Documentation for Crowd 2.5. Documentation for other versions of Crowd is available too.

A Delegated Authentication directory combines the features of an internal Crowd directory with delegated LDAP authentication. This means that you can have your users authenticated via an external LDAP directory while managing the users and groups in Crowd. You can use Crowd's flexible and simple group management when the LDAP groups do not suit your requirements. Alternatively, you can have Crowd import users' group memberships from LDAP each time they authenticate.

For example, you can set up a simple group configuration in Crowd for use with Confluence and other Atlassian products, while authenticating your users against the corporate LDAP directory. You can also avoid the performance issues which might result from downloading large numbers of groups from LDAP.

重要

Delegated Authentication directories do not allow you to browse the LDAP data. The directory delegates user authentication to LDAP, but to be able to list users and groups, you will need to add them to the directory. See more details in the Next Steps section of this page.

The diagram below gives a conceptual overview of delegated LDAP authentication. This example assumes that you have:

  • The Confluence application integrated with Crowd.
  • A Crowd Delegated Authentication directory called 'Employees' which contains the group 'confluence-users'.
  • An LDAP directory containing all your employees and their authentication details (e.g. username and password).

Summary of Configuration Steps

To configure a Delegated Authentication directory,

  1. Log in to the Crowd Administration Console.
  2. Click the 'Directories' link in the top navigation bar.
  3. This will display the Directory Browser. Click the 'Add Directory' link.
  4. This will display the 'Select Directory Type' screen. Click the 'Delegated Authentication' button.
  5. This will display the 'Details' tab (see Screenshot 1 below). Enter the 'Name' and 'Description' fields, then click the 'Continue' button.
  6. This will display the 'Connector' tab (see Screenshot 2 below). Select the relevant connector type, and fill in the basic connection information for your directory server. For details, please see:
  7. Click the 'Test Connection' button to verify that Crowd can successfully connect to the directory.
  8. Click the 'Continue' button.
  9. This will display the 'Configuration' tab (see Screenshot 3 below). Fill in the configuration details for your users.
  10. Click the 'Test Search' button to verify that Crowd can successfully locate groups/users within the directory.
  11. Click the 'Continue' button to configure the directory's permissions.

Configuring Directory Details

Screenshot 1: Directory details

属性

説明

名前

The name used to identify the directory within Crowd. For example: 'Chicago Employees' or 'Web Customers'.

説明

More information about this directory.

アクティブ

Only deselect this if you wish to prevent all users within the directory from accessing all mapped applications. If a directory is not marked as 'Active', it is inactive. Inactive directories:

  • are not included when searching for users, groups or memberships.
  • are still displayed in the Crowd Administration Console screens.

Configuring Connector Details

Screenshot 2: Connector

属性

説明

Connector

The directory connector to use when communicating with the directory server.

URL

The connection URL to use when connecting to the directory server, e.g.:
Plain connection: ldap://localhost:389
SSL connection: ldaps://localhost:636

Secure SSL

Specifies whether the connection to the directory server is an SSL connection.

Use Node Referrals

Use the JNDI lookup java.naming.referral option. Generally needed for Active Directory servers configured without proper DNS, to prevent a 'javax.naming.PartialResultException: Unprocessed Continuation Reference(s)' error.

Use Nested Groups

Enable or disable support for nested groups on the LDAP user directory.

Synchronise User Details

Update users' details in Crowd from the LDAP directory each time they authenticate.

Synchronise Group Memberships

Update users' group memberships in Crowd from the LDAP directory each time they authenticate. Note that nested groups are not imported, and that groups are not imported if there is a locally-defined group of the same name.

Use the User Membership Attribute

This option appears only when "Synchronise Group Memberships" is checked. Put a tick in the checkbox if your Active Directory supports the group membership attribute on the user. (By default, this is the 'memberOf' attribute.)

  • If this checkbox is ticked, Crowd will use the group membership attribute on the user when retrieving the members of a given group. This will result in a more efficient retrieval.
  • If this checkbox is not ticked, Crowd will use the members attribute on the group ('member' by default) for the search.
  • If the 'Use Nested Groups' checkbox is ticked, Crowd will ignore the 'Use the User Membership Attribute' option and will use the members attribute on the group for the search.

ベース DN

Enter the root distinguished name to use when running queries versus the directory server, e.g.: o=acmecorp,c=com.

ユーザー DN

Distinguished name of the user that Crowd will use when connecting to the directory server.

パスワード

The password that Crowd will use when connecting to the directory server.

We have shown the settings for Active Directory. For details about the settings for your specific directory server, please see:

Configuring LDAP Object and Attribute Settings

Screenshot 3: User configuration

属性

説明

ユーザー DN

This value is used in addition to the base DN (distinguished name) when searching and loading users. An example is ou=Users. If no value is supplied, the subtree search will start from the base DN.

ユーザー オブジェクト クラス

This is the name of the class used for the LDAP user object. An example is user.

ユーザー オブジェクト フィルタ

The filter to use when searching user objects.

ユーザー名属性

The attribute field to use when loading the username. Examples are cn and sAMAccountName.

ユーザー名 RDN 属性

The RDN (relative distinguished name) to use when loading the username. An example is cn. The DN for each LDAP entry is composed of two parts: the RDN and the location within the LDAP directory where the record resides. The RDN is the portion of your DN that is not related to the directory tree structure.

ユーザの名属性

The attribute field to use when loading the user's first name. An example is givenName.

ユーザーの姓属性

The attribute field to use when loading the user's last name. An example is sn.

ユーザーの表示名属性

The attribute field to use when loading the user's full name. An example is displayName.

ユーザーのメール属性

The attribute field to use when loading the user's email address. An example is mail.

User Group Attribute

The attribute field to use when loading the user's groups. An example is memberOf. Please refer to the specific settings for group membership searches on the 'Connector' tab, as described above.

ユーザーのパスワード属性

The attribute field to use when loading a user's password. An example is unicodePwd.

Screenshot 4: Group configuration

属性

説明

Group DN

This value is used in addition to the base DN when searching and loading groups, an example is ou=Groups. If no value is supplied, the subtree search will start from the base DN.

グループ オブジェクト クラス

This is the name of the class used for the LDAP group object. Examples are groupOfUniqueNames and group.

グループ オブジェクト フィルター

The filter to use when searching group objects. An example is (objectCategory=Group).

グループ名属性

The attribute field to use when loading the group's name. An example is cn.

グループ説明属性

The attribute field to use when loading the group's description. An example is description.

グループ メンバー 属性

The attribute field to use when loading the group's members. An example is member. Please refer to the specific settings for group membership searches on the 'Connector' tab, as described above.

(info) Please refer to the notes on LDAP object structures in the page about LDAP connectors.

次のステップ

Once you have configured the directory's permissions, you have finished configuring your new directory.

Next steps will be:

  1. Map the directory to the appropriate applications.
  2. Consider how you would like to add your users to Crowd's Delegated Authentication directory. There are a few options:
    • Manually add the users to the Crowd directory.
    • Use Crowd's Directory importer to copy your LDAP users into your Delegated Authentication directory.
    • Let Crowd do it for you, at login time. If a user logs in successfully via LDAP authentication but does not yet exist in Crowd, Crowd will automatically add them to the Delegated Authentication directory. You will then need to add the user to any necessary groups, to allow them to access applications where group membership is required. If you have enabled the "Synchronise Group Memberships" option, groups and group memberships from LDAP will be automatically imported each time a user authenticates.

Same username required in Crowd and LDAP

The username must be the same in the Crowd Delegated Authentication directory and in the LDAP directory. Changing the username in LDAP will break the link to the Crowd Delegated Authentication directory.

関連トピック

Crowd Documentation



Log a request with our support team.



Raise an issue for our developers.



See answers from the community.



Blog and update our documentation.

Except where otherwise noted, content in this space is licensed under a Creative Commons Attribution 2.5 Australia License.