The requirement to make this to work is to ensure the following are true:

• The person's username is in a user directory where all users are authorised to use Crowd. See the instructions below.
• The person is not a member of a group mapped to the 'crowd' application. (Group members will have Crowd administration rights.)

A customer comment:

Its quite counterintuitive that you add a directory with "allow all to auth" and then make sure not to map their group. Probably could clean up the messaging on the UI to make this clear.