# Configure Crowd Integration

Only available in Sonatype Nexus RepositoryTM Pro. Interested in a free trial? [Start here](/content/products/repository-pro/trial/index.html).

To administrate Nexus Repository Crowd configuration via capability, you need the `nx-capabilities` privilege assigned to your user. To access the Atlassian Crowd panel `nx-crowd` privilege is needed.

## Enable the Crowd Capability

Follow the below steps to enable the Crowd Integration:

1. Select _Capabilities_ to open the _Capabilities_ panel, located in the _Settings_ menu under _System_

2. Click the _Create capability_ button to get to the _Select Capability Type_ table

3. Select _Crowd_ to open the _Create Crowd Capability_ panel

4. Complete the form by entering the _Crowd Server URL_ and the _Application Name_ and _Application Password_ that correspond to your Crowd application

This form also includes an option to _Use the Nexus Repository truststore_. You would check this box if you configured and want to manage Crowd with the HTTPS protocol.

After you create the capability, you will see the _Enable Crowd_ box checked automatically in the _Atlassian Crowd_ panel in the Settings menu under _Security_. Further, you can see the _Crowd server URL_, _Crowd application name_ and _Crowd application password,_ all automatically filled in. Additionally, you can configure _Connection timeout_, a value that specifies the number of seconds the repository manager will wait for a response from Crowd. A value of zero indicates that there is no timeout limit. Leave the field blank to use the default timeout.

You can use the _Verify Connection_ button to confirm your connection to Crowd is working. Pressing _Save_ will save any changes made to the Crowd configuration.

|     |
| --- |
|  |

## Trust Crowd’s Secure URL (Optional)

Although optional, we advise the connection from Nexus Repository to your Crowd server to use the HTTPS protocol.

If the Crowd certificate is not signed by a public certificate authority, you may have to explicitly trust the server certificate. A common symptom observed is the `peer not authenticated` message when trying to connect to the untrusted Crowd server.

### Adding the Crowd Server Certificate to the Truststore

To add the server certificate of your Crowd server to the truststore, go to _SSL Certificates_, located under _Security_ in the Settings menu. In the _SSL Certificates_ panel click the _Load Certificate_ button, which prompts a dropdown menu with two options:

- _Load from server_: where you can enter the full `https://` URL from the Crowd server
- _Paste PEM_: where you can enter an encoded, remote certificate generated from Crowd

Read more about centralizing [SSL certificates](https://help.sonatype.com/en/configuring-ssl.html#outbound-ssl---trusting-ssl-certificates-globally "Outbound SSL - Trusting SSL Certificates Globally") to the Nexus Repository in [Access Control](https://help.sonatype.com/en/access-control.html "Access Control").

## Configure Crowd Security

There are two approaches available to manage privileges a Crowd user has when they login to the Nexus Repository. You can map Crowd groups to roles or map Crowd users to roles.

Mapping Crowd groups to roles results in less maintenance by Nexus Repository administrators while keeping your users centrally managed inside of Crowd.

### Mapping a Crowd Group to Roles

When mapping a Crowd group to a role, you are specifying the permissions (via roles) that users within the Crowd group will have after they authenticate.

To map a Crowd group to a role, open the _Roles_ panel by clicking on the _Roles_ link under _Security_ in the Settings panel. Click on _Create role_ button, select _External Role Mapping_, then click _Crowd_. This will take you _Create Role_ panel, as mentioned in [Roles](https://help.sonatype.com/en/roles.html "Roles").

After choosing the Crowd realm, the Role drop-down should list all the Crowd groups to which the Crowd application has access. Select the group you would like to map in the _Role_ field.

If you have two or more groups in a Crowd application with identical names but in different directories, the repository manager will only list the first one that Crowd finds. Therefore, Crowd administrators should avoid identically named groups in Crowd directories.

Before you save, you must add at least one role or privilege to the mapped group. After you have them added using the `>` button or drag and drop to the _Contained_ or _Given_ areas (respectively), click the _Save_ button.

Saved mappings will appear in the list of roles with a mapping value of _Crowd_.

### Mapping a Crowd User to Roles

Consider the Crowd server user with an id of `johnsmith`. In the Crowd administrative interface, the `johnsmith` Crowd realm user is a member of both _dev_ and _crowd-administrators_ groups.

To add an external user go to the Settings menu, then select _Users_ in the _Security_ section.

Click the _Source_ dropdown button and select _Crowd_. To search for users from the Crowd realm you can either enter an individual username within the filter box or click the magnifying glass icon to generate the list of all users from the Crowd realm.

When the name you entered appears, click on the row of the name you desire to create the mapping for. This will take you to a form where you can assign available roles. You must map at least one role to the Crowd managed user in order to _Save_.

## Search results

No results found.