confluence and ldap authentication

Alex Samad YB

Hi

I am planning for installing confluence and using a ldap db for my users. just wondering how confluence authenticates users, does it do a ldap bind with the relevant user and password ?

What my setup is going to look like is, I have AD (say abc.com). I was going to setup a linux box running openldap so that i could create none AD users (our customer in here, why I don't want to pay for 000s of CAL licenses and I believe the MS connector license is prohibative but not ruled out. ) so all the clientes were going to exist in external.abc.com

do my ldap would look like

dc=abc,dc=com

ou=external,dc=abc,dc=com

DN's for AD look something like CN=alex samad,ou=abc,dc=abc,dc=com

where as DN's for clients could be something like

CN=<emailaddress>,ou=external,dc=abc,dc=com

Am I going to be able to configure confluence to handle that ?

Thanks

Alex

Andrew Frayling

Hi Alex,

For binding to LDAP Confluence can use either a single user or anonymous bind (if your LDAP is configured to allow anonymous bind) depending on whether you supply values for "Username" and "Password" in the LDAP config in Confluence.

If I'm understanding the second part of the question correctly, you only want Confluence to allow access for users in external.abc.com and not for users in abc.com? If that's the case then that's not a problem with Confluence as in the LDAP config you supply a base DN and Confluence will only look for users in that container and below, so if you set your base DN in Confluence to ou=external,dc=abc,dc=com then only users in that container and below will be able to log in.

For licensing in general a user counts against your Confluence license if they have the "Can Use" permission, so if you have 10,000 users in LDAP, but your Confluence LDAP is configured so that Confluence can only see 50 of them then that would be 50 against your license, not 10,000. Does that make sense?

For LDAP config have a look at http://confluence.atlassian.com/display/DOC/Connecting+to+an+LDAP+Directory

Hope that helps,

Andrew.