nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Single sign on with active directory credentials

Kenan Dervisevi

Are there any options or plugins that we can use to pass active directory credntials through to confluence (using Kerberos)?

We would like to have a user login to their PC on the domain, launch confluence and automatically be logged in using those same crednetials. Our environment is already LDAP integrated, however currently a user has to login in with their domain credentials into windows, then again into confluence with the same login.

What are our options in this scenario?

Accepted answers

All comments

onkeldom

+1 from me. We need a working solution as well (for Confluence and JIRA), since our last one broke up Office-Connector <-> Office 2010 functionality. So any hints about this topic would be appreciated.

Alejandro Conde Carrillo

There is a (paid) plugin for that: Single Sign-on.

unknown

Our company already delivered a working solution (Jira/Confluence authentication via AD/Kerberos) to an enterprise customer.

If you are interested feel free to contact us.

Regards from Hamburg, Kai

Steve Gerstner [bridgingIT]

If you are using an Apache in front of Conlfuence, you can use mod_auth_kerberos and use the HTTP-Header variable REMOTE_USER for Login.

Kenan Dervisevi

Do you have any more info regarding this, or can you elaborate a little further?

Sorin Sbarnea (

That's not expensive, it's most expensive piece of code I ever seen (when it comes of price/line of code written).

sdgew sdfwe

~~~ spam ~~~

Steve Gerstner [bridgingIT]

Use Apache for Authentication via Kerberos. This will store the Username in the headervariable REMOTE_USER.

In Confluence you need to extend ConfluenceAuthenticator's getUser-method to read the headervariable and to perform the login.

That's all

Ellen Feaheny [

AppFusions has deployed Kerberos SSO over 30 times for Confluence, JIRA, Crowd -

It is an authenticator AND service - since devil is in the details of configuration for sure. Not all deployments are alike.

We are working on having the Marketplace deployable - but even this will not be plug and play, but it will be close. And also will have a license so you can keep up to date with releases.

Best,

Ellen

Ellen Feaheny [

It is an Enterprise solution - and supported.

Ed Letifov _TechTime - New Zealand_

TechTime Initiative Group, an Atlassian Expert in New Zealand has been providing a solution to do NTLM authentication with Confluence and Jira for over 6 years. Though one can argue that this is not an SSO solution but merely an auto-login one, it works well in Windows-based environments.

We have over 60 customers successfully using this solution in New Zealand, Australia, Switzerland, Finland, Norway, Sweeden, France, Germany, Netherlands, Slovenia, Czech Republic, Turkey, Russia, Latvia, the UK and the USA both in NTLMv2 and NTLMv1 environments with and without Crowd in the backend.

The NTLM Authenticator is delivered as a jar file and instructions how to deploy it to Atlassian Jira and/or Confluence to work in conjunction with IOPlex Jespa to perform NLTM authentication in Windows environment.

The cost is one-off NZ$150 (plus fees for Jespa license payable to IOPlex). We do sell bundles that include IOPlex Jespa license.

If you need it, the trial version is available from our TurningRight website. Our NTLM Authenticators for Jira and Confluence support the latest versions of both applications.

We are currently working on moving it to Marketplace (Jan/Feb 2014) and as byproduct eventually making it support the rest of Atlassian tools (planned for 2nd quarter of 2014)

Marcos Sciarra

Hi Kai, its a commercial product or something you can share for free?

Bruno Vincent

You might want to have a look at the Integrated Windows Authentication for Apps using Crowd (IWAAC) plugin: https://marketplace.atlassian.com/plugins/com.cleito.iwaac/server/overview

IWAAC provides your Windows domain users with automatic logon on any application using Atlassian Crowd as its user management system, including Jira, Confluence, Bitbucket Server (previously known as Stash), Bamboo, FishEye, Crucible, Jenkins and G Suite (formerly Google Apps).

IWAAC is a generic plugin that works on all applications that are compatible with Crowd. Once you have purchased a proper license, you can deploy the plugin on as many applications (Confluence, Jira, Bamboo etc.) and server instances as you want since an IWAAC license is an Enterprise license that is valid for your entire organisation.

You can download IWAAC and test it for free at: https://www.cleito.com/products/iwaac/

Richard Cross_f74qtv

https://marketplace.atlassian.com/plugins/no.kantega.kerberosauth.kerberosauth-plugin.confluence/server/pricing

But I agree that it's expensive, given that Atlassian Crowd does so much more for the same price.

emailrichardchen

Hi KP, we are interested in using enterprise AD solution. can you share solution with us?

Richard Cross_f74qtv

"In Confluence you need to extend ConfluenceAuthenticator's getUser-method to read the headervariable and to perform the login."

That doesn't sound entirely trivial. Could you explain a little further?

AJ Greyling

Good day,

Please provide details of your solution

Regards

Jeevan Desarda_lpq0qh

Microsoft is offering this integration for FREE. You can use Azure Active Directory FREE version which comes with 500K directory objects. See the Free SKU details from here.

You can connect you existing Active Directory with Azure Active Directory using Azure AD Connect. Once you have all the users in Azure AD then you can simply use our FREE plugin listed here and then configure SAML based single sign on with Confluence server. All the instructions are listed here.

Feel free to post your queries on the article and we are happy to help.

Thanks.

Christian Reichert (resolution)

@Jeevan Desarda

Compatibility say up to Confluence 5.10 ... sure it's still actively maintained & supported?

Jeevan Desarda_lpq0qh

Yes, it is. Try it out and let us know how it goes!

Thanks,

Jeevan Desarda

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

active-directory

kerberos