nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Can confluence use windows authentication when connecting to Active Directory

Martin Jæger

When i create an AD user directory, i see the password of that user, in clear text, in the database.
Not cool. That would definetly not get approved, by the security team in my company.

I would like the AD lookup, to use windows authentication. I have already setup the confluence service to run as a domain account.

Can i somehow tell confluence. to use that security context for LDAP queries against my Active Directory?

Accepted answers

All comments

Tiago Comasseto

Hi Martin,

I really thing that some confusing may have happened as Confluence doesn't store LDAP passwords in plain text in the database.

Also, as for Integrated Windows Authentication, it can be done in two different ways for Confluence:

Cheers

Martin Jæger

Hi Tiago,

Thanks commenting.
Let me try to clarify.

When creating a LDAP user directory, i provide a username and password, that will be used when fetching users and groups. That password provided here, is saved to the database in clear text.

It is being saved to the table: [cwd_directory_attribute] with attributename as [ldap.password], and the password as value.

That is my concern.

It may be a solution to create a domain-account that has that single purpose, to read from AD, and then "live with" that it's password is revealed in the DB.

Another solution would be to use anonymous lookup, and configure the AD to allow anonymous access from the confluence servers specific IP address. Can that be configured in Confluence? (to use anonymous LDAP access)

Cheers!

Nic Brough -Adaptavist-

A third option on the authentication-in-windows thing - you might want to look at http://www.adaptavist.com/w/products-plugins/enterprise-products/adaptavist-umbrella/ (As well as "log into Windows and you're in Confluence too", it does SAML and some other stuff people ask for here)

And yes, this is a bit of a blatant plug, so I should say that I work for Adaptavist at the moment. I've not been involved in the development of it, it was there before I was, but I can vouch for the really good people who did write it.

Davin Studer

It is not in clear text in our installation. Sound like you've got a weird setup to me.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

confluence-administration