Has anyone used OKTA for user Authentication and AD for group Authorization for on-prem Confluence?

[Joe Birney]

Folks

our company traditionally has been using LDAP to authenticate the users and have their group information stored in AD.  The idea was they can use AD to self-manage their own groups across all of the Atlassian tools. Life has been good.

However, at the direction of the security team, we now want to switch to use OKTA to provide the SSO authentication most of all our apps. We have been able to setup Confluence to authentication the users. But so far we have not found a way to pull in the user's group info from AD in such a setup (we are on Confluence 6.2).

Does anyone know if this is possible (we would like to stay away from Crowd for now)

[Joe Birney]

Hi Amy

thanks for your feedback. That is what we tried to set up but apparently, it's not working just yet. 

[AnnWorley]

I cannot speak from personal experience but it is possible that the aggregating group memberships across user directories feature that was introduced with Confluence 5.7 may come in handy. The login would be controlled by the Okta directory but LDAP groups could still be used for Confluence permissions. This strategy is worth testing in your staging environment if possible.

Please review:

Managing Multiple Directories

Login
The directory order is significant during the authentication of the user, in cases where the same user exists in multiple directories. When a user attempts to log in, the application will search the directories in the order specified, and will use the credentials (password) of the first occurrence of the user to validate the login attempt.

Permissions
Aggregating membership (default)
The directory order is not significant when granting the user permissions based on group membership as Confluence uses an aggregating membership scheme by default. If the same username exists in more than one directory, the application will aggregate (combine) group membership from all directories where the username appears.

Example:

You have connected two directories: The Customers directory and the Partners directory.
The Customers directory is first in the directory order.
A username jsmith exists in both the Customers directory and the Partners directory.
The user jsmith is a member of group G1 in the Customers directory and group G2 in the Partners directory.
The user jsmith will have permissions based on membership of both G1 and G2 regardless of the directory order.