Crowd Directory Copy in AWS effected by ALB Timeout in UI
Platform Notice: Server and Data Center Only - This article only applies to Atlassian products on the server and data center platforms.
Clients who use AWS with Crowd may wish to setup a second Failover Directory so that their users can login to their Atlassian products. If they follow the procedure to copy a directory as per the article Configuring a delegated authentication directory, specifically the following:
After configuring your new directory:
- Map the directory to the appropriate applications.
- Consider how you would like to add your users to Crowd's Delegated Authentication directory. There are a few options:
The directory copy will appear to fail
The following message will appear in the Crowd Administrators User Interface:
Your request could not be processed because a required security token was not present in the request. You may need to re-submit the form or reload the page. ou may need to re-submit the form or reload the page.
- If your Crowd instance is inside of AWS and is using an Amazon Load Balancer (ALB) for the application, then you are effected by the ALB settings.
- Check to see what the timeout is set to inside of AWS for your ALB
The maximum amount of time that the ALB will allow for an HTTP/HTTPS request is 4000 seconds. This is hardcoded in the ALB and can not be altered. That is the set maximum value allowed.
The directory copy will actually complete, but it will take time to do so. The only workaround inside of AWS if you wish to use the Directory Copy method above is to add debug logging for Crowd in the instance in the Crowd application's Administrator's UI.
- Login to Crowd as an Administrator
- Navigate to the Logging and Profiling section as shown:
Next, set the packages com.atlassian.crowd and the root logger to DEBUG and click the Update logging button:
The system will show the progression of the Directory Copy in the logs, as this will continue in background, but the Administrator's UI will present the message that was previously noted.
The directory copy will succeed, but the Admin UI will not show the completion due to the ALB timeout of 4000 seconds, which is a little over one hour and six minutes.
You can setup a second directory without using the Directory Copy feature. This will prevent the issue from occurring.