SSO for Confluence doesn't work.

[Jim Logan]

We updated JIRA from 8.5.7 – 8-18.2 and upgraded Confluence from 6-15-7 – 7.49

Now SSO doesn’t work and shows anonymous in the logs. 

LOGS SHOW:

2021-09-22 11:20:49,448 WARN [http-nio-8090-exec-11] [microsoft.saml.util.Util] base64encoded MS_WARN : Before base 64 encoding::<?xml version="1.0" encoding="UTF-8"?><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" AssertionConsumerServiceURL=https://ocioconfluence-test.doe.gov/confluence/plugins/servlet/saml/auth Destination=https://login.microsoftonline.com/6b183ecc-4b55-4ed5-b3f8-7f64be1c4138/saml2 ForceAuthn="false" ID="MSSSO_08238a94-91d2-44b4-aa32-47fd32127641" IsPassive="false" IssueInstant="2021-09-22T11:20:49Z" Version="2.0"><saml:Issuer>https://ocioconfluence-test.doe.gov/confluence/</saml:Issuer></samlp:AuthnRequest>

-- referer: https://ocioconfluence-test.doe.gov/confluence/login.action?errorOccured=User+is+not+available+in+Confluence.+Please+contact+your+Confluence+admin. | url: /confluence/plugins/servlet/saml/auth | traceId: 982a414452bea4b5 | userName: anonymous

2021-09-22 11:20:49,449 WARN [http-nio-8090-exec-11] [microsoft.saml.util.Util] base64encoded MS_WARN : After base 64 encoding::PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbHA6QXV0aG5SZXF1ZXN0IHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIHhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iIEFzc2VydGlvbkNvbnN1bWVyU2VydmljZVVSTD0iaHR0cHM6Ly9vY2lvY29uZmx1ZW5jZS10ZXN0LmRvZS5nb3YvY29uZmx1ZW5jZS9wbHVnaW5zL3NlcnZsZXQvc2FtbC9hdXRoIiBEZXN0aW5hdGlvbj0iaHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tLzZiMTgzZWNjLTRiNTUtNGVkNS1iM2Y4LTdmNjRiZTFjNDEzOC9zYW1sMiIgRm9yY2VBdXRobj0iZmFsc2UiIElEPSJNU1NTT18wODIzOGE5NC05MWQyLTQ0YjQtYWEzMi00N2ZkMzIxMjc2NDEiIElzUGFzc2l2ZT0iZmFsc2UiIElzc3VlSW5zdGFudD0iMjAyMS0wOS0yMlQxMToyMDo0OVoiIFZlcnNpb249IjIuMCI+PHNhbWw6SXNzdWVyPmh0dHBzOi8vb2Npb2NvbmZsdWVuY2UtdGVzdC5kb2UuZ292L2NvbmZsdWVuY2UvPC9zYW1sOklzc3Vlcj48L3NhbWxwOkF1dGhuUmVxdWVzdD4=

-- referer: https://ocioconfluence-test.doe.gov/confluence/login.action?errorOccured=User+is+not+available+in+Confluence.+Please+contact+your+Confluence+admin. | url: /confluence/plugins/servlet/saml/auth | traceId: 982a414452bea4b5 | userName: anonymous

2021-09-22 11:20:49,450 WARN [http-nio-8090-exec-11] [microsoft.saml.util.Util] prepareAuthnRequest MS_WARN : Target generated is:https://login.microsoftonline.com/6b183ecc-4b55-4ed5-b3f8-7f64be1c4138/saml2?SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbHA6QXV0aG5SZXF1ZXN0IHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIHhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iIEFzc2VydGlvbkNvbnN1bWVyU2VydmljZVVSTD0iaHR0cHM6Ly9vY2lvY29uZmx1ZW5jZS10ZXN0LmRvZS5nb3YvY29uZmx1ZW5jZS9wbHVnaW5zL3NlcnZsZXQvc2FtbC9hdXRoIiBEZXN0aW5hdGlvbj0iaHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29...

-- referer: https://ocioconfluence-test.doe.gov/confluence/login.action?errorOccured=User+is+not+available+in+Confluence.+Please+contact+your+Confluence+admin. | url: /confluence/plugins/servlet/saml/auth | traceId: 982a414452bea4b5 | userName: anonymous

2021-09-22 11:20:49,969 ERROR [http-nio-8090-exec-7] [microsoft.saml.util.SignatureValidator] validate MS_INFO : SignatureValidator started to validate signature tags

-- referer: https://login.microsoftonline.com/ | url: /confluence/plugins/servlet/saml/auth | traceId: b5944bc2aaab2de4 | userName: anonymous

2021-09-22 11:20:49,971 ERROR [http-nio-8090-exec-7] [microsoft.saml.util.SignatureValidator] validate MS_INFO : SignatureValidator Completed  validation of signature tags

 -- referer: https://login.microsoftonline.com/ | url: /confluence/plugins/servlet/saml/auth | traceId: b5944bc2aaab2de4 | userName: anonymous

2021-09-22 11:20:49,972 WARN [http-nio-8090-exec-7] [microsoft.saml.util.XMLUtility] validateSignNode MS_WARN : certificate found in signature

 -- referer: https://login.microsoftonline.com/ | url: /confluence/plugins/servlet/saml/auth | traceId: b5944bc2aaab2de4 | userName: anonymous

2021-09-22 11:20:49,976 ERROR [http-nio-8090-exec-7] [atlassianplugin.confluence.servlet.ConfluenceSSOLoginServlet] authenticateUserAndLogin MS_ERROR : User is not available in Confluence. Please contact your Confluence admin :6GM2SDgs8w4-etWa9iB8BDoSv4SfA-qbtr2D3P1L330

-- referer: https://login.microsoftonline.com/ | url: /confluence/plugins/servlet/saml/auth | traceId: b5944bc2aaab2de4 | userName: anonymous

2021-09-22 11:20:49,983 ERROR [http-nio-8090-exec-7] [microsoft.atlassianplugin.applicationinsight.ApplicationInsightUtil] logException MS_ERROR : Exception message = User is not available in Confluence. Please contact your Confluence admin.

tenantID = 6b183ecc-4b55-4ed5-b3f8-7f64be1c4138

appID = 9cb91197-9d25-4067-9fc8-b131e1b6e5f8

userID = 6GM2SDgs8w4-etWa9iB8BDoSv4SfA-qbtr2D3P1L330

-- referer: https://login.microsoftonline.com/ | url: /confluence/plugins/servlet/saml/auth | traceId: b5944bc2aaab2de4 | userName: anonymous

[Kishan Sharma · Accepted solution]

thanks for the details. If you perform Quick Test, what results do you get ? just to make sure that the username/password is correct so that sync can work.

[Jim Logan]

Test Remote Directory Connection
Test Remote Directory Connection
Use this form to test the connection to Atlassian Crowd directory 'Remote JIRA Directory'.

For extended testing enter the credentials of a user in the remote directory.

Test basic connection : Succeeded
Test retrieve user : Succeeded
Test user rename is configured and tracked : The Unique ID Attribute has been left blank. We recommend you set this to the attribute for the UUID of the user.
Test get user's memberships : Succeeded, 9 groups retrieved
Test retrieve group : Succeeded
Test get group members : Succeeded, 19 users retrieved
Test user can authenticate : Not performed
User name
james.logan
Password
••••••••••••••••••••••••••
Back to directory list

[Kishan Sharma]

Great, so you have got this working now already ?

[Kishan Sharma]

Hi @Jim Logan The error says "User is not available in Confluence." Have you verified if the user exists in the confluence user directory ? It's not working for all users or just few users ? 

[Jim Logan]

Hi @Kishan Sharma , 

The users exist in the confluence directory and it works for me and nobody else.

[Kishan Sharma]

Thanks for confirming Jim. If you go to User directories, can you test the directory sync ? when was it last successful ?

[Jim Logan]

- Test user rename is configured and tracked : The Unique ID Attribute has been left blank. We recommend you set this to the attribute for the UUID of the user.

- Test user can authenticate : Not performed

[Jim Logan]

=== Current user ===
Directory ID: 294913
Username: james.logan
Display name: Jim Logan
Email address: james.logan@hq.doe.gov

=== Directories configured ===
Directory ID: 294914
Name: Confluence Internal Directory
Active: true
Type: INTERNAL
Created date: 2018-07-18 11:54:33.151
Updated date: 2018-07-18 11:54:33.151
Allowed operations: [CREATE_USER, DELETE_GROUP, UPDATE_USER_ATTRIBUTE, CREATE_ROLE, CREATE_GROUP, UPDATE_ROLE, UPDATE_ROLE_ATTRIBUTE, DELETE_ROLE, UPDATE_GROUP_ATTRIBUTE, DELETE_USER, UPDATE_GROUP, UPDATE_USER]
Implementation class: com.atlassian.crowd.directory.InternalDirectory
Encryption type: atlassian-security
Attributes:
"user_encryption_method": "atlassian-security"

Directory ID: 294913
Name: Remote JIRA Directory
Active: true
Type: CROWD
Created date: 2018-07-18 11:54:32.978
Updated date: Fri Sep 24 15:01:18 EDT 2021
Allowed operations: [CREATE_USER, DELETE_GROUP, UPDATE_USER_ATTRIBUTE, UPDATE_ROLE_ATTRIBUTE, CREATE_GROUP, UPDATE_ROLE, CREATE_ROLE, DELETE_ROLE, UPDATE_GROUP_ATTRIBUTE, DELETE_USER, UPDATE_GROUP, UPDATE_USER]
Implementation class: com.atlassian.crowd.directory.RemoteCrowdDirectory
Encryption type: null
Attributes:
"application.name": "Confluence - ocioconfluence.doe.gov - d9687ab7-6f4d-3b28-8ebb-29c4d7981a8c"
"application.password": ********
"com.atlassian.crowd.directory.sync.cache.enabled": "true"
"com.atlassian.crowd.directory.sync.issynchronising": "false"
"com.atlassian.crowd.directory.sync.lastdurationms": "946"
"com.atlassian.crowd.directory.sync.laststartsynctime": "1632510077604"
"crowd.server.http.max.connections": "20"
"crowd.server.http.timeout": "5000"
"crowd.server.url": "http://ocioconfluence-test.doe.gov:8080/jira"
"crowd.sync.group.membership.after.successful.user.auth.enabled": "true"
"crowd.sync.incremental.enabled": "false"
"directory.cache.synchronise.interval": "3600"
"useNestedGroups": "true"

[Jim Logan]

Current Settings

Initial Pool Size:1

Preferred Pool Size:10

Maximum Pool Size:0

Pool Timeout (seconds):30

Pool Protocol:plain ssl

Pool Authentication:simple

Update Settings

Initial Pool Size:

Number of connections to create when initially connecting to the pool.

Preferred Pool Size:

Idle connections will be removed from the pool if the pool is larger than the preferred size.

Maximum Pool Size:

Maximum number of connections to the LDAP server. Value of 0 means no maximum. Note that requests will block if there is no available connection.

Pool Timeout (seconds):

Idle time for a connection before it is removed from the pool. Value of 0 means there is no timeout.

Pool Protocol:

Space-separated list of protocols for which connections will be pooled. Valid types are: plain, ssl.

Pool Authentication: