Uploaded image for project: 'Crowd Data Center'
  1. Crowd Data Center
  2. CWD-432

Client applications should only see groups which have been allocated to them

    • Our product teams collect and evaluate feedback from a number of different sources. To learn more about how we use customer feedback in the planning process, check out our new feature policy.

      Atlassian Status as of 31 October 2013

      Hi everyone,

      Thank you for your votes and comments on this improvement request. Whilst this is something we would like to implement some day, it is not at the forefront of our upcoming backlog.

      We will be focussing on improving the integration of Crowd within our Atlassian suite of products, as well as simplifying and improving the overall user management and a unified administrative experience.

      If our backlog changes and this improvement request becomes a priority, this ticket will be updated. If you'd like to better understand how we make roadmap decisions, have a read of : https://confluence.atlassian.com/display/DEV/Implementation+of+New+Features+Policy

      Cheers, Helen Hung
      Atlassian Product Management

      Currently, a client application can "see" all the groups in the directories configured for that application.

      Ideally, if Allow All To Authenticate on a directory is set to False, only the configured groups should be visible to the application. If Allow All To Authenticate on a directory is set to True, then the current behaviour of retrieving all groups is acceptable.

            [CWD-432] Client applications should only see groups which have been allocated to them

            The feature has been already released in Crowd 4.4:

            https://confluence.atlassian.com/crowd/crowd-4-4-release-notes-1087517293.html

            Pawel Gruszczynski (Inactive) added a comment - - edited The feature has been already released in Crowd 4.4: https://confluence.atlassian.com/crowd/crowd-4-4-release-notes-1087517293.html

            Same with me!

            Florian Reichl added a comment - Same with me!

            Kumaran added a comment -

            I can understand that this feature request is on backlog for 13 years now. With growing user base and big companies working on large scale, plugins, custom fields look ups on large group set and membership of all groups impact performance of atlassian tools. I would strongly ask the current product manager to consider implementing this feature. Thank you !

            Kumaran added a comment - I can understand that this feature request is on backlog for 13 years now. With growing user base and big companies working on large scale, plugins, custom fields look ups on large group set and membership of all groups impact performance of atlassian tools. I would strongly ask the current product manager to consider implementing this feature. Thank you !

            Same issue at our end also. We have integrated Crowd with JIRA, Jira Service Desk, Confluence & Bitbucket. What we now see is that all groups configured in Crowd is visible in all applications which is not required. This causes confusion among Atlassian Administrators who are distributed across various locations. Appreciate if it can be fixed.

            Anurag Jalan added a comment - Same issue at our end also. We have integrated Crowd with JIRA, Jira Service Desk, Confluence & Bitbucket. What we now see is that all groups configured in Crowd is visible in all applications which is not required. This causes confusion among Atlassian Administrators who are distributed across various locations. Appreciate if it can be fixed.

            This is definitely affecting us as Expert Partners. Crowd potentially saves us a lot of time when setting up demos or training instances for clients. The best case to avoid this is to use a directory per isolated group of applications, but we then need to make duplicate accounts for ourselves. It also clutters the user directories on our client facing sites.

            We would be very excited to see this fixed, and would make it easier to recommend Crowd to our enterprise clients as well.

            Majken Connor added a comment - This is definitely affecting us as Expert Partners. Crowd potentially saves us a lot of time when setting up demos or training instances for clients. The best case to avoid this is to use a directory per isolated group of applications, but we then need to make duplicate accounts for ourselves. It also clutters the user directories on our client facing sites. We would be very excited to see this fixed, and would make it easier to recommend Crowd to our enterprise clients as well.

            We have several Atlassian stacks that consist of Jira, Confluence, and Stash. It would be preferable to use only one Crowd server, however, every application shows every user available in Crowd and not just the users that belong to the groups that are allowed to log into the specific application instance. Also, every application shows every group configured in Crowd and not just the groups allowed to log into that application. This leads to a great deal of clutter and potential management headaches when scaling beyond a single stack and a few hundred users.

            Michelle Fritch added a comment - We have several Atlassian stacks that consist of Jira, Confluence, and Stash. It would be preferable to use only one Crowd server, however, every application shows every user available in Crowd and not just the users that belong to the groups that are allowed to log into the specific application instance. Also, every application shows every group configured in Crowd and not just the groups allowed to log into that application. This leads to a great deal of clutter and potential management headaches when scaling beyond a single stack and a few hundred users.

            Hi everyone,

            Just letting you know that we've updated the current Atlassian status in the description of this issue, and you should go check it out!

            Eugene Mak
            Atlassian Product Management

            Eugene Mak [Atlassian] added a comment - Hi everyone, Just letting you know that we've updated the current Atlassian status in the description of this issue, and you should go check it out! Eugene Mak Atlassian Product Management

            Hi Andy,

            Assigning a group to an application means that only the users in that group will be able to successfully authenticate. It has no other function.

            Cheers,
            Dave.

            David O'Flynn [Atlassian] added a comment - Hi Andy, Assigning a group to an application means that only the users in that group will be able to successfully authenticate. It has no other function. Cheers, Dave.

            Can someone clarify what the point is of CROWD providing features to associate groups with applications if all groups in the CROWD directory are visible to client apps? Does this association in CROWD do anything at all?

            Andy Brook (Javahollic Software) added a comment - Can someone clarify what the point is of CROWD providing features to associate groups with applications if all groups in the CROWD directory are visible to client apps? Does this association in CROWD do anything at all?

            Another reason why this should be optional:

            Jira craps all over itself when it expects a user to exist and it doesn't. This means that removing users from the system screws everything up. The way we handle this is to create a separate OU for Disabled Users, we don't allow them to log in but we let Jira see them.

            If Jira were smarter about this, this issue could potential be fixed but until then, fixing this issue will introduce regressions in work arounds for an already broken set of features.

            Eric Anderson added a comment - Another reason why this should be optional: Jira craps all over itself when it expects a user to exist and it doesn't. This means that removing users from the system screws everything up. The way we handle this is to create a separate OU for Disabled Users, we don't allow them to log in but we let Jira see them. If Jira were smarter about this, this issue could potential be fixed but until then, fixing this issue will introduce regressions in work arounds for an already broken set of features.

              Unassigned Unassigned
              shamid@atlassian.com shihab
              Votes:
              60 Vote for this issue
              Watchers:
              41 Start watching this issue

                Created:
                Updated:
                Resolved: