Connecting Stash to Crowd

You can configure Stash to use Atlassian Crowd for user and group management, and for authentication and authorisation.

Atlassian Crowd is an application security framework that handles authentication and authorisation for your web-based applications. With Crowd you can integrate multiple web applications and user directories, with support for single sign-on (SSO) and centralised identity management. See the Crowd Administration Guide.

Connect to Crowd if you want to use Crowd to manage existing users and groups in multiple directory types, or if you have users of other web-based applications.

See also this information about deleting users and groups in Stash.

Connecting Atlassian Stash to your external directory is not sufficient to allow your users to log in to Stash. You must explicitly grant them access to Stash in the global permission screen.

We recommend that you use groups instead of individual accounts when granting permissions. However, be careful not to add more users to those groups that your Stash license allows. If the license limit is exceeded, your developers will not be able to push commits to repositories, and Stash will display a warning banner. See this FAQ.

このページの内容

To connect Stash to Crowd:

Log in as a user with 'Admin' permission.
In the Stash administration area, click User Directories (under 'Accounts').
Click Add Directory and select Atlassian Crowd.
Enter settings, as described below.
Test and save the directory settings.
Define the directory order, on the Directories tab, by clicking the blue up- and down-arrows next to each directory. The directory order has the following effects:
- ディレクトリの順序は、ユーザーおよびグループの検索順序です。
- ユーザーおよびグループへの変更は、アプリケーションが変更権限を持つ最初のディレクトリに対してのみ行われます。

サーバー設定

設定	説明
名前	ディレクトリサーバーの一覧でこの Crowd サーバーを識別するのに役立つよう、わかりやすい名前にします。例: `Crowd Data Center` `Example Company Crowd`
サーバー URL	Crowd コンソールサーバーのWeb アドレス。例: `http://www.example.com:8095/crowd/` `http://crowd.example.com`
アプリケーション名	The name of your application, as recognized by your Crowd server. Note that you will need to define the application in Crowd too, using the Crowd administration Console. See the Crowd documentation on adding an application.
アプリケーションパスワード	The password which the application will use when it authenticates against the Crowd framework as a client. This must be the same as the password you have registered in Crowd for this application. See the Crowd documentation on adding an application.

Crowd 権限

Stash offers Read Only permissions for Crowd directories. The users, groups and memberships in Crowd directories are retrieved from Crowd and can only be modified from Crowd. You cannot modify Crowd users, groups or memberships using the Stash administration screens.

For local Stash directories, Read Only and Read/Write permissions are available.

高度な設定

設定	説明
Enable Nested Groups	入れ子グループのサポートを有効または無効にします。入れ子グループを有効にする前に、Crowd のユーザーディレクトリで入れ子グループがサポートされているかどうかを確認します。入れ子グループが有効になっているときは、グループを別のグループのメンバーとして定義できます。グループを使用して権限を管理している場合、入れ子グループを作成して、1 つのグループからそのサブグループに権限を継承できます。
Enable Incremental Synchronization	インクリメンタル同期を有効または無効にします。ディレクトリの同期時には、前回の同期時以降の変更のみが取得されます。完全な同期はアプリケーションの再起動時に常に実行されます。
Synchronization Interval (minutes)	同期とは、アプリケーションがユーザーデータの内部ストアをディレクトリサーバ上のデータで更新するプロセスです。アプリケーションは x 分ごとにディレクトリサーバーにリクエストを送信します。x はここで指定する数値です。既定値は60分です。

Single sign-on (SSO) with Crowd

Once the Crowd directory has been set up, you can enable Crowd SSO integration by adding the following setting to shared/stash-config.properties in the Stash home directory (create this file if it doesn't exist yet):

stash-config.properties

# Whether SSO support should be enabled or not. Regardless of this setting SSO authentication 
# will only be activated when a Crowd directory is configured in Stash that is configured 
# for SSO.
plugin.auth-crowd.sso.enabled=true

Please note that you will need to correctly set up the domains of the applications involved in SSO. See Crowd SSO Domain examples.

In addition to this property, Crowd SSO integration can be tuned using the system properties described on Stash config properties.

Using multiple directories

When Stash is connected to Crowd you can map Stash to multiple user directories in Crowd.

For Crowd 2.8, and later versions, there are two different membership schemes that Crowd can use when multiple directories are mapped to an integrated application, and duplicate user names and group names are used across those directories. The schemes are called 'aggregating membership' and 'non-aggregating membership' and are used to determine the effective group memberships that Stash uses for authorisation. See Effective memberships with multiple directories for more information about these two schemes in Crowd.

注意:

Authentication, for when Stash is mapped to multiple directories in Crowd, only depends on the mapped groups in those directories – the aggregation scheme is not involved at all.
For inactive users, Stash only checks if the user is active in the first (highest priority) directory in which they are found to determine authentication. The membership schemes described above are not used when Crowd determines if a user should have access to Stash.
When a user is added to a group, they are only added to the first writeable directory available, in priority order.
When a user is removed from a group, they are only removed from the group in the first directory the user appears in, when non-aggregating membership is used. With aggregating membership, they are removed from the group in all directories the user exists in.

An administrator can set the aggregation scheme that Stash uses when integrated with Crowd. Go to the Directories tab for the Stash instance in Crowd, and check Aggregate group memberships across directories to use the 'aggregating membership' scheme. When the checkbox is clear 'non-aggregating membership' is used.

Note that changing the aggregation scheme can affect the authorisation permissions for your Stash users, and how directory update operations are performed.

ページツリー