Integrating Crowd with Atlassian Bamboo
This page tells you how to connect Atlassian's Bamboo integration server to one or more directory servers through Crowd.
Currently Crowd supports centralized authentication and single sign-on for Bamboo versions 1.2.2 and later.
このドキュメントがご利用の Crowd バージョンに適用されるかどうかをご確認ください
このドキュメントの Crowd リリース番号をご利用の Crowd バージョンと確認してください。Crowd の異なるバージョンを使用している場合、Crowd ドキュメントのホームページの「以前のバージョン」から適切なドキュメントを見つけることができます。
Prerequisites
Due to incompatible atlassian-user libraries, Bamboo releases prior to 1.2.2 are not compatible with latest version of Crowd. Please upgrade to the latest version of Bamboo before attempting to integrate Crowd.
1 つの Tomcat コンテナに複数のアトラシアン アプリケーションをデプロイしないでください。
弊社では、多くの実用的な理由から、複数のアトラシアンアプリケーションを単一の Tomcat コンテナーにデプロイするサポートは行っておりません。第一に、アプリケーションをアップグレードするには Tomcat をシャットダウンする必要があります。第二に、1つのアプリケーションがクラッシュすると、その Tomcat コンテナーで実行中のその他のアプリケーションにアクセスできなくなります。
したがって、Crowd を実行する Tomcat コンテナ内に他のアプリケーションをデプロイすることは推奨されません。このような他のアプリケーションが大容量のメモリを必要としたり、Tomcat の lib
サブディレクトリ内に追加のライブラリを必要とする場合は特に推奨されません。
- Crowd をダウンロードしてインストールします。手順については「Crowd インストール ガイド」をご参照ください。ここでは Crowdルート フォルダを
CROWD
とします。 - Download and install Bamboo (version 1.2.2 or later). Refer to the Bamboo installation guide for instructions. We will refer to the Bamboo root folder as
BAMBOO
. For the purposes of this document, we will assume that you have used the Crowd distribution (not EAR-WAR) (ie. the easier) installation method of Bamboo. If you need to install Bamboo as an EAR/WAR, simply explode the EAR/WAR and make the necessary changes as described below, then repackage the EAR/WAR. - Run the Bamboo Setup Wizard, as described in the Bamboo documentation. During this setup process, you will define the Bamboo administrator's username and password. It is easier to do this before you integrate Bamboo with Crowd.
- After you have installed and set up Bamboo, shut Bamboo down before you begin the integration process described below.
Step 1. Configuring Crowd to Talk to Bamboo
1.1 Prepare Crowd's Directories/Groups/Users for Bamboo
- Create a Crowd directory: The Bamboo application will need to authenticate users against a directory configured in Crowd. You will need to set up a directory in Crowd for Bamboo. For more information on how to do this, see Adding a Directory. We will assume that the directory is called Crowd Bamboo Directory for the rest of this document. It is possible to assign more than one directory for an application, but for the purposes of this example, we will use Crowd Bamboo Directory to house Bamboo users.
- Add users and groups: You can either import them from your Bamboo deployment or add them manually.
- Importing users and groups from Bamboo: If you have an existing Bamboo deployment and would like to import existing users and groups into Crowd, use the Bamboo Importer tool by navigating to Users > Import Users > Atlassian Importer. Select 'Bamboo' as the Atlassian Product and the Crowd Bamboo Directory as the directory into which Bamboo users will be imported. For details please see Importing Users from Atlassian Bamboo. If you are going to import users into Crowd, you need to do this now, before you proceed any further.
- Adding users and groups manually: Bamboo needs an administrative group to exist in the directory in order to access the administration features. You can also create an optional additional group for other users. Create the groups in the Crowd Bamboo Directory:
bamboo-admin
bamboo-user
(optional)
See the documentation on Creating Groups for more information on how to define these groups.- Create at least one user in the Crowd Bamboo Directory and assign the user(s) to both the
bamboo-user
and thebamboo-admin
groups. The Crowd documentation has more information on creating groups, creating users and assigning users to groups.
1.2 Define the Bamboo Application in Crowd
Crowd needs to be aware that the Bamboo application will be making authentication requests to Crowd. We need to add the Bamboo application to Crowd and map it to the Crowd Bamboo Directory:
- Crowd Administration Console にログインし、[Applications] > [Add Application] に移動します。
- Complete the 'Add Application' wizard for the Bamboo application. See the instructions. The Name and Password values you specify in the 'Add Application' wizard must match the application.name and application.password that you will set in the
crowd.properties
file. You can find thecrowd.properties
file in eitherBamboo/webapp/WEB-INF/classes/
(Bamboo 3.1 and earlier) or$BAMBOO_HOME/xml-data/configuration
(Bamboo 3.2 or later). See Step 2 below.
1.3 Specify which Users can Log In to Bamboo
Once Crowd is aware of the Bamboo application, Crowd needs to know which users can authenticate (log in) to Bamboo via Crowd. As part of the 'Add Application' wizard, you will set up your directories and group authorizations for the application. If necessary, you can adjust these settings after completing the wizard. Below are some examples.
You can either allow entire directories to authenticate, or just particular groups within the directories. In our example, we will allow the bamboo-user
and bamboo-admin
groups within the Crowd Bamboo Directory to authenticate:
If you are not using a bamboo-user
group as a security restriction, you will need to set 'Allow all to authenticate' to 'true' when mapping the directory, otherwise only bamboo-admin
group members will be able to log in to Bamboo.
1.4 Specify the Address from which Bamboo can Log In to Crowd
As part of the 'Add Application' wizard, you will set up Bamboo's IP address. This is the address which Bamboo will use to authenticate to Crowd. If necessary you can add a hostname, in addition to the IP address, after completing the wizard. See Specifying an Application's Address or Hostname.
Step 2. Configuring Bamboo to Talk to Crowd
Before you begin Step 2
- If you are using Bamboo 3.2 or later, please refer to the Bamboo instructions on Integrating Bamboo with Crowd and skip Step 2 (and all sub-steps) on this page.
- If your Bamboo version is earlier than 1.2.2, please upgrade to the latest stable version of Bamboo.
2.1 Install the Crowd Client Libraries into Bamboo
Bamboo needs Crowd's client libraries in order to be able to delegate user authentication to the Crowd application. In some cases, you will need to modify the Bamboo application, which is stored in BAMBOO/webapp
.
- Please check your versions of Crowd and Bamboo:
- If you are using Bamboo 1.2.2 to 1.2.4, you will need to update the Bamboo libraries as described in this step below.
- If you are using Bamboo 2.0 or later, the Crowd client libraries and
crowd.properties
file are included in the Bamboo 2.0 installation download. Please check if your version of Crowd is the same version as the Crowd client library included in the Bamboo 2.x.x installation download (e.g. Bamboo 2.0 currently includes the client library for Crowd 1.3).- If the Crowd library versions are different, you will need to update the Bamboo libraries as described in this step below.
- If the Crowd library versions are the same, you can skip this step.
- Please, copy
CROWD/client/crowd-integration-client-X.X.X.jar
intoBAMBOO/webapp/WEB-INF/lib
directory. - If you are using the Crowd WAR distribution, then you will need to get the CROWD client libraries from the Crowd distribution, available on our download site.
Copy the Crowd client libraries and configuration files to Bamboo:
Copy From
Copy To
CROWD/client/crowd-integration-client-X.X.X.jar
BAMBOO/webapp/WEB-INF/lib (No need to copy any crowd .jar files over for the latest Bamboo versions (after 4.0) as they already contain the needed jar files to work with Crowd)
CROWD/client/conf/crowd.properties
BAMBOO/webapp/WEB-INF/classes (Bamboo 3.1 and earlier) or $BAMBOO_HOME/xml-data/configuration (Bamboo 3.2 or later)
CROWD/client/conf/crowd-ehcache.xml
BAMBOO/webapp/WEB-INF/classes (Bamboo 3.1 and earlier) or $BAMBOO_HOME/xml-data/configuration (Bamboo 3.2 or later)
- For Bamboo 1.2.4 only: You will need to remove the
seraph-0.7.23.jar
file from Bamboo'sWEB-INF/lib/
directory and replace it with the following file:
http://repository.atlassian.com/maven2/com/atlassian/seraph/atlassian-seraph/0.10/atlassian-seraph-0.10.jar
(Note: the 0.10 version of the Seraph JAR is newer than 0.7.23.)
2.2 Edit Bamboo's crowd.properties file
Configure the Bamboo application's properties to determine how Crowd will interact with Bamboo.
Edit
crowd.properties
found inBAMBOO/webapp/WEB-INF/classes
(Bamboo 3.1 and earlier) or$BAMBOO_HOME/xml-data/configuration
(Bamboo 3.2 or later). Change the following properties:キー
値
application.name
bamboo
The application.name and application.password must match the Name and Password that you specified when defining the application in Crowd (see Step 1 above).application.password
The application.name and application.password must match the Name and Password that you specified when defining the application in Crowd (see Step 1 above).
crowd.server.url
http://localhost:8095/crowd/services/
If your Crowd server's port is configured differently from the default (8095), set it accordingly.session.validationinterval
Set to 0, if you want authentication checks to occur on each request. Otherwise set to the number of minutes between requests to validate if the user is logged in or out of the Crowd SSO server. Setting this value to 1 or higher will increase the performance of Crowd's integration.
オプション設定の詳細については「crowd.properties ファイルについて」をご参照ください。
2.3 Configure Bamboo to use Crowd's Authenticator
Now that the Crowd client libraries exist, we need to configure Bamboo to use them.
Edit the
atlassian-user.xml
file (found inBAMBOO/webapp/WEB-INF/classes
(Bamboo 3.1 and earlier) or$BAMBOO_HOME/xml-data/configuration
(Bamboo 3.2 or later)) so that the contents of the file is:<atlassian-user> <repositories> <crowd key="crowd" name="Crowd Repository"/> </repositories> </atlassian-user>
- At this stage, Bamboo is set up for centralized authentication. If you wish to enable single sign-on (SSO) to Bamboo, refer to section 2.5 of this document.
2.4 Configure External User Management in Bamboo
For Bamboo to integrate successfully with Crowd, Bamboo's 'External User Management' option needs to be:
- Checked if you are using an LDAP directory with Crowd and you don't have write-access in LDAP.
- Unchecked if you are using internal Crowd directories, or Crowd with LDAP where you do have write-access.
- Unchecked if you are using a Delegated Authentication directory.
詳細情報:
- Please ignore the wording on some versions of the Bamboo screens, which may imply that you should check this option.
- In later versions of Bamboo, the option will be called 'Read-Only External User Management'.
- Refer to the Bamboo documentation for full details of Bamboo's external management configuration.
2.5 (Optional) Enable Single Sign-On
SSO is optional
Single sign-on (SSO) is optional when integrating Bamboo and other Atlassian products with Crowd. To use centralized authentication without SSO, skip the steps below.
To enable single sign-on (SSO), you will configure Bamboo's authentication and access request calls to use Seraph. To configure Seraph-based authentication:
- Edit the
\BAMBOO\webapp\WEB-INF\classes\seraph-config.xml
Comment out the
authenticator
node :<!--<authenticator class="com.atlassian.bamboo.user.authentication.BambooAuthenticator"/>-->
Please, uncomment the authenticator "
com.atlassian.crowd.integration.seraph.v25.BambooAuthenticator
":<!-- If you're authenticating against a Crowd server you can use this authenticator for single sign-on. Enable it after configuring your Crowd properties through user management and restart Bamboo. It does not support Crowd property changes at runtime. If you need to switch back to local users, revert the change and restart Bamboo again. --> <authenticator class="com.atlassian.crowd.integration.seraph.v25.BambooAuthenticator"/>
Bamboo's authentication and access request calls will now be performed using Seraph.
2.6 (Optional) Tune the Cache
When using the atlassian-user and Crowd framework together with Bamboo, it is highly recommended that caching be enabled. Multiple redundant calls to the atlassian-user framework are made on any given request. These results can be stored locally between calls by enabling caching via the Crowd Options menu. (Note that this caching in the Crowd application is enabled by default.)
Bamboo will obtain all necessary information for the period specified by the cache configuration - see Configuring Caching for an Application. If a change or addition occurs in Crowd to users, groups and roles, these changes will not be visible in Bamboo until the cache expires for that specific item (i.e. for the particular user, group or role).
The default value for the application cache is 5 minutes (300 seconds). To increase the performance of your application, consider changing the cache value to one or two hours (3600 or 7200 seconds).
Crowd の動作を確認する
Welcome to Bamboo with Crowd!
- Users belonging to the
bamboo-user
group should now be able to log in to Bamboo. Try adding a user to the group using Crowd — you should be able to log in to Bamboo using this newly created user. That's centralized authentication in action! - If you have enabled SSO, you can try adding the Crowd Bamboo Directory and
bamboo-admin
group to the crowd application (see Mapping a Directory to an Application and Specifying which Groups can access an Application). This will allow Bamboo administrators to log in to the Crowd Administration Console. Try logging in to Crowd as a Bamboo administrator, and then point your browser at Bamboo. You should be logged in as the same user in Bamboo. That's single sign-on in action!
関連トピック
- Using the Application Browser
- アプリケーションの追加
- Integrating Crowd with Atlassian Bamboo
- Integrating Crowd with Atlassian Confluence
- Integrating Crowd with Atlassian CrowdID
- Integrating Crowd with Atlassian Crucible
- Integrating Crowd with Atlassian FishEye
- Integrating Crowd with Atlassian JIRA
- Integrating Crowd with Atlassian Bitbucket Server
- Integrating Crowd with Acegi Security
- Integrating Crowd with Apache
- Disabling Previous Versions of the Crowd Apache Connector
- Installing the Crowd Apache Connector on CentOS Linux
- Installing the Crowd Apache Connector on Red Hat Enterprise Linux
- Installing the Crowd Apache Connector on Ubuntu Linux
- Installing the Crowd Apache Connector on Debian
- Installing the Crowd Apache Connector on Other UNIX-Like Systems
- Installing the Crowd Apache Connector on Windows
- Integrating Crowd with Jive Forums
- Integrating Crowd with Spring Security
- Integrating Crowd with Subversion
- Integrating Crowd with a Custom Application
- Integrating Crowd with Atlassian HipChat
- Configuring the Google Apps Connector
- Mapping a Directory to an Application
- Effective memberships with multiple directories
- Specifying an Application's Address or Hostname
- Testing a User's Login to an Application
- Enforcing Lower-Case Usernames and Groups for an Application
- Managing an Application's Session
- Deleting or Deactivating an Application
- Configuring Caching for an Application
- Overview of SSO
- Configuring Options for an Application