Confluence Shibboleth Authenticator

Question

Dear experts, we will implement a SSO between Active Directory and Confluence. I found a set of plugins and tools: - SSO Authenticators AppFusions (via kerberos) - Waffle NTLM Filter - Shibboleth First I try the waffle NTLM filter which is only running in windows environment. The filter sets the remote_user in http header, I write my own authenticator. The authenticator is running and i can now login via sso. But I found a set of problems. e.g. Press on Logout link always do a login again ... etc. Therefore I tried shibboleth. I do all steps which are descriped here:https://studio.plugins.atlassian.com/wiki/display/SHBL/How+to+Shibbolize+Confluence But always when I login, i get an Page Not found message! My first question is: In seraph-config.xml I defined the following parameters:

login.url

http://wikiq.endress.com/Shibboleth.sso/Login?target=${originalurl}

But I dont know how confluence can handle Shibboleth.sso, in my point of view I have to define this url anywhere! Is it lika a servlet? Can anybody tell me, how I can define a wiki.bla.bla/XYZ placeholder? For my waffle implemtation scenario it would be useful two, that I can implement different rules! Best regards, Timo

Gary Weaver · Answer

Note: the project is moving since Jira Studio is going to be shutdown. The new link is: https://marketplace.atlassian.com/manage/plugins/shibauth.confluence.authentication.shibboleth or https://github.com/chauth/confluence_http_authenticator

Ellen Feaheny [ · Answer

Well a few comments -and lots of opinions.

One more for the pot!

If you believe Wikipedia (http://en.wikipedia.org/wiki/NTLM) that Microsoft doesn't even recommend NTLM anymore, and alot of cries from the field on NTLM pains.

... well that's all. Its your call.

This doc sorts out the different options at a more literal level, and it is OUR opinion that Kerberos is the right choice:

https://www.appfusions.com/display/KBRSCJ/NTLM+v1+or+v2+or+Kerberos

AppFusions has been deploying Kerberos authenticators with Confluence, JIRA, Crowd, and Fisheye with much success for a few months now. And happy to provide you with referrals to our customers.

We tried giving our Authenticator away in the beginning (and just provide support), but NO ONE could figure out the configs by themselves without endless free-only support questions to us, which was worse. We have a day job that pays us, and honestly this should too if we get you on your way happily, swiftly.

The questions were not b/c it was bad or didn't work; it was b/c a) its complicated, and b) there are many variables in the network with IIS, browser and OS deltas, forms, multiple AD directories, mobile users, etc...

So, now we offer a very reasonable "authenticator + service included deployment" and have had 100% success since.

Happy to help you - info@appfusions.com

Best,

Ellen

p.s.

imho: This is not an advertisement per se -

This area is just a serious pain pt, and customers can kill weeks trying to figure it out, or learn alongside us doing it for you; we share our knowledge with all customers in all our services, just as or team does on Answers.atlassian.com.

Ed Letifov _TechTime - New Zealand_ · Answer

If you need to integrate Confluence with Active Directory so it does SSO on any platform - we have it.

http://techtime.co.nz/x/AwCxAg

The NTLM Authenticator is delivered as a jar file and instructions how to deploy it to Atlassian Jira and/or Confluence to work in conjunction with IOPlex Jespa library to perform NLTM authentication in Windows environment.

The cost is one-off NZ$150 (plus fees for Jespa license payable to IOPlex).

TechTime NTLMv2/NTLMv1 authenticator supports Confluence 4.x as well as Jira 4.x. The authenticator works in Crowd environment as well as without Crowd.

We are always open to requests if some killer feature is missing.