nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

SSO not working after upgrade

Dovid Bender

Hi,

We recently upgraded our confluence install from 5.7 to 6.6.13 and SSO does not seem to be working. I made sure to update:

1)
seraph-config.xml (as it was before. I also did a diff from my changes to the last file and the only thing I see is:
< <param-value>/login.action?os_destination=${originalurl}&permissionViolation=true</param-value>
---
> <param-value>/login.action?os_destination=${originalurl}</param-value>
which I think is unrelated.

2) crowd.properties (as it was before).

I know that there is communication between confluence and crowd as I added a new user to crowd called me_test. I then was able to login directly to confluence. My only issue seems to be that SSO is not working between Confluence and everything else. Meaning if I log out of everything then login in say to jira, I can get access stash without logging in again and vice versa. However even if I am already logged into jira if I go to the confluence URL I still must login again. Is there any other setting that I am missing?

What's interesting is if if I log out of confluence it will also log me out of jira, stash etc.

EDIT: For all my applications I am using the AJP proxy with the exception of confluence which uses the mod_proxy.

Accepted answers

All comments

Edwin Kyalangalilwa

Hi @Dovid Bender ,

Based on Integrating Crowd with Atlassian Confluence

In seraph-config.xml - you'll comment out

<!-- <authenticator class="com.atlassian.confluence.user.ConfluenceAuthenticator"/> -->

and uncomment

<authenticator class="com.atlassian.confluence.user.ConfluenceCrowdSSOAuthenticator"/>

Dovid Bender

@Edwin Kyalangalilwa of course I tri that and it didn't work. My current config is:

<security-config>
<parameters>
<init-param>
<param-name>login.url</param-name>
<param-value>/login.action?os_destination=${originalurl}&permissionViolation=true</param-value>
</init-param>
<init-param>
<param-name>link.login.url</param-name>
<param-value>/login.action</param-value>
</init-param>
<init-param>
<param-name>cookie.encoding</param-name>
<param-value>cNf</param-value>
</init-param>
<init-param>
<param-name>login.cookie.key</param-name>
<param-value>seraph.confluence</param-value>
</init-param>

<init-param>
<param-name>authentication.type</param-name>
<param-value>os_authType</param-value>
</init-param>


<init-param>
<param-name>invalidate.session.on.login</param-name>
<param-value>true</param-value>
</init-param>

<init-param>
<param-name>invalidate.session.exclude.list</param-name>
<param-value></param-value>
</init-param>
</parameters>

<authenticator class="com.atlassian.confluence.user.ConfluenceCrowdSSOAuthenticator"/>

<services>
<service class="com.atlassian.seraph.service.PathService">
<init-param>
<param-name>config.file</param-name>
<param-value>seraph-paths.xml</param-value>
</init-param>
</service>
</services>

</security-config>

Edwin Kyalangalilwa

@Dovid Bender was Confluence restarted after this change?

dovi5988

Yes . I restarted it a few times . The only thing I wonder is if the other apps are using ajp connectors and confluence is using mod proxy.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

server

confluence-server