Confluence user can't login due to JIRA domain update

Celtis Omaris

The way we have set up jira and confluence servers is that the Jira instance has all the users and their credentials and confluence uses those users and credentials to login to confluence.

Our jira instance was running without SSL and on port 8080 and we have since moved it to SSL and now the users can't use their credentials to log into confluence.

I've tried restoring the domain to port 8080, logging into confluence and keeping the session logged in so I can update the application link after transitioning back to SSL but that doesn't work.

I did a grep on all the files on the server and couldn't see where it might be set up so I can change it.

I did a search in the confluence DB and found some entries that looked like they needed updating also, and I ran the below commands to update them but still didnt work.

 

UPDATE cwd_directory_attribute
SET attribute_value = REPLACE(attribute_value, 'http://DOMAIN:8080', 'https://DOMAIN')
WHERE attribute_value LIKE '%'http://DOMAIN:8080%'

UPDATE BANDANA
SET BANDANAVALUE = REPLACE(BANDANAVALUE, 'DOMAIN:8080', 'https://DOMAIN')
WHERE BANDANAVALUE LIKE '%DOMAIN:8080%'

 

Any more Ideas?

Andy Heinzer

Hi,

I understand that you have recently changed the site address where Jira is reachable (from http to an https address) and since that time, users are unable to login to Confluence.  I see that you have tried to use some SQL to update values here.  However I would recommend against this method to try to correct this problem.  It might work, but sometimes there are caches that have to be cleared in the application when making direct SQL changes like this that can only be achieved by restarting the application itself.

Instead, I would recommend trying to follow Restore Passwords To Recover Admin User Rights to then at least be able to have one user internal to Confluence as a admin be able to login.   From there you will probably need to setup this application link and Jira user server settings again. But before you do that, I have some questions for you:

1. Is Jira's Tomcat handing SSL directly?  Or do you have a proxy / loadbalancer in front of Jira's Tomcat that is terminating the SSL connection here?
2. Is Confluence using HTTP or HTTPS/SSL at all?

 

Ideally, I would prefer to try to have both applications (Jira and Confluence) using the same protocol when communicating with each other (either both using HTTP or both using HTTPS).  It tends to avoid the mixed content errors for the sake of application links, and other complications that can prevent this integration from working.    Both applications will use the $install/conf/server.xml file to manage what Connectors are setup for each respective Tomcat instance. It is possible to have more than one connector defined here, which might be needed if say Jira is using HTTPS and Confluence is not.

The additional tricky part though here is that using SSL has added requirements.  Namely, each application has to then have the SSL certificate of the other application in its Java truststore, otherwise it won't be able to establish an SSL connection here.  So in your case, at the very least we would want to make sure that Confluence's java truststore contains this new Jira SSL certificate.  Steps on how you can import this are explained in such documents as How to import an existing SSL certificate for use in Tomcat and/or How to import a public SSL certificate into a JVM.

And conversely, if Confluence is also running over HTTPS, you would want to make sure that Jira has the Confluence certificate in its truststore.

It would be helpful to take a closer look at the $ConfluenceHOME/logs/atlassian-confluence.log file as well.  I suspect this has some other details in the stacktraces that might help to clarify the connection problem here.  I am thinking that you might be encountering the problem documented in Unable to connect to SSL services due to "PKIX Path Building Failed" error.  But even if you are not, the diagnosis steps in that article could still be helpful to follow here just so we can learn more about your specific environment.

Andy