of the Linux variants easiest to set up.

The 2.x version of the Crowd-Apache connector supports advanced features such as nested groups and single sign-on but is currently only supported for certain operating systems.

*The Crowd-Apache Connector 2.0 source code is available with instructions to build from source. If you have the expertise to compile the C library and get it working for an environment that is currently not supported then feel free to contribute by adding a comment to this page. We will try to incorporate your fix in the next release of the Crowd-Apache Connector.

Step 4. Configuring Authentication

In this section, you will tell Apache to use Crowd to authenticate requests for a particular location. Edit the Apache config file and add the following commands to a <Location> or <Directory> section.

<Directory "/var/mysite/">
.
.
.
  AuthName "Atlassian Crowd"
  AuthType Basic
  AuthBasicProvider crowd

  CrowdAppName myappname
  CrowdAppPassword mypassword
  CrowdURL http://localhost:8095/crowd/

  Require valid-user
.
.
.
</Directory>

This is the minimum configuration required to password-protect a location with Crowd.

<Directory "/var/mysite/">
.
.
.
</Directory>

CrowdURL http://localhost:8095/crowd/

The following configuration commands are optional, and can be used to customize your configuration further:

For more detail about Apache configuration, please refer to the Apache documentation.

Step 5. Configuring Authorization

If you want to restrict access to a certain Apache <Directory> or <Location>, so that only a subset of Crowd users and/or groups have permissions, add the following lines to your configuration:

<Location URL_to_restrict>
  .
  .
  .
  Require user johnh kevinr
  Require group developers crowd-administrators
  AuthzUserAuthoritative Off
  .
  .
  .
</Location>

If you are using "Require user" and "Require group" directives together, you will need to add the following setting:

If you have configured authorization providers in addition to the Crowd Apache connector, you may need to add the following optional setting:

Step 6. Configuring Subversion (Optional)

If you are using Subversion under Apache, Crowd's Subversion connector allows you to password-protect a Subversion repository and provide fine-grained access control by group or user.

Follow the instructions on integrating Crowd with Subversion.

Notes

• Typically, only one of the Require user or Require group commands is needed for a particular location. You can define both. If you do, then access is granted if either is satisfied.
• If the CrowdCacheMaxEntries setting is missing or set to a non-zero value, then requests to Crowd are cached in order to increase performance. This means that changes to passwords, group membership and session expiry in Crowd may not be reflected immediately in user access.

• Although the Apache Connector does not support Digest Authentication, the connection with Crowd can still be secured by using httpsto make the SOAP connections.

  CrowdURL https://localhost:8095/crowd/

  For information on how to secure Crowd connections, refer to the documentation on configuring Crowd to work with SSL.

• If you are using Crowd 2.0 or earlier, you need to follow the instructions for Crowd 2.0.

RELATED TOPICS

• Using the Application Browser
• Adding an Application
• Configuring the Google Apps Connector
• Mapping a Directory to an Application
• Effective memberships with multiple directories
• Specifying an Application's Address or Hostname
• Testing a User's Login to an Application
• Enforcing Lower-Case Usernames and Groups for an Application
• Managing an Application's Session
• Deleting or Deactivating an Application
• Configuring Caching for an Application
• Overview of SSO
• Configuring Options for an Application

Crowd 3.0 beta documentation