Connecting JIRA to Crowd Throwing ApplicationPermissionException
Platform Notice: Data Center - This article applies to Atlassian products on the Data Center platform.
Note that this knowledge base article was created for the Data Center version of the product. Data Center knowledge base articles for non-Data Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Symptoms
- Crowd users are unable to login to JIRA.
- While testing the directory configuration, the below error is displayed on the configuration screen:
JIRA can use Crowd for user management: users, groups and authentication.
Connection test failed. Response from the server:
com.atlassian.crowd.exception.ApplicationPermissionException: <html»<head›<title»Apache Tomcat/6.0.32 - Error report</title><style><!-H1 (font-family: Tahoma, Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial, sans-serif;color:white;background-color:#525D76;font-size: 16px;) H3 (font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;) BODY {font-family: Tahoma, Arial, sans-serif;color:black;background-color:white;) B (font-family:Tahoma, Arial, sans-serif;color:white;background-color:#525D76;} P (font-family: Tahoma, Arial,sans-serif;background:white;color:black;font-size: 12px;)A (color: black;A.name (color: black;)HR {color: #525D76;)-></style> </head> <body><h1>HTTP Status 403 - Client with address " 127.0.0.1" is forbidden from making requests to the application, {2).</h1><HR size="1* noshade="noshade"> <p><b> type</b> Status report</p><p> <b>message</b> <u>Client with address " 127.0.0.1" is forbidden from making requests to the application, {2).</u></p> <p><b>description</b> <u›Access to the specified resource (Client with address " 127.0.0.1" is forbidden from making requests to the application, (2}.) has been forbidden.</u></p><HR size=*1* noshade="noshade><h3>Apache Tomcat/6.0.32</h3></body></html>
Additionally, the below exception will appear in the atlassian-jira.log:
2015-02-10 16:55:54,616 atlassian-scheduler-quartz1.clustered_Worker-2 WARN [directory.ldap.cache.EventTokenChangedCacheRefresher] Could not update event token.
com.atlassian.crowd.exception.OperationFailedException: com.atlassian.crowd.exception.ApplicationPermissionException: HTTP Status 403 - Client with address "123.123.123.123" is forbidden from making requests to the application, avengers.type Status reportmessage Client with address "123.123.123.123" is forbidden from making requests to the application, avengers.description Access to the specified resource (Client with address "123.123.123.123" is forbidden from making requests to the application, avengers.) has been forbidden.Apache Tomcat/6.0.32
at com.atlassian.crowd.directory.RemoteCrowdDirectory.getCurrentEventToken(RemoteCrowdDirectory.java:757)
at com.atlassian.crowd.directory.ldap.cache.EventTokenChangedCacheRefresher.synchroniseAll(EventTokenChangedCacheRefresher.java:54)
at com.atlassian.crowd.directory.DbCachingRemoteDirectory.synchroniseCache(DbCachingRemoteDirectory.java:1014)
at com.atlassian.crowd.manager.directory.DirectorySynchroniserImpl.synchronise(DirectorySynchroniserImpl.java:75)
at com.atlassian.jira.crowd.embedded.JiraDirectorySynchroniser.synchronizeDirectory(JiraDirectorySynchroniser.java:96)
at com.atlassian.jira.crowd.embedded.JiraDirectorySynchroniser.runJob(JiraDirectorySynchroniser.java:60)
at com.atlassian.scheduler.core.JobLauncher.runJob(JobLauncher.java:135)
at com.atlassian.scheduler.core.JobLauncher.launchAndBuildResponse(JobLauncher.java:101)
at com.atlassian.scheduler.core.JobLauncher.launch(JobLauncher.java:80)
at com.atlassian.scheduler.quartz1.Quartz1Job.execute(Quartz1Job.java:32)
at org.quartz.core.JobRunShell.run(JobRunShell.java:223)
at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:549)
Caused by: com.atlassian.crowd.exception.ApplicationPermissionException: HTTP Status 403 - Client with address "123.123.123.123" is forbidden from making requests to the application, avengers.type Status reportmessage Client with address "123.123.123.123" is forbidden from making requests to the application, avengers.description Access to the specified resource (Client with address "123.123.123.123" is forbidden from making requests to the application, avengers.) has been forbidden.Apache Tomcat/6.0.32
at com.atlassian.crowd.integration.rest.service.RestExecutor$MethodExecutor.throwError(RestExecutor.java:490)
at com.atlassian.crowd.integration.rest.service.RestExecutor$MethodExecutor.andReceive(RestExecutor.java:344)
at com.atlassian.crowd.integration.rest.service.RestCrowdClient.getCurrentEventToken(RestCrowdClient.java:1052)
at com.atlassian.crowd.directory.RemoteCrowdDirectory.getCurrentEventToken(RemoteCrowdDirectory.java:754)
... 11 more
Cause
This is caused by the difference in the IP addresses configured in Crowd and the IP addresses used by the JIRA instance which is connecting to the Crowd server.
This error message isn't very pretty, so we've raised an issue to get it fixed: JRASERVER-25598 - raw html displayed on user directory connection error
Resolution
- Login to the Crowd server and locate the Application administered for the JIRA instance.
- Switch to the Remote Addresses tab.
- Remove/Add the IP Addresses to match the IP Address of the JIRA server.
- If JIRA and Crowd are running on the same server, you may need to add both
localhostand127.0.0.1to the IP Address list. - If JIRA is configured to use a Proxy server, you may need to add this proxy server address to the IP Address list, or Exclude the Crowd Address from being proxied using the
*.nonProxyHostsargument.
- If JIRA and Crowd are running on the same server, you may need to add both
Re-test the connection to the Crowd from JIRA.
Please take a look at our Integrating Crowd with Atlassian Jira docs, specifically the section Define the JIRA Application in Crowd for more details on this configuration.