To connect Fisheye to Crowd:

1. Log in as a user with 'Admin' permission.
2. In the Fisheye administration area, click User Directories (under 'Security Settings').
3. Click Add Directory and select Atlassian Crowd.
4. Enter settings, as described below.
5. Test and save the directory settings.
6. Define the directory order, on the Directories tab, by clicking the blue up- and down-arrows next to each directory. The directory order has the following effects:
   • The order of the directories is the order in which they will be searched for users and groups.
   • Changes to users and groups will be made only in the first directory where the application has permission to make changes.

Server settings

Crowd permissions

Fisheye offers Read Only permissions for Crowd directories. The users, groups and memberships in Crowd directories are retrieved from Crowd and can only be modified from Crowd. You cannot modify Crowd users, groups or memberships using the Fisheye administration screens.

Advanced settings

Single sign-on (SSO) with Crowd

Once the Crowd directory has been set up, you can enable or disable Crowd SSO integration by adding the following setting to your $FISHEYE_INST/config.xml file (you can create missing xml nodes if they don't exist yet). SSO is disabled by default, if not configured in config.xml.

<config>
...
	<security allow-anon="false" allow-cru-anon="false">
        <built-in>
                <signup enabled="true"/>
        </built-in>
        <crowd sso-enabled="true"/>
        <admins>
                <system-admins>
                        <group>confluence-users</group>
                </system-admins>
        </admins>
        <avatar><disabled/></avatar>
        <emailVisibility/>
    </security>
...
</config>

Note that you will need to correctly set up the domains of the applications involved in SSO. See Crowd SSO Domain examples.

Configuring SSO Domain

• If you want the SSO cookie to be set to the domain that requests are made from, no more configuration is needed. 

• If the SSO cookie domain is configured in Crowd, Fisheye & Crucible will automatically retrieve this configuration. The following log in Fisheye & Crucible will show this:

  INFO [Crowd SSO] Received cookie configuration (cookie name: crowd.token_key, domain: .example.com) for directory: MyCrowd.

  , or when the value was changed (visible on next SSO user request, 60 seconds after the configuration change was done): 

  INFO [Crowd SSO] Updating cookie configuration for directory: MyCrowd. Domain changed from: .example.com to .internal.example.com.

• If the SSO cookie domain has to be overridden on the Fisheye & Crucible side (multiple groups of SSO applications using a single Crowd) configure it by system properties or environment properties:

  1. System property:  crowd.property.cookie.domain

     -Dcrowd.property.cookie.domain=.internal.example.com

  2. Environment property:  CROWD_PROPERTY_COOKIE_DOMAIN

     CROWD_PROPERTY_COOKIE_DOMAIN=.internal.example.com

     together with system property enabling configuration via environment properties: atlassian.use.environment.variables

     -Datlassian.use.environment.variables=true

Note that the same applies to other Crowd properties.

-Datlassian.use.environment.variables=true

crowd.property.application.password

crowd.property.application.login.url            

crowd.property.cookie.tokenkey

crowd.property.session.tokenkey

crowd.property.session.lastvalidation        

crowd.property.session.validationinterval

crowd.property.http.proxy.host

crowd.property.http.proxy.port

crowd.property.http.proxy.username

crowd.property.http.proxy.password

crowd.property.http.max.connections

crowd.property.http.timeout     

crowd.property.socket.timeout             

crowd.property.cookie.domain

Using multiple directories

When Fisheye is connected to Crowd you can map Fisheye to multiple user directories in Crowd.

For Crowd 2.8, and later versions, there are two different membership schemes that Crowd can use when multiple directories are mapped to an integrated application, and duplicate user names and group names are used across those directories. The schemes are called 'aggregating membership' and 'non-aggregating membership' and are used to determine the effective group memberships that Fisheye uses for authorization. See Effective memberships with multiple directories for more information about these two schemes in Crowd.

Note that:

• Authentication, for when Fisheye is mapped to multiple directories in Crowd, only depends on the mapped groups in those directories – the aggregation scheme is not involved at all. 
• For inactive users, Fisheye only checks if the user is active in the first (highest priority) directory in which they are found to determine authentication. The membership schemes described above are not used when Crowd determines if a user should have access to Fisheye.
• When a user is added to a group, they are only added to the first writeable directory available, in priority order.
• When a user is removed from a group, they are only removed from the group in the first directory the user appears in, when non-aggregating membership is used. With aggregating membership, they are removed from the group in all directories the user exists in.

An administrator can set the aggregation scheme that Fisheye uses when integrated with Crowd. Go to the Directories tab for the Fisheye instance in Crowd, and check Aggregate group memberships across directories to use the 'aggregating membership' scheme. When the checkbox is clear 'non-aggregating membership' is used.

Note that changing the aggregation scheme can affect the authorization permissions for your Fisheye users, and how directory update operations are performed.