How to login to Confluence when kerberos authentication is used programatically

[Prakash Tandukar]

We have Confluence Server 4.1 version installed. It is using AD authentication (Kerberos/Windows Security).

When we enter the http://confluenceURL in the address bar of browser, then it shows following pop-up windows for entering the credentials.

Users access Confluence through their local machines when they’re logged onto the domain. They are already logged into the domain, so are not prompted for a login. Users can easily view, add pages in Spaces.

We have followincg C# code to connect to Confluence, but it could not connect.

ConfluenceSoapServiceService service = new ConfluenceSoapServiceService();

                    service.Url = "http://myserver/rpc/soap-axis/confluenceservice-v2";
                    service.UseDefaultCredentials = true;
                    Token token = service.login(username, password);

It throws following exception from the last line while calling serviec.login() method:

Error connecting to Confluence server url 'http://confluence/'. Please check ServerAddress, Username and Password. System.Web.Services.Protocols.SoapException: com.atlassian.confluence.rpc.AuthenticationFailedException: Attempt to log in user 'null' failed - incorrect username/password combination.
at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)
at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
at ConfluenceAPIWebsServiceVersion2.ConfluenceSoapServiceService.login

Remote API (XML-RPC & SOAP) was already enabled. Basically, I wanted to login and get the token - which can be later passed for calling other functions of the soap API.

Could anybody sheds some light on how to connect\login to Confluence?

Ref: https://answers.atlassian.com/questions/7674/does-the-appfusions-kerberos-sso-authenticator-for-confluence-work-with-the-confluence-remote-api

[Bruno Vincent]

Steve is absolutely right.

There might also be a sub-option of Option 1 if you use Crowd as the user management system of your Confluence instance. You could actually use Crowd's REST API to get a Crowd SSO token that you would then insert in your HTTP requests to Confluence. I guess this is quite easier than getting a valid Kerberos ticket.

As for Option 2, if you use the IWAAC plugin (Integrated Windows Authentication for Apps using Crowd), you can disable Windows Authentication for a set of URLs, for instance /rpc.

[Steve Gerstner [bridgingIT]]

Option 1: You need to get a valid kerberos ticket in your c# solution and send it with your request to confluence

Option 2: Do not force kerberos authentication, this allows confluence in the background to accept other authentication forms. Maybe you can just disable it for the rest and rps/soap apis?

Option 3: Depending on your solution of kerberos... If it's not on the webserver (apache/iis) you can extend your authenticator to allow differnet forms of authentication.

[David at David Simpson Apps]

Feel free to contact info@appfusions.com if you're interested in the AppFusions solution.