nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

NTLM Authenticator does not work any more with Confluence 4.x (probably same problem with 3.5.x) ?!?

Sven

Hello,

I just tried to get this to work:

https://studio.plugins.atlassian.com/wiki/display/NTLM/Confluence+NTLM+Authenticator

But from the Errors/Logfiles I've seen that there is a "missing" atlassian-users.xml-file. And this file doesn't exists any more after confluence 3.5...

Are there really so less Windows users who want to login to confluence with their windows credentials?

Is there currently no solution available?

Could there be a way to restore such an xml-file from confluence 3.4 and get it working this way?

Thanks for any hint,

Bye

Sven

--------------------------------

From the log-file

2011-11-29 13:19:17,728 ERROR [main] [net.ldap.atlassianuser.AUParser] parse The 'atlassian-user.xml' file could not be found at all. Bug!
2011-11-29 13:19:17,728 ERROR [main] [net.ldap.atlassianuser.AUParser] parse Problem reading 'atlassian-user.xml' file - The 'atlassian-user.xml' file could not be found at all. Bug!
2011-11-29 13:19:17,728 FATAL [main] [com.jnj.confluence.NTLMFilter] <clinit> Error loading ldap configuration (this isnt going to work)Unable to process atlassian-user file, IOProblem: The 'atlassian-user.xml' file could not be found at all. Bug!
2011-11-29 13:19:19,288 ERROR [http-80-1] [com.jnj.confluence.NTLMFilter] doFilter Exception during NTLM filter:java.lang.NullPointerException, msg=null

Accepted answers

Joe Clark

You could try either of these approaches (Note that both these mechanisms are unsupported by Atlassian unless you are using the SharePoint Connector for Confluence):

There is also a third-party vendor who supports an NTLM solution for Confluence, but I am unsure if they support Confluence 4 or not:

http://techtime.co.nz/display/TECHTIME/Home

All comments

David at David Simpson Apps

This could be an alternative:

https://plugins.atlassian.com/plugin/details/39713

Sven

Thanks for the answer! Only the pricetag is far too high ;-(

We have only a 50 user license, so about 1000 USD for a little more "comfort and security" is out of reach.

Is there no version "without install support" available? (around max. USD 200 or so ;-)

Thanks,

Sven

Joe Clark

You could try either of these approaches (Note that both these mechanisms are unsupported by Atlassian unless you are using the SharePoint Connector for Confluence):

There is also a third-party vendor who supports an NTLM solution for Confluence, but I am unsure if they support Confluence 4 or not:

http://techtime.co.nz/display/TECHTIME/Home

Sven

Another question:
On the suggested page about Jespa it is written "for Sharepoint Connector Customers only". What does this mean? Do I have to order the Sharepoint Connector to use this .jar-File? Do I need an additional Jespa-License in addition to the price of the sharepoint connector?

Thanks in advance for a short clarification...

Joe Clark

It will work perfectly fine without the SharePoint Connector, but Atlassian won't offer any support to you.

Sven

Hi, tanks for the suggestions.

I already contacted techtime, they say its compatible with 4.x! The Jespa-Pricetag is 200 USD from 25 to 500 Users, too. Hmm. I will look into the other options...

unknown

The project in the subject only broke a while back, I think when Oauth came in. The justification of effort to rewrite what is only an NTLM v1 'fakey' authenticator wasnt there. I dont support it and it should be pulled.

Jespa is the only native Java NTLM V2 authenticator library, +1 to TechTime for their impl and maintaining platform neutrality. I think that the product David refers to makes use of windows native DLLs making it platform dependant, which may or may not matter to you.

The issue with JESPA is that the license doesnt really work for resellers, its targetted at you, the end user who has the specific userbase.

Ed Letifov _TechTime - New Zealand_

Our NTLMv2/NTLMv1 authenticator supports Confluence 4.x as well as Jira 4.x. Our fees at the moment are one-off same as those from IOPlex. The authenticator works in Crowd environment as well as without Crowd. We are always open to requests if some killer feature is missing.

Sven

/EDIT

As of confluence 4.1 this is not working any more ;-(

/EDIT

Thank you everyboy for all your suggestions and informations.

I got it working without 3rd-Party-Software following this guide:

http://confluence.atlassian.com/display/SPCON011/Access+Confluence+using+Integrated+Windows+Authentication+via+IIS

There are some limitations, though. Perhaps I'll come back to a 3rd party connector ;-)

Eleveo Admin

Hi svenni, we had same problem as you wrote in comment on Dec 14 at 03:36 AM. steps you did we did same based on http://confluence.atlassian.com/display/SPCON/Access+Confluence+using+Integrated+Windows+Authentication+via+IIS+with+SP+2007

i've reported to atlassian and they send me new customauth-0.4.jar build which fixes errors for logg message "java.lang.ClassCastException: com.atlassian.confluence.user.SessionSafePrincipal cannot be cast to com.atlassian.user.User"

so i can send you if you want it

Sven

hey, yes, that sounds great! Yes please send it to me!

thanks a lot in advance!

Eleveo Admin

paste here your email because there is no private messages.

Sven

oh. yes, thats really something missing in here:

sven (dot) schaetzl (at,at) gmail (dot) com

(hope I'll not be spammed now, I doubled the "at" for fighting against spam bots... ;-)

Thanks in advance!

Sven

I've done another try - and it just works again... Don't know why ;-)

Sven

Its working again, don't know why ;-)

Sven

For Info:

What was not working any more with the downloadable "customauth-0.4.jar" is the following configuration in the server.xml-File:

        <Connector className="org.apache.coyote.tomcat4.CoyoteConnector" port="8090" minProcessors="5"
                   maxProcessors="75"
                   enableLookups="false" redirectPort="8443" acceptCount="10" debug="0" connectionTimeout="20000"
                   useURIValidationHack="false" URIEncoding="UTF-8"/>
					   
		
		<Connector port="8009" address="127.0.0.1" enableLookups="false" redirectPort="8443" protocol="AJP/1.3" tomcatAuthentication="false" URIEncoding="UTF-8" />

=> that means using two different connectors: One (port 80 via 8009) with IIS 7/NTLM/LDAP-ActiveDirectory authentication and the standard port "8090" to be able to still login with native confluence users ("admin") or SOAP-Clients.

This works again with the help of a new edition of "customauth-0.4.jar" (see comments to the original question).

Sven

Thanks a lot Tibor, with the help of this little updated .jar-file everything works again as before!

Ed Letifov _TechTime - New Zealand_

With all due respect, Kerberos may be theoretically better and the technology of the future, but in practice there are A LOT of caveats. As a company offering hands holding service to install your own solution in the clients' environments you should know that very well.

This is what I got in response when I asked Jespa's author for his opinion about NTLM vs. Kerberos:

Kerberos does not work if they client does not have access to the DC (and under a variety of other conditions) so NTLM will never be deprecated in favor of Kerberos. At least not Kerberos in it's current form. I suspect Microsoft will eventually add some extension of Kerberos that does not have these restrictions. But if they don't have that on the drawing board yet it will be many years before they can shelve NTLM.

Note that NTLM is actually better than Kerberos in many ways. Kerberos is very fickle. Kerberos clients must have direct access to DCs, DNS has to be exactly right for clients and servers, time has to be synchronized to within usually 5 minutes on the client, server and DC, if new Kerberos keys are distributed tickets can become stale and need to be purged. IOPLEX's first product was actually a Kerberos module for PHP. When I did Jespa I conscientiously decided to do NTLM instead because Kerberos is so fickle. I think that is one of the reasons why Jespa is so popular. It's easy to setup and once it is, it just works.

Ellen Feaheny [

Microsoft does not even recommend NTLM technology any more..

http://en.wikipedia.org/wiki/NTLM

Seems a bit short-sighted to go down this path with impact to lots of users, imho.

Bill_Campbell

Where does one obtain the new edition of "customauth-0.4.jar"? ie: "i've reported to atlassian and they send me new customauth-0.4.jar build which fixes errors for logg message "java.lang.ClassCastException: com.atlassian.confluence.user.SessionSafePrincipal cannot be cast to com.atlassian.user.User""

Thanks,

Bill

Joe Clark

The latest version is linked for download from our documentation - the latest version is currently 0.6 and is available for download here.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

authentication

ldap