Documentation for Crowd 1.6. Documentation for other versions of Crowd is available too.
A Delegated Authentication directory combines the features of an internal Crowd directory with delegated LDAP authentication. This means that you can have your users authenticated via an external LDAP directory while managing the users, groups and roles in Crowd. You can use Crowd's flexible and simple group management when the LDAP groups do not suit your requirements. For example, you can set up a simple group configuration in Crowd for use with Confluence and other Atlassian products, while authenticating your users against the corporate LDAP directory. You can also avoid the performance issues which might result from downloading large numbers of groups from LDAP.
The diagram below gives a conceptual overview of delegated LDAP authentication. This example assumes that you have:
- The Confluence application integrated with Crowd.
- A Crowd Delegated Authentication directory called 'Employees' which contains the group 'confluence-users'.
- An LDAP directory containing all your employees and their authentication details (e.g. username and password).
Summary of Configuration Steps
To configure a Delegated Authentication directory,
- Log in to the Crowd Administration Console.
- Click the 'Directories' link in the top navigation bar.
- This will display the Directory Browser. Click the 'Add Directory' link.
- This will display the 'Select Directory Type' screen. Click the 'Delegated Authentication' button.
- This will display the 'Details' tab (see Screenshot 1 below). Enter the 'Name' and 'Description' fields, then click the 'Continue' button.
- This will display the 'Connector' tab (see Screenshot 2 below). Select the relevant connector type, and fill in the basic connection information for your directory server. For details, please see:
- Click the 'Test Connection' button to verify that Crowd can successfully connect to the directory.
- Click the 'Continue' button.
- This will display the 'Configuration' tab (see Screenshot 3 below). Fill in the configuration details for your users.
- Click the 'Continue' button to configure the directory's permissions.
Configuring Directory Details
Screenshot 1: Directory details
Attribute |
Description |
|---|---|
Name |
The name used to identify the directory within Crowd. For example: 'Chicago Employees' or 'Web Customers'. |
Description |
More information about this directory. |
Active |
Only deselect this if you wish to prevent all users within the directory from accessing all mapped applications. |
Configuring Connector Details
Screenshot 2: Connector
Attribute |
Description |
|---|---|
Connector |
The directory connector to use when communicating with the directory server. |
URL |
The connection URL to use when connecting to the directory server, e.g.: |
Secure SSL |
Specifies whether the connection to the directory server is an SSL connection. |
Use Node Referrals |
Use the JNDI lookup java.naming.referral option. Generally needed for Active Directory servers configured without proper DNS, to prevent a 'javax.naming.PartialResultException: Unprocessed Continuation Reference(s)' error. |
Use Nested Groups |
Enable or disable support for nested groups on the LDAP user directory. |
Use the User Membership Attribute |
Put a tick in the checkbox if your Active Directory supports the group membership attribute on the user. (By default, this is the 'memberOf' attribute.)
|
Use 'memberOf' for Group Membership |
Put a tick in the checkbox if your Active Directory supports the 'memberOf' attribute on the user.
|
Use Paged Results |
Use the LDAP control extension for simple paging of search results. Retrieves chunks of data rather than all of the search results at once. This feature may be necessary when using Microsoft Active Directory if more than 999 results are returned for any given search. |
Paged Results Size |
Enter the desired page size i.e. the maximum number of search results to be returned per page, when paged results are enabled. Defaults to 999 results. |
Use Relaxed DN Standardisation |
This setting determines how Crowd will compare DNs to determine if they are equal. See Configuring Relaxed DN Standardisation.
|
Enable Caching |
Put a tick in the checkbox to enable directory caching. Directory caching can provide fast recurrent access to user, group and role data for a particular directory. This can provide significant performance improvements for applications such as JIRA, which require large amounts of user information. Please read the full instructions: Configuring Caching for an LDAP Directory. |
Max Cache Elements in Memory |
This checkbox appears if 'Enable Caching' is ticked. Specify the maximum number of cache elements to be held in memory before overflowing to disk. Please read the full instructions: Configuring Caching for an LDAP Directory. |
Polling Interval |
This checkbox appears if 'Enable Caching' is ticked. Crowd will send a request to Active Directory every x seconds, where 'x' is the number specified here. Please read the full instructions: Configuring Caching for an LDAP Directory. |
Base DN |
Enter the root distinguished name to use when running queries versus the directory server, e.g.: |
User DN |
Distinguished name of the user that Crowd will use when connecting to the directory server. |
Password |
The password that Crowd will use when connecting to the directory server. |
We have shown the settings for Active Directory. For details about the settings for your specific directory server, please see:
- Apache Directory Server (ApacheDS)
- Apple Open Directory
- Fedora Directory Server
- Generic LDAP Directories
- Microsoft Active Directory
- Novell eDirectory
- OpenDS
- OpenLDAP
- OpenLDAP Using Posix Schema
- Posix Schema for LDAP
- Sun Directory Server Enterprise Edition (DSEE)
Configuring LDAP Object and Attribute Settings
Screenshot 3: Configuration
Attribute |
Description |
|---|---|
User DN |
This value is used in addition to the base DN when searching and loading users. An example is |
User Object Class |
This is the name of the class used for the LDAP user object. |
User Object Filter |
The filter to use when searching user objects. |
User Name Attribute |
The attribute field to use when loading the username. |
User First Name Attribute |
The attribute field to use when loading the user's first name. |
User Last Name Attribute |
The attribute field to use when loading the user's last name. |
User Email Attribute |
The attribute field to use when loading the user's email address. |
User Group Attribute |
The attribute field to use when loading the user's groups. |
User Password Attribute |
The attribute field to use when loading a user's password. |
Please refer to the notes on LDAP object structures in the page about LDAP connectors.
Next Steps
Once you have configured the directory's permissions, you have finished configuring your new directory.
Next steps will be:
- Map the directory to the appropriate applications.
- Consider how you would like to add your users to Crowd's Delegated Authentication directory. There are a few options:
- Manually add the users to the Crowd directory.
- Use Crowd's Directory importer to copy your LDAP users into your Delegated Authentication directory.
- Let Crowd do it for you, at login time. If a user logs in successfully via LDAP authentication but does not yet exist in Crowd, Crowd will automatically add them to the Delegated Authentication directory. You will then need to add the user to any necessary groups, to allow them to access applications where group membership is required.
Things to be aware of
- The username must be the same in the Crowd Delegated Authentication directory and in the LDAP directory. Changing the username in LDAP will break the link to the Crowd Delegated Authentication directory.
- You may encounter problems if you alternate between LDAP and Delegated Authentication directories.
RELATED TOPICS
Overview
Content Tools
Apps
Except where otherwise noted, content in this space is licensed under a Creative Commons Attribution 2.5 Australia License.